AIF-C01 Domains 4 and 5: Responsible AI and Security

Part 6 of 6 in the AIF-C01 exam prep series for developers. Previous: Agentic AI on AWS.

The last two domains share one theme: trust. Domain 4 asks whether an AI system is fair, safe, and explainable. Domain 5 asks whether it's secure, auditable, and compliant. They overlap heavily. Bedrock Guardrails is named in both, and human oversight and transparency run through both, so this post covers them together.

Together they carry 28% of the exam, the same as Domain 3. For developers, Domain 5 is the easier half: IAM, encryption, and logging are familiar ground. Domain 4 is mostly vocabulary, but the exam likes pairs of near-synonyms, so precision matters.

Domains at a glance#

Objective checklist#

Responsible AI#

Dimensions of responsible AI#

The guide names six features:

AWS's broader responsible AI framework adds:

• explainability: understanding why a model produced an output
• privacy and security: control over how personal data is used
• transparency: disclosing how the system works and its limits
• governance: processes that enforce responsible practices
• controllability: the ability to steer and correct model behavior

Amazon Bedrock Guardrails#

Guardrails is the tool the guide names for responsible AI (4.1.2), and it reappears as a security service in 5.1.1. It applies configurable safeguards to both user inputs and model outputs.

Figure: Guardrails check both directions. Input checks stop harmful or manipulative prompts; output checks catch harmful, sensitive, or ungrounded responses.

Guardrails works with models on Bedrock and, through its standalone API, with self-hosted and third-party models. It can also be enforced through IAM, so that every inference call must use a guardrail.

Choosing a model responsibly#

Objective 4.1.3 highlights environmental considerations and sustainability:

• Right-size the model. A smaller model that meets the requirement uses far less energy per request.
• Reuse before you train. Using or fine-tuning a pre-trained model avoids the enormous footprint of pre-training.
• Use efficient hardware. AWS Trainium and AWS Inferentia are designed for energy-efficient training and inference.
• Consider the model's whole life. Energy is spent in both training and every inference call.

Responsible selection also covers the model's documented intended uses, its known limitations, and its licensing terms.

Legal risks#

Datasets, bias, and variance#

Good datasets (4.1.5) are:

• inclusive: they represent all the groups the model will serve.
• diverse: varied sources, contexts, and conditions.
• curated: from trustworthy, vetted sources.
• balanced: no class or group is badly over- or under-represented.

Bias and variance (4.1.6) describe how a model fits its data:

These errors aren't only statistical. If one demographic group is under-represented, a model can fit that group poorly while looking accurate overall, producing unfair outcomes for exactly the people the data missed.

Detecting and monitoring bias#

Objective 4.1.7 names three methods:

• Analyzing label quality: wrong or inconsistent labels teach bias.
• Human audits: people review samples of inputs and outputs.
• Subgroup analysis: measure performance separately for each group, not just overall.

On AWS:

Transparency and explainability#

Tools to identify transparent and explainable models (4.2.2):

• SageMaker Model Cards document a model: intended use, training data, evaluation results, risk rating, and limitations.
• SageMaker Clarify explains predictions with feature attributions.
• Bedrock Model Evaluations produce comparable quality and responsible AI scores for foundation models.
• Open-source models, data, and licensing let you inspect weights, training data, and permitted uses.
• AWS AI Service Cards are AWS's own documentation of intended uses and limitations for its AI services.

Trade-offs#

Objective 4.2.3 says transparency and safety don't always pull in the same direction:

• Interpretability vs. performance. Simple, explainable models are often less accurate on complex tasks. Measure both and choose deliberately.
• Transparency vs. security. Publishing too much about a model, its prompts, or its filters can help attackers evade them or expose intellectual property.
• Safety filters vs. usefulness. Aggressive filtering blocks harm but also blocks legitimate requests.

Human-centered design#

Objective 4.2.4 names two principles, and a third follows naturally from them:

• User-feedback mechanisms: let users rate, flag, and correct outputs, and feed that back into improvement.
• AI decision transparency: show why, through citations, confidence, and key factors, and say clearly that AI is involved.
• Keep humans in control: easy escalation to a person, the ability to override, and design that supports human decisions rather than replacing them in high-stakes cases.

Securing AI systems#

The shared responsibility model for AI#

Figure: AWS secures the infrastructure; you secure what you put on it and how you use it. The more you manage yourself (EC2 over SageMaker over Bedrock), the more of the stack is yours.

Security services for AI#

Bedrock also doesn't use your prompts and outputs to train its base models or share them with model providers, and customized models stay private to your account.

Least privilege in practice: this IAM policy lets an application invoke exactly one approved model, and nothing else in Bedrock.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeOneApprovedModel",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:us-east-1::foundation-model/amazon.nova-lite-v1:0"
    }
  ]
}

Illustrative only; the exam never asks you to read policies. In a real account you'd also allow any inference profile the application uses.

Data origins and lineage#

Objective 5.1.2 is about knowing where data and answers come from:

Secure data engineering#

Threats, controls, and audit trails#

Figure: Which service logs what. CloudTrail records API activity, not content. To keep the actual prompts and responses, turn on model invocation logging.

Hallucination detection and grounding#

Models predict plausible text, and plausible isn't the same as true. New objective 5.1.5 names three techniques for the gap (RAG grounding, output validation, confidence scoring), and several AWS features support them:

Governance and compliance#

Governance services#

Data governance strategies#

Governance protocols and the Scoping Matrix#

Objective 5.2.3 lists the processes that make governance real:

• Policies: written rules for acceptable AI use.
• Review cadence: scheduled reviews of models and applications.
• Review strategies: what gets reviewed, how, and by whom.
• Governance frameworks: such as the Generative AI Security Scoping Matrix.
• Transparency standards: what gets documented and disclosed.
• Team training requirements: everyone who builds or uses AI knows the rules.

The Generative AI Security Scoping Matrix classifies GenAI use by how much of it you own. The more you own, the more security, governance, and compliance responsibility you carry.

Service cheat sheet#

Commonly confused#

Practice questions#

Q1 (matching). Match each requirement to the AWS service that meets it.

Services: AWS Artifact, AWS Trusted Advisor, AWS Config, AWS CloudTrail, Amazon Inspector.

Q2 (ordering). Order the Generative AI Security Scoping Matrix scopes from lowest to highest ownership.

• A. Fine-tuned models
• B. Consumer app
• C. Self-trained models
• D. Pre-trained models
• E. Enterprise app

Q3. An auditor asks a company to provide documentation of a credit model's intended use, training data, evaluation results, and known limitations. What should the company use?

• A. SageMaker Clarify
• B. SageMaker Model Cards
• C. AWS Artifact
• D. Amazon Macie

Q4 (multiple response). A bank's customer chatbot must never give investment advice and must never reveal customers' account numbers. Which TWO Bedrock Guardrails policies should the bank configure?

• A. Denied topics
• B. Contextual grounding check
• C. Sensitive information filters
• D. Word filters for the phrase "account number"
• E. Automated Reasoning checks

Q5. A model scores 99% accuracy on training data but 70% on new data. What is happening, and what helps?

• A. Underfitting; use a simpler model
• B. Overfitting; add more training data or apply regularization
• C. Underfitting; train for fewer epochs
• D. Data drift; retrain on the same data

Q6. A RAG-based HR assistant sometimes answers with policy details that don't exist in the retrieved documents. Which combination best reduces this?

• A. Fine-tune the model on the HR documents
• B. Instruct the model to answer only from retrieved content, and enable the Guardrails contextual grounding check
• C. Increase the temperature
• D. Switch to a larger model

Q7. Before using a large S3 dataset to fine-tune a model, a company must find any personally identifiable information in it. Which service should it use?

• A. Amazon Macie
• B. Amazon Inspector
• C. AWS Config
• D. AWS Trusted Advisor

Q8. Security policy requires that traffic from an application in a VPC to Amazon Bedrock never traverses the public internet. What should the team use?

• A. AWS KMS
• B. AWS PrivateLink (a VPC interface endpoint)
• C. Amazon Macie
• D. AWS Artifact

Q9. A healthcare company must retain the full text of every prompt sent to its Bedrock-based assistant, and every response, for compliance review. What should it enable?

• A. AWS CloudTrail
• B. Amazon Bedrock model invocation logging
• C. AWS Config
• D. SageMaker Model Monitor

Q10. A company fine-tunes an Amazon Bedrock foundation model with its own customer data. Which scope of the Generative AI Security Scoping Matrix applies?

• A. Scope 2: Enterprise app
• B. Scope 3: Pre-trained models
• C. Scope 4: Fine-tuned models
• D. Scope 5: Self-trained models

Key takeaways#

• Responsible AI features: bias, fairness, inclusivity, robustness, safety, veracity. AWS adds explainability, privacy, transparency, governance, and controllability.
• Guardrails filters inputs and outputs. Know each policy's trigger:
  • "Don't discuss X" → denied topics.
  • "Never show PII" → sensitive information filters.
  • "Stick to the sources" → contextual grounding check.
  • "Resist manipulation" → prompt attack detection.
• Overfitting = high variance (great on training, poor on new data). Underfitting = high bias (poor everywhere).
• Clarify measures bias and explains; Model Cards document. Both stay exam-relevant despite maintenance mode.
• Shared responsibility: AWS secures the infrastructure; you secure data, access, configuration, and usage.
• Security services: IAM for access, KMS for encryption, Macie for PII in S3, PrivateLink for private traffic, Secrets Manager for credentials. For agents, add AgentCore Identity and Policy.
• Logging:
  • CloudTrail → who called what.
  • Model invocation logging → prompt and response content.
  • CloudWatch → metrics and alarms.
  • AgentCore Observability → agent traces.
• Hallucinations: ground with RAG, validate outputs, score confidence, check grounding. Never fine-tune it away.
• Governance five: Config, Inspector, Artifact, CloudTrail, Trusted Advisor. The Scoping Matrix's five scopes run from consumer app to self-trained model.

Series cram sheet#

The whole series in one table, for exam eve.

That's the series. Good luck on the exam.

Sources#

• AIF-C01 exam guide, Domains 4 and 5 and revisions
• Amazon Bedrock Guardrails and product page
• Amazon Bedrock model invocation logging
• Amazon SageMaker Clarify and SageMaker Model Cards
• Securing generative AI: the Generative AI Security Scoping Matrix (AWS Security Blog)
• AWS shared responsibility model
• AWS service availability updates, June 30, 2026