The scopes climb with ownership, so they climb with the work a team takes on. Sorting a risk into the layer that owns it is the same instinct applied to one worry at a time. The matrix applies it to a whole workload before anybody writes a control down. The wider set of frameworks, review cadences and transparency standards sits in the governance programme this framework hangs inside. The step from scope 3 to scope 4 is the choice in deciding how far to customise a model, seen from the security side rather than the cost side.
Flash card
Generative AI Security Scoping Matrix: an AWS framework placing a generative AI use case in one of five scopes, least ownership to greatest, so a team can say which controls are theirs.
- Scope 1, consumer app: staff use a public third-party service, free or paid, through its own interface. You do not see or own the model or its training data, and cannot modify it. Controls are policy, staff training, and monitoring what leaves the organisation.
- Scope 2, enterprise app: a third-party business application with generative AI features embedded, where your organisation has a vendor relationship. Controls are contractual, plus whatever admin settings the product exposes.
- Scope 3, pre-trained models: you build the application and call another party’s foundation model through an API. AWS’s example is a support chatbot on Amazon Bedrock with retrieval-augmented generation. The model is the provider’s; the prompts, retrieval corpus, logs, IAM permissions and output filtering are yours.
- Scope 4, fine-tuned models: that same model refined on data specific to your business, producing a new one. You now own that training data, and whatever a prompt might pull back out of the weights. Scope 5, self-trained models: trained from scratch on data you own or acquire; you own every part.
- Scopes 1 and 2 take a buyer’s perspective: data governance and a careful read of the enterprise agreement. Scopes 3 to 5 take a builder’s: threat modelling, more control over your data, more responsibility for it. The matrix sets all five against governance and compliance, legal and privacy, risk management, controls, and resilience.
Pick it when
Reach for it when a governance programme needs one vocabulary for several AI uses, or when a team needs to know which controls are theirs. Naming the scope settles whether a control is policy, contract or engineering. The AI Practitioner objectives name it under governance frameworks.
It's the wrong answer when
Not for a certifiable management system, which is ISO/IEC 42001:2023. Not for a risk process organised around govern, map, measure and manage, which is the NIST AI Risk Management Framework. Not for runtime enforcement: a scope is a classification. Scope 3 says output filtering is yours; Amazon Bedrock Guardrails still has to be configured.