A fast pass over responsible AI, security, and governance: the eight dimensions by name, and the terms that get skimmed past because they sound generic.
The eight responsible-AI dimensions at a glance
| Dimension | Canonical scope |
|---|---|
| Fairness | Considering impacts on different groups of stakeholders |
| Explainability | Understanding and evaluating system outputs |
| Privacy and security | Appropriately obtaining, using, and protecting data and models |
| Safety | Preventing harmful system output and misuse; about what the model emits |
| Controllability | Mechanisms to monitor and steer system behaviour: intervene, override, shut down |
| Veracity and robustness | Correct output even under unexpected or adversarial input |
| Governance | Best practices carried through the AI supply chain, providers and deployers included |
| Transparency | Stakeholders can make an informed choice about engaging with the system, starting with knowing it is AI |
Responsible-AI vocabulary at a glance
These are ordinary English words carrying specific meanings, which is why they get skimmed. Four describe a dataset, three describe a way of finding bias in one, and the rest sit around model selection and the design of an explanation. The dataset four are the ones checked before anyone decides a dataset is fit to train on.
| Term | What it covers |
|---|---|
| Inclusivity (dataset characteristic) | The dataset represents the people the system will be used on, including the groups easiest to leave out |
| Diversity (dataset characteristic) | Range across the variation that matters: demographics, dialects, devices, conditions of capture |
| Curated data sources | Sources chosen deliberately, with a known origin and licence, rather than scraped and accepted as found |
| Balanced datasets | Group sizes proportioned so no group is a rounding error in training or evaluation |
| Analyzing label quality | Bias detection aimed at the labels: who applied them, how consistently, whether the rule shifted by group |
| Human audits | Bias detection by people reading real cases, rather than reading a metric |
| Subgroup analysis | Bias detection by scoring the model once per group instead of once overall |
| Environmental considerations and sustainability | A model-selection criterion: a smaller model, or one already trained, does the same job for less energy |
| Principles of human-centered design for explainable AI | Designing for the person a decision lands on: user-feedback mechanisms and AI decision transparency |
| User-feedback mechanisms | A way for that person to mark an output wrong, wired into a queue somebody works |
| AI decision transparency | Telling that person a model was involved, what it worked from, and how to reach a human who can override it |
| Tradeoffs between model safety and transparency | Publishing weights, evaluation detail and failure modes serves accountability and also helps an attacker |
Those three bias-detection techniques are the ones a team keeps running after launch rather than once before it.
The five legal risks of a generative feature
| Risk | What it looks like |
|---|---|
| Intellectual property infringement claims | Output reproduces training material closely enough for a rights holder to object |
| Biased model outputs | Outputs land unevenly across groups, and the organisation carries the consequence |
| Loss of customer trust | One visible failure does more damage to confidence than the feature adds in efficiency |
| End user risk | Somebody acts on a wrong answer in a setting where acting on it does harm: medical, legal, financial |
| Hallucinations | Fluent, unsupported output presented as fact, with nothing in the response marking it as unsupported |
Naming the risk is the first half; each of the five has a control that reduces it and the controls are different from each other.
Why the AWS infrastructure underneath counts
AWS describes the benefit of its infrastructure for generative AI under four headings, each with concrete services behind it. This sits underneath the building blocks a GenAI application is assembled from.
| Benefit | What it means for a GenAI application |
|---|---|
| Security | IAM scopes who may invoke which model, AWS KMS encrypts data at rest, TLS encrypts it in transit, and an AWS PrivateLink interface endpoint keeps Bedrock traffic off the public internet |
| Compliance | AWS Artifact supplies AWS’s own SOC reports, ISO and PCI certificates and AWS agreements; Region choice decides where data sits; content sent to Bedrock is not used to improve base models or shared with model providers |
| Responsibility | In one line for GenAI: AWS operates the infrastructure and hosts the model; you own your data, prompts, IAM configuration, and the compliance of your usage |
| Safety | Amazon Bedrock Guardrails applies content filters, denied topics, word filters, sensitive-information filters and contextual grounding checks to the prompt going in and the response coming out, whichever model answered |
Security and governance terms at a glance
The layer each of these belongs to is worked out in sorting an AI security risk into the layer that owns it, and the matching of a worry to a control in choosing the control that actually answers it.
| Term | What it covers |
|---|---|
| Interpretability | Understanding a model’s internal mechanics: how it actually computes an output |
| Explainability (as distinct from interpretability) | A post-hoc account of why a specific output happened, without opening the model up |
| Fairness-through-unawareness | The naive, failing fix of deleting a protected attribute from the data |
| Shared responsibility model (Bedrock) | AWS owns infrastructure and model hosting; you own your data, prompts, IAM configuration, and compliance of your own usage |
| Amazon Macie | Finds PII and other sensitive data in S3 |
| Amazon Inspector | Finds software vulnerabilities and unintended network exposure in EC2 instances, ECR container images, and Lambda functions |
| AWS Config | Tracks resource configuration and evaluates it against rules |
| AWS Artifact | AWS’s own downloadable compliance documents: SOC reports, ISO and PCI certificates, plus AWS agreements |
| ISO/IEC 42001 | The AI management system standard; 27001’s sibling, for AI governance specifically. AWS itself is certified against it |
| Direct prompt injection | Malicious instructions arrive through the instruction channel: the user’s own message |
| Indirect prompt injection | Malicious instructions arrive through the data channel: a retrieved document, a tool result, a webpage |
| Jailbreaking | Getting a model to override its own safety training via crafted prompts, distinct from injection |
| AWS PrivateLink | A private network path to Bedrock through a VPC interface endpoint. It changes the route the request takes, not the cryptography |
| Encryption at rest and in transit | AWS KMS for at rest, TLS for in transit. AWS managed keys rotate yearly and that is not adjustable; a customer managed key gives you the key policy, a CloudTrail record of every use, and the ability to disable it or schedule deletion |
| Amazon Bedrock AgentCore Identity | Establishes which workload is asking before the agent runs, and holds its OAuth tokens and API keys in the token vault |
| Policy in AgentCore | Cedar policies held in a policy engine, evaluated on every tool call an agent makes through an AgentCore Gateway |
| AWS CloudTrail | Who called which API, when, and from where |
| Bedrock model invocation logging | What the prompt and the completion actually said, delivered to S3 or CloudWatch Logs. Disabled until you turn it on |
| AWS Trusted Advisor | Account-level best-practice checks in six categories: cost optimisation, performance, security, fault tolerance, service limits, and operational excellence |
| AWS Well-Architected Tool | A recorded workload review against the pillars, leaving a dated document with owners and improvement items |
| Data lineage | Which run, which source, which version produced this record. Produced by the pipeline that moved the data |
| Data cataloguing | An inventory of the datasets themselves: what exists, who owns it, what may be done with it |
| Source citation | Which passage of which document supported this sentence, produced at answer time by the application |
| Amazon SageMaker Model Card | The build history of one model: intended use, risk rating, training details, evaluation results, limitations |
| Generative AI Security Scoping Matrix | AWS’s framework sorting a generative use into five scopes by how much of the stack you own: consumer app, enterprise app, pre-trained model, fine-tuned model, self-trained model |
| Privacy-enhancing technologies | Redaction removes a value; masking hides part of one; pseudonymisation swaps an identifier for a token reversible with the key. Anonymisation aims at no reversal at all, and differential privacy adds calibrated noise so no single record changes the result |
| Data integrity | The record is still what it was. Amazon S3 versioning keeps the previous copy when something is overwritten; S3 Object Lock adds WORM protection, blocking overwrite and deletion for a retention period or until a legal hold is lifted |
| Residency | Which Region data sits in. Set by Region choice, then widened by a cross-Region inference profile: a geographic profile routes within one geography such as US or EU, a global profile to any supported commercial Region |
| Retention | How long each copy lives: S3 lifecycle rules to expiry or to Amazon S3 Glacier, and CloudWatch Logs retention, which stores data indefinitely until you set it |
| Output filtering and validation | Checking a response before a person sees it: guardrail content filters for toxicity, plus your own schema, range, and policy checks |
| Toxicity | Harmful, abusive, or insulting content in the output. A content-filter category, not a service of its own |
| Retrieval Augmented Generation [RAG] grounding | Putting source passages into the prompt so the model continues text that already contains the answer |
| Confidence scoring | A number attached to an answer so a low one can be routed to a human. A classifier’s probability is calibrated against a validation set; a language model’s stated confidence is not |
Decision rules
- If the concern is equitable impact across groups, name it fairness; if the concern is why an output happened, name it explainability. Do not reach for a control before naming the dimension.
- If the concern is a model emitting something harmful, that is safety. If it is a human’s ability to intervene, override, or shut the system down, that is controllability. The two are adjacent and frequently swapped.
- If the concern is disclosing that a system is AI at all, or how it works, that is transparency. Governance is the set of practices carried through the AI supply chain, not the disclosure itself.
- If a review asks for a model’s internal mechanics, that is interpretability; if it asks for an after-the-fact account of one output, that is explainability. An LLM rarely supports the first.
- If someone proposes fixing bias by deleting the protected attribute from the data, name the trap: fairness-through-unawareness. Other features still act as proxies, and now the bias cannot even be measured.
- If the concern is Bedrock infrastructure or model hosting, that is AWS’s side of shared responsibility. Your data, prompts, IAM, and usage compliance are yours.
- If PII in a data store is the concern, use Macie; if vulnerabilities in a workload are the concern, use Inspector; if configuration drift against a rule is the concern, use Config. Three different objects being checked.
- If you need AWS’s own compliance evidence, that is AWS Artifact. If you need your own model’s documentation, that is an Amazon SageMaker Model Card. If you need evidence of your own usage, no single service hands it over: AWS Config carries resource state and AWS CloudTrail carries who did what. Match the author to the artefact.
- If malicious instructions arrive in the user’s own message, that is direct injection; if they arrive through a retrieved document or tool result, that is indirect injection. The channel is the tell, not the intent.
- If a crafted prompt is getting the model to override its own safety training rather than an application’s instructions, name it jailbreaking, not injection.
- If the concern is what stops harmful output reaching a user of a GenAI application, that is the safety benefit of the AWS infrastructure. The named control is Amazon Bedrock Guardrails, on the prompt and on the response.
- If the concern is a per-decision reason for the person affected, that is human-centered design for explainable AI. It needs plain-language reason codes, a user-feedback mechanism, and an appeal path, and none of that is what a model card delivers.
- If the concern is that publishing weights and evaluation detail would help an attacker, name the tradeoff between model safety and transparency. It resolves by disclosing enough for accountability without publishing an attack recipe.
- If the worry is the labels themselves, analyse label quality; if it is a group the model fails, run subgroup analysis; if it is behaviour no metric captures, commission human audits.
- If a model-selection scenario names environmental considerations or sustainability, the responsible answer is the smallest model that does the job, and reusing a trained one rather than training your own.
- If the concern is who called the model, that is AWS CloudTrail; if it is what the prompt and the completion said, that is Bedrock model invocation logging. Only the first is on by default.
- If a named resource has to be evaluated against a rule continuously, that is AWS Config. If the ask is account-wide best-practice checks with no rule of your own, that is AWS Trusted Advisor. If it is a dated review of a whole workload, that is the AWS Well-Architected Tool.
- If the concern is where this sentence came from, that is source citation; where this dataset came from, data lineage. What datasets exist and who owns them is data cataloguing; how this model was built is an Amazon SageMaker Model Card.
- If a response is harmful, a content filter catches it; if a response is unsupported by the retrieved passages, only a grounding check catches it. A filter reads the text on its own, a grounding check compares it against the passages retrieval put in front of the model.
- If the requirement is that traffic never crosses the public internet, that is AWS PrivateLink and a VPC interface endpoint. If it is that nobody can read the data, that is encryption at rest and in transit. Route and cryptography are separate requirements with separate answers.
- If which controls are yours has to be settled before naming any of them, sort the use into the Generative AI Security Scoping Matrix first. The scope decides the obligation, and the five run from consumer app to self-trained model.
Traps
- Reaching for “safety” whenever anything sounds risky. Safety is specifically about harmful output; a human-oversight question is controllability even if it feels adjacent.
- Treating transparency and governance as the same dimension because both sound like paperwork. Transparency is disclosure to stakeholders; governance runs the practices and accountability across the supply chain.
- Promising interpretability on a foundation model. What you can actually deliver is explainability as traceability: citations, documented behaviour, a stated rationale.
- Assuming removing a protected attribute makes a model fair. It is fairness-through-unawareness, and it typically makes bias worse and unmeasurable.
- Reading shared responsibility as AWS taking your side of it too. AWS secures the infrastructure and hosts the models; your data, prompts, IAM configuration, and the compliance of your own usage stay yours, however managed the service is.
- Mixing up Macie, Inspector, and Config because all three sound like general “security scanning”. Each checks a different object: data, workload, configuration.
- Treating AWS Artifact as documentation about your own AI usage. It is AWS’s own certification and agreement downloads, not your evidence trail.
- Answering an evidence request by naming one service that assembles the whole package. AWS Audit Manager does that job and does not appear on the AI Practitioner in-scope service list; here the evidence is AWS Config, AWS CloudTrail, and AWS Artifact put together.
- Calling every prompt-based attack “prompt injection”. A jailbreak targets the model’s own alignment. Injection targets an application’s instructions, and splits further by the channel the content arrived through.
- Reading a managed service as an absence of customer responsibility. Bedrock hosts the model and operates the infrastructure. The prompt content, the retrieved documents, and who may call it stay yours.
- Reading an aggregate accuracy number as evidence of fairness. Only subgroup analysis shows the group the model fails, and a high overall score can hide it completely.
- Assuming a VPC endpoint encrypts. AWS PrivateLink changes which network the request crosses; the encryption in transit was TLS and was already there.
- Assuming a Region choice settles residency. A cross-Region inference profile widens where a request may be processed, and enabling one is a line of configuration.
- Trusting a model’s self-reported confidence. The number is generated the same way the answer was, so a wrong answer arrives with a high number attached as readily as a right one.
- Treating AWS CloudTrail as the record of what an assistant said. It records the API call, not the content of the prompt or the completion.
Say it in one line
- AWS names eight responsible-AI dimensions: fairness, explainability, privacy and security, safety, controllability, veracity and robustness, governance, and transparency.
- Safety is about what a model emits; controllability is about a human’s power to intervene, override, or shut it down.
- Interpretability is internal mechanics; explainability is a post-hoc account. An LLM supports the second, rarely the first.
- Fairness-through-unawareness fails because other features act as proxies for the deleted attribute, and now bias cannot be measured either.
- Bedrock’s shared responsibility: AWS owns infrastructure and hosting; you own data, prompts, IAM, and usage compliance.
- Macie finds PII in S3, Inspector finds vulnerabilities in EC2, ECR images and Lambda, Config tracks resource configuration against rules.
- AWS Artifact is AWS’s own compliance downloads; a Model Card documents your own model; evidence of your own usage is assembled from AWS Config and AWS CloudTrail.
- ISO/IEC 42001 is the AI management system standard, 27001’s sibling for AI governance.
- Direct injection arrives through the instruction channel; indirect injection arrives through the data channel; jailbreaking targets the model’s own alignment.
- AWS states the benefit of its infrastructure for GenAI under four headings: security, compliance, responsibility, and safety. Guardrails is the safety one.
- The four dataset characteristics are inclusivity, diversity, curated data sources, and balanced datasets. The three bias-detection techniques are analyzing label quality, human audits, and subgroup analysis.
- The five legal risks of generative AI are intellectual property infringement claims, biased model outputs, loss of customer trust, end user risk, and hallucinations.
- Environmental considerations and sustainability are named criteria for selecting a model responsibly, sitting alongside cost, latency, and capability.
- The principles of human-centered design for explainable AI are user-feedback mechanisms and AI decision transparency, aimed at the affected person rather than an auditor.
- CloudTrail records who called an API; Bedrock model invocation logging records what was said, and it is off until switched on.
- AWS PrivateLink changes the network path, not the encryption. Encryption at rest and in transit is AWS KMS and TLS.
- Residency is a Region choice a cross-Region inference profile widens, within a geography or worldwide depending on the profile.
- Retention is S3 lifecycle rules and CloudWatch Logs retention, which stores data indefinitely by default.
- Privacy-enhancing technologies run redaction, masking, pseudonymisation, anonymisation, and differential privacy; data integrity on Amazon S3 is versioning and Object Lock.
- The Generative AI Security Scoping Matrix sorts a use into five scopes by how much of the stack you own, and the scope decides which controls are yours.
- RAG grounding, source citation, and output filtering and validation check an answer; a model’s own confidence scoring does not, because it is not calibrated.