A municipal night-market stall map is (a) staff typing into a consumer chatbot, versus (b) a Bedrock app the market built on a hosted foundation model, versus (c) a model the market fine-tuned. Which idea matches security effort to how much of the stack they own?
Select an answer to reveal the explanation.
Short Explanation
Think of staff in a consumer chatbot, a Bedrock app the market built, and a model they fine-tuned. The Generative AI Security Scoping Matrix matches effort to how much stack they own. One control set does not cover all three.
Full Explanation
Staff typing into a consumer chatbot, a Bedrock app the market built on a hosted foundation model, and a model the market fine-tuned are three different ownership scopes. The Generative AI Security Scoping Matrix matches security and governance effort to how much of the stack the night-market team owns: consumer chat shifts most model and platform duty to the provider with heavy acceptable-use limits on what staff paste; a hosted Bedrock app adds customer duties for app security, data, and monitoring; a fine-tune expands duties into training data, evaluation, and model governance. Effort follows ownership.
One control set for all three fails by concept: consumer chat and a fine-tune do not own the same stack, so identical controls either overburden the lightest scope or under-protect the heaviest. Amazon Polly fails because speech synthesis is not a scoping matrix. Skipping scoping and assigning every builder control to the consumer-chatbot case fails because it misallocates work and still leaves paste risk unmanaged in the lightest scope.
Exam caveat: scope can change mid-project when a team moves from consumer chat to Bedrock or into fine-tuning—reassess duties when ownership expands. Operational check: classify the stall-map path into the matrix scope, list buyer-versus-builder controls for that scope only, and verify staff are not pasting market PII into a consumer chatbot when a scoped Bedrock app exists.