Putting the matrix to work
Lesson 5 of 5 in The GenAI Security Scoping Matrix: Know What You’re Securing.
AWS built the matrix to be adopted into internal process, and it names three: procurement, evaluation, and security-architecture scoping. In procurement, ask the scope question before the contract question — a vendor pitching an enterprise app with genAI features is offering Scope 2, so the diligence checklist writes itself: training opt-outs, data-handling terms, provider availability. In use-case intake, make which scope? the first field on the form; it tells the reviewer instantly whether they are reading ToS or threat-modeling a RAG pipeline. In architecture reviews, the scope declares which party owns each layer — and therefore which findings are yours to fix versus your provider’s to answer for.
It also composes with the rest of this domain. The Guardrail Catalog and the cloud-guardrails module supply the concrete controls the matrix’s controls column calls for at Scopes 3–5. The GenAI Lens turns a scoped workload into a full Well-Architected review — scoping tells you what you own; the lens interrogates how well you run it. And the Responsible AI Lens adds the fairness and transparency questions the security matrix deliberately leaves to others. Scope first; the rest of your toolchain snaps onto the result.
Which scope is this workload?
Interactive decision tree — outcomes:
- Scope 1 — Consumer app
You own nothing here. Duties: usage policy (public, non-proprietary data only — submissions may train the provider’s model), ToS review, and awareness that provider availability is out of your hands.
- Scope 2 — Enterprise app
The contract is your control surface. Duties: negotiate protections and opt-outs so proprietary data is not used for training, set data-classification policy for what may enter the tool, and assess provider risk and availability.
- Scope 3 — Pre-trained model
You own the application and its data flows; the model stays the provider’s. Duties: validate both service-provider and model-provider terms, threat-model for AI safety and data security, and enforce least privilege before the context window.
- Scope 4 — Fine-tuned model
Your data is in the weights now. Everything from Scope 3 plus: classify the model at the highest sensitivity of its training data, gate inference to users cleared for that level, keep PII out of training, and remember the erasure-means-retraining problem.
- Scope 5 — Self-trained model
You own every aspect. All building-scope duties plus: your legal team writes the terms of service for external users, the training corpus is a regulated asset, and no provider stands between you and any obligation.
One more payoff: the scopes crosswalk onto the governance frameworks this site teaches. The mapping below is our practitioner reading — useful for spotting which obligations a scope tends to attract, never a substitute for legal analysis of the workload itself.
| Scope group | EU AI Act lens | ISO/IEC 42001 lens | NIST AI RMF lens |
|---|---|---|---|
Buy (Scopes 1–2) | You look like a deployer: using AI under your authority, someone else provides it. Deployer duties — oversight, input relevance, usage transparency — dominate. | Supplier-management territory: Annex A controls on third parties and data expect you to verify vendor claims, not just collect them. | Map and Govern do the heavy lifting: inventory the use, assess the third party, set usage policy. |
Build on a model (Scopes 3–4) | Role risk rises with ownership. Substantially modifying a system — or putting your name on it — can drift you toward provider duties; fine-tuning a GPAI model can attract provider-of-GPAI analysis. Get a role opinion per workload. | The management system now covers your development lifecycle: impact assessment, data governance for tuning corpora, and supplier controls for the model beneath you. | All four functions engage — Measure and Manage especially, since evaluation and threat modeling of your own pipeline are now in scope. |
Own it all (Scope 5) | You are the provider (and, for GPAI-class models, potentially a GPAI-model provider) — conformity, documentation, and downstream-information duties run to you. | Full-stack AIMS coverage: nothing is inherited from upstream, so every control objective lands on your organization. | The full lifecycle is yours to Govern, Map, Measure, and Manage — including the profile choices a model provider must make for downstream users. |
Tool: Scoping Matrix Navigator — Open the Scoping Navigator: an interactive version of the five-by-five matrix plus a wizard that walks a real workload through the scope questions and hands back the discipline checklist for its row.
Interactive checkpoint quiz (1 questions) — open this page in a browser to take it.