A fast pass over responsible AI, security, and governance: the eight dimensions by name, and the terms that get skimmed past because they sound generic.
The eight responsible-AI dimensions at a glance
| Dimension | Canonical scope |
|---|---|
| Fairness | Impacts are equitable across stakeholder groups |
| Explainability | Understanding and evaluating why a system produced a given output |
| Privacy and security | Appropriately obtaining, using, and protecting data and models |
| Safety | Preventing harmful output and misuse; about what the model emits |
| Controllability | Mechanisms to monitor and steer behaviour: intervene, override, shut down; about human power over the system |
| Veracity and robustness | Correct output under unexpected or adversarial input |
| Governance | Organisational processes to define, implement, and enforce responsible AI |
| Transparency | Informing stakeholders how the system works, including that it is AI at all, so they can choose how to engage with it |
Responsible-AI vocabulary at a glance
The words are ordinary English carrying specific meanings, which is why they get skimmed. Four of them describe a dataset, three of them describe a way of finding bias in one, and the rest sit around model selection and the design of an explanation. The dataset four are the ones checked before anyone decides a dataset is fit to train on.
| Term | What it covers |
|---|---|
| Inclusivity (dataset characteristic) | The dataset represents the people the system will be used on, including the groups easiest to leave out |
| Diversity (dataset characteristic) | Range across the variation that matters: demographics, dialects, devices, conditions of capture |
| Curated data sources | Sources chosen deliberately, with a known origin and licence, rather than scraped and accepted as found |
| Balanced datasets | Group sizes proportioned so no group is a rounding error in training or in evaluation |
| Analyzing label quality | Bias detection aimed at the labels: who applied them, how consistently, and whether the labelling rule shifted by group |
| Human audits | Bias detection by people reading real cases and judging the outputs, rather than reading a metric |
| Subgroup analysis | Bias detection by scoring the model once per group instead of once overall |
| Environmental considerations and sustainability | A responsible model-selection criterion: a smaller model, or one already trained, does the same job for less energy |
| Principles of human-centered design for explainable AI | Designing for the person a decision lands on: user-feedback mechanisms and AI decision transparency |
| User-feedback mechanisms | A way for that person to mark an output wrong, wired into a queue somebody works |
| AI decision transparency | Telling that person a model was involved, what it worked from, and how to reach a human who can override it |
| Tradeoffs between model safety and transparency | Publishing weights, evaluation detail and failure modes serves accountability and would also help an attacker |
Those three bias-detection techniques are the ones a team keeps running after launch rather than once before it.
The five legal risks of a generative feature
| Risk | What it looks like |
|---|---|
| Intellectual property infringement claims | Output reproduces training material closely enough for a rights holder to object |
| Biased model outputs | Outputs land unevenly across groups, and the organisation carries the consequence |
| Loss of customer trust | One visible failure costs more in confidence than the feature earned in efficiency |
| End user risk | Somebody acts on a wrong answer in a setting where acting on it does harm: medical, legal, financial |
| Hallucinations | Fluent, unsupported output presented as fact, with nothing in the response marking it as unsupported |
Naming the risk is the first half; each of the five has a control that reduces it and the controls are different from each other.
Why the AWS infrastructure underneath counts
AWS describes the benefit of its infrastructure for generative AI under four headings, and each one has concrete services behind it rather than a claim. This sits underneath the building blocks a GenAI application is assembled from.
| Benefit | What it means for a GenAI application |
|---|---|
| Security | IAM scopes who may invoke which model, AWS KMS encrypts data at rest and TLS encrypts it in transit, and AWS PrivateLink keeps Bedrock traffic on a private path instead of the public internet |
| Compliance | AWS Artifact supplies AWS’s own SOC reports and ISO certificates, Region choice decides where data sits, and prompts and completions sent to Bedrock are not used to train the base models |
| Responsibility | The AWS shared responsibility model, in one line for GenAI: AWS operates the infrastructure and hosts the model, you own your data, your prompts, your IAM configuration, and the compliance of your own usage |
| Safety | Amazon Bedrock Guardrails applies content filters, denied topics and PII handling to the prompt on the way in and the response on the way out, whichever model answered |
Security and governance terms at a glance
The layer each of these belongs to is worked out in sorting an AI security risk into the layer that owns it, and the matching of a worry to a control in choosing the control that actually answers it.
| Term | What it covers |
|---|---|
| Interpretability | Understanding a model’s internal mechanics: how it actually computes an output |
| Explainability (as distinct from interpretability) | A post-hoc account of why a specific output happened, without opening the model up |
| Fairness-through-unawareness | The naive, failing fix of deleting a protected attribute from the data |
| Shared responsibility model (Bedrock) | AWS owns infrastructure and model hosting; you own your data, prompts, IAM configuration, and compliance of your own usage |
| Amazon Macie | Finds PII and other sensitive data in S3 |
| Amazon Inspector | Finds vulnerabilities in workloads: EC2, ECR images, Lambda |
| AWS Config | Tracks resource configuration and evaluates it against rules |
| AWS Artifact | AWS’s own downloadable compliance certifications: SOC reports, ISO certificates |
| ISO/IEC 42001 | The AI management system standard; 27001’s sibling, for AI governance specifically |
| Direct prompt injection | Malicious instructions arrive through the instruction channel: the user’s own message |
| Indirect prompt injection | Malicious instructions arrive through the data channel: a retrieved document, a tool result, a webpage |
| Jailbreaking | Getting a model to ignore its own safety training via crafted prompts, distinct from injection |
| AWS PrivateLink | A private network path to Bedrock through a VPC endpoint. It changes the route the request takes, not the cryptography |
| Encryption at rest and in transit | AWS KMS for at rest, TLS for in transit. AWS-managed keys rotate on AWS’s schedule; customer-managed keys let you set the policy, audit use, and revoke |
| Amazon Bedrock AgentCore Identity | Establishes which workload is asking before the agent runs, and holds its credentials in the token vault |
| Policy in AgentCore | Constrains what a permitted agent may then do, once identity has established that it may run at all |
| AWS CloudTrail | Who called which API, when, and from where |
| Bedrock model invocation logging | What the prompt and the completion actually said, delivered to S3 or CloudWatch Logs. Off until you turn it on |
| AWS Trusted Advisor | Account-level best-practice checks across cost, performance, security, fault tolerance, and service limits |
| AWS Well-Architected Tool | A recorded workload review against the pillars, leaving a dated document with owners and improvement items |
| Data lineage | Which run, which source, which version produced this record. Produced by the pipeline that moved the data |
| Data cataloguing | An inventory of the datasets themselves: what exists, who owns it, what may be done with it |
| Source citation | Which passage of which document supported this sentence, produced at answer time by the application |
| Amazon SageMaker Model Card | The build history of one model: intended use, training data, evaluation results, limitations |
| Generative AI Security Scoping Matrix | AWS’s framework sorting a generative use into five scopes by how much of the stack you own: consumer app, enterprise app, pre-trained model, fine-tuned model, self-trained model |
| Privacy-enhancing technologies | Redaction removes a value; masking hides part of one; pseudonymisation swaps an identifier for a token reversible with the key; anonymisation aims at no reversal at all; differential privacy adds calibrated noise so no single record changes the result |
| Data integrity | The record is still what it was. Amazon S3 versioning keeps the previous copy when something is overwritten; S3 Object Lock stops deletion for a set period |
| Residency | Which Region data physically sits in. Decided by Region choice, and undone by a cross-Region inference profile |
| Retention | How long each copy lives: S3 lifecycle rules to expiry or to Amazon S3 Glacier, and CloudWatch Logs retention, which defaults to never expire |
| Output filtering and validation | Checking a response before a person sees it: guardrail content filters for toxicity, plus your own schema, range, and policy checks |
| Toxicity | Harmful, abusive, or insulting content in the output. A content-filter category, not a service of its own |
| Retrieval Augmented Generation [RAG] grounding | Putting source passages into the prompt so the model continues text that already contains the answer |
| Confidence scoring | A number attached to an answer so a low one can be routed to a human. A classifier’s probability is calibrated against a validation set; a language model’s stated confidence is not |
Decision rules
- If the concern is equitable impact across groups, name it fairness; if the concern is why an output happened, name it explainability; do not reach for a control before naming the dimension.
- If the concern is a model doing something harmful, that is safety; if the concern is a human’s ability to intervene, override, or shut the system down, that is controllability. The two are adjacent and frequently swapped.
- If the concern is disclosing that a system is AI at all, or how it works, that is transparency, not governance; governance is the organisational process behind enforcing all of this, not the disclosure itself.
- If a review asks for a model’s internal mechanics, that is interpretability; if it asks for an after-the-fact account of one output, that is explainability. An LLM almost never offers the first.
- If someone proposes fixing bias by deleting the protected attribute from the data, name the trap: fairness-through-unawareness. Other features still act as proxies, and now the bias cannot even be measured.
- If a Bedrock security question is about infrastructure or model hosting, that is AWS’s side of shared responsibility; if it is about your data, prompts, IAM, or usage compliance, that is yours.
- If PII in a data store is the concern, use Macie; if vulnerabilities in a workload are the concern, use Inspector; if resource configuration drift against a rule is the concern, use Config. Three different objects being checked.
- If you need AWS’s own compliance evidence, that is AWS Artifact; if you need your own model’s documentation, that is an Amazon SageMaker Model Card; if you need evidence of your own usage, no single service hands it over, and the pieces are AWS Config for resource state and AWS CloudTrail for who did what. Match the author to the artefact.
- If malicious instructions arrive in the user’s own message, that is direct injection; if they arrive through a retrieved document or tool result, that is indirect injection. The channel is the tell, not the intent.
- If a crafted prompt is getting the model to override its own safety training rather than an application’s instructions, name it jailbreaking, not injection.
- If a scenario asks what stops harmful output reaching a user of a GenAI application, that is the safety benefit of the AWS infrastructure, and the named control is Amazon Bedrock Guardrails: content filters, denied topics, and PII handling, on the prompt and on the response.
- If the concern is a per-decision reason for the person affected, that is human-centered design for explainable AI. It needs plain-language reason codes, a user-feedback mechanism, and an appeal path, and none of that is what a model card delivers.
- If the concern is that publishing weights and evaluation detail would help an attacker, name the tradeoff between model safety and transparency. It resolves by disclosing enough for accountability without publishing an attack recipe.
- If the worry is the labels themselves, analyse label quality; if it is a group the model fails, run subgroup analysis; if it is behaviour no metric captures, commission human audits. Three techniques, three different things being examined.
- If a model-selection scenario names environmental considerations or sustainability, the responsible answer is the smallest model that does the job, and reusing a trained one rather than training your own.
- If the question is who called the model, that is AWS CloudTrail; if it is what the prompt and the completion said, that is Bedrock model invocation logging. Two logs, two questions, and only one of them is on by default.
- If a named resource has to be evaluated against a rule continuously, that is AWS Config; if the ask is account-wide best-practice checks with no rule of your own, that is AWS Trusted Advisor; if it is a dated review of a whole workload, that is the AWS Well-Architected Tool.
- If the question is where this sentence came from, that is source citation; where this dataset came from, data lineage; what datasets exist and who owns them, data cataloguing; how this model was built, an Amazon SageMaker Model Card.
- If a response is harmful, a content filter catches it; if a response is unsupported by the retrieved passages, only a grounding check catches it. A filter reads the text on its own, a grounding check compares it against the passages retrieval put in front of the model.
- If the requirement is that traffic never crosses the public internet, that is AWS PrivateLink and a VPC endpoint; if it is that nobody can read the data, that is encryption at rest and in transit. Route and cryptography are separate requirements with separate answers.
- If a scenario needs to know which controls are yours before naming any of them, sort it into the Generative AI Security Scoping Matrix first. The scope decides the obligation, and the five run from consumer app to self-trained model.
Traps
- Reaching for “safety” whenever anything sounds risky. Safety is specifically about harmful output; a human-oversight question is controllability even if it feels adjacent.
- Treating transparency and governance as the same dimension because both sound like paperwork. Transparency is disclosure to stakeholders; governance is the organisational process behind everything else.
- Promising interpretability on a foundation model. What you can actually deliver is explainability as traceability: citations, documented behaviour, a stated rationale.
- Assuming removing a protected attribute makes a model fair. It is fairness-through-unawareness, and it typically makes bias worse and unmeasurable.
- Reading shared responsibility as AWS taking your side of it too. AWS secures the infrastructure and hosts the models; your data, prompts, IAM configuration, and the compliance of your own usage stay yours, however managed the service feels.
- Mixing up Macie, Inspector, and Config because all three sound like general “security scanning”. Each checks a different object: data, workload, configuration.
- Treating AWS Artifact as documentation about your own AI usage. It is AWS’s own certification downloads, not your evidence trail.
- Answering an evidence request by naming one service that assembles the whole package. AWS Audit Manager does that job and does not appear on the AI Practitioner in-scope service list; here the evidence is AWS Config, AWS CloudTrail, and AWS Artifact put together.
- Calling every prompt-based attack “prompt injection”. A jailbreak targets the model’s own alignment; injection targets an application’s instructions, and it further splits by which channel the malicious content arrived through.
- Reading a managed service as an absence of customer responsibility. Bedrock hosts the model and operates the infrastructure; the prompt content, the retrieved documents, and who may call it stay yours under the AWS shared responsibility model.
- Reading an aggregate accuracy number as evidence of fairness. Only subgroup analysis shows the group the model fails, and a high overall score hides it comfortably.
- Assuming a VPC endpoint encrypts. AWS PrivateLink changes which network the request crosses; the encryption in transit was TLS and was already there.
- Assuming a Region choice settles residency. A cross-Region inference profile sends the request wherever there is capacity, and enabling one is a line of configuration.
- Trusting a model’s self-reported confidence. The number is generated the same way the answer was, so a wrong answer arrives with a high number attached as readily as a right one.
- Treating AWS CloudTrail as the record of what an assistant said. It records the API call, not the content of the prompt or the completion.
Say it in one line
- AWS names eight responsible-AI dimensions: fairness, explainability, privacy and security, safety, controllability, veracity and robustness, governance, and transparency.
- Safety is about what a model emits; controllability is about a human’s power to intervene, override, or shut it down.
- Interpretability is internal mechanics; explainability is a post-hoc account. An LLM offers the second, rarely the first.
- Fairness-through-unawareness fails because other features act as proxies for the deleted attribute, and now bias cannot be measured either.
- Bedrock’s shared responsibility: AWS owns infrastructure and hosting; you own data, prompts, IAM, and usage compliance.
- Macie finds PII in S3, Inspector finds workload vulnerabilities, Config tracks resource configuration against rules.
- AWS Artifact is AWS’s own compliance certification downloads; a Model Card documents your own model; evidence of your own usage is assembled from AWS Config and AWS CloudTrail.
- ISO/IEC 42001 is the AI management system standard, 27001’s sibling for AI governance.
- Direct injection arrives through the instruction channel; indirect injection arrives through the data channel; jailbreaking targets the model’s own alignment rather than an application’s instructions.
- AWS states the benefit of its infrastructure for GenAI under four headings: security, compliance, responsibility, and safety. Amazon Bedrock Guardrails is the safety one.
- The four dataset characteristics are inclusivity, diversity, curated data sources, and balanced datasets. The three bias-detection techniques are analyzing label quality, human audits, and subgroup analysis.
- The five legal risks of generative AI are intellectual property infringement claims, biased model outputs, loss of customer trust, end user risk, and hallucinations.
- Environmental considerations and sustainability are named criteria for selecting a model responsibly, sitting alongside cost, latency, and capability.
- The principles of human-centered design for explainable AI are user-feedback mechanisms and AI decision transparency, aimed at the affected person rather than an auditor.
- CloudTrail records who called an API; Bedrock model invocation logging records what was said, and it is off until switched on.
- AWS PrivateLink changes the network path, not the encryption. Encryption at rest and in transit is AWS KMS and TLS.
- Residency is a Region choice a cross-Region inference profile can undo; retention is S3 lifecycle rules and CloudWatch Logs retention, which never expires by default.
- Privacy-enhancing technologies run redaction, masking, pseudonymisation, anonymisation, and differential privacy; data integrity on Amazon S3 is versioning and Object Lock.
- The Generative AI Security Scoping Matrix sorts a use into five scopes by how much of the stack you own, and the scope decides which controls are yours.
- RAG grounding, source citation, and output filtering and validation check an answer; a model’s own confidence scoring does not, because it is not calibrated.