Exam-style
An auditor sits down with a team that runs a support-ticket triage model it trained itself, and also calls a managed AWS AI service for document extraction. She asks for three things. First, what the team's triage model is intended for and where its output should not be trusted. Second, the fairness considerations and known limitations AWS documented for the managed service. Third, evidence that AWS holds a current SOC 2 report. Which set of artefacts answers all three?
Reveal the answer
C. Amazon SageMaker Model Cards for the triage model, an AWS AI Service Card for the managed service, and AWS Artifact for the SOC 2 report
Match the artefact to whoever wrote it. You document your own model, AWS documents its own services, and AWS publishes its own certifications. Amazon SageMaker Model Cards are the document the team authors and versions alongside the triage model: intended use, the data it learned from, how it was evaluated, per-group results, known limitations, and an accountable owner. That is the only one of the three artefacts the team can write, because nobody else knows what the model was built for. An AWS AI Service Card is the mirror image, written by AWS for a managed AI service and covering intended use cases, design and fairness considerations, limitations, and guidance on responsible use. The team reads it and cites it; it cannot edit it, and it says nothing about the triage model. AWS Artifact is the console where AWS’s own audit reports and certifications are downloaded on demand, SOC 2 among them, which answers the third ask without an email to an account manager. The distractors each name a service that does something real and different. Amazon Bedrock Model Evaluations runs a scoring job over a prompt dataset and returns measured numbers about output quality, which is evidence rather than documentation, and it has nothing to say about intended use or a limitation nobody has measured yet. AWS Config records how resources are configured and flags drift against rules you define. AWS CloudTrail records API calls, so it shows who invoked what and when. Neither one is a compliance certification, and an auditor asking for SOC 2 wants the report AWS’s auditors signed, not a log of the team’s activity. The single-card answer fails on authorship: a card the team wrote is worth nothing as evidence about AWS, because the party being assessed produced it.
Q. An auditor wants to know what your own triage model is for, what fairness considerations AWS documented for the managed service you call, and whether AWS holds SOC 2. Which three artefacts?
A. Amazon SageMaker Model Cards for your model, an AWS AI Service Card for the AWS service, and AWS Artifact for the SOC 2 report.
Why? Sort by author. You write the card for the model you trained, AWS writes the card for the service it sells, and AWS Artifact is where AWS’s own certifications are downloaded. A Model Card carries intended use, training data, evaluation results and the limitations you already know about, and it is documentation rather than a deployment gate. A service card carries the same shape of information for a service you did not build, which is exactly why it convinces somebody assessing you. The near misses are worth naming: Amazon Bedrock Model Evaluations produces measured scores over a dataset, AWS Config tracks resource configuration against rules, and AWS CloudTrail records API calls. All three are useful, none is a piece of documentation about what a model is for.
There is a fourth route to the same transparency, and it is not a document at all. Choosing open source models, data, licensing over a closed one means the weights, the training corpus and the licence terms can be inspected directly, so the answers come from the model’s provenance rather than from somebody’s write-up of it. Between them, that gives four tools to identify transparent and explainable models, and each one answers a different question: what the model is for, what AWS’s service does, what AWS has been certified against, and what the model was actually made from.