Amazon Bedrock manages models, not customer responsibility

Amazon introduced Bedrock on April 13, 2023 as a managed service providing API access to foundation models from Amazon and several companies. The proposition removed a substantial burden: operating infrastructure. It did not remove the duty to show that the application built on top was appropriate for its task, data and affected people.

That distinction is the durable skill. “Managed” describes who maintains servers and part of the platform; it does not automatically transfer quality, security, compliance or accountability. Before choosing an AI API, write six internal contracts: model identity, data, adaptation, evaluation, operations and exit.

What the preview offered

The AWS announcement placed Bedrock in limited preview and listed models from AI21 Labs, Anthropic, Stability AI and Amazon. The Titan family would begin with a generative text model and an embeddings model, producing numerical representations useful for search and personalization.

The platform would be serverless: customers could consume models without administering the underlying infrastructure. AWS also described customization with labeled examples in S3 and said customer data would not train base models. These were declared preview features, not uniform availability for every account or region.

AI21 Labs’ announcement that day framed the provider benefit: Jurassic-2 could be consumed inside the AWS environment without developers managing infrastructure. It listed summarization, writing and questions over a knowledge base, along with support for several languages.

A task list is not a warranty for a particular use. “Summarize” may mean preserving every obligation in a contract or shortening an informal note; “answer” may require verifiable citations or only fluent conversation. Procurement starts by turning the commercial verb into a test with error criteria.

Contract one: identity and version

A stable API can hide changing models. Records should preserve provider, exact name, version, date, region, generation parameters and the complete instruction template. If an update improves style but changes classification, the team needs to attribute the result to a version and roll back.

“Model choice” exists only when candidates are compared on the same tasks. Give each one the same permitted inputs and measure quality, latency, cost, refusals, variability and safety. A global average can conceal failure in the language or document supporting the business.

Applications should not assume equal features either. Context length, formats, embeddings, moderation and adaptation options vary. An internal layer normalizes the common portion and declares specific dependencies; pretending to have a universal interface creates silent failures.

Contract two: the data path

Draw the route of a request: source, application, logs, API, model provider, response and later storage. For every hop, record fields, purpose, encryption, region, retention, access and deletion. Include metadata, debugging copies and outputs, not only the user’s text.

AWS’s isolation claim was relevant, but a complete architecture includes customer behavior. If the application itself writes prompts into an open log or includes unnecessary secrets, the base model not training on them does not prevent exposure.

The AWS shared responsibility model distinguished security of the cloud, operated by the provider, from security in the cloud, which depends on customer service choice, configuration, data and integration. For AI, extend the table across AWS, model maker, application developer, using organization and human supervisor.

Test the allocation through scenarios, not a generic checkbox. When personal data enters a request, the customer decides whether collection and transmission were appropriate; the platform applies its controls; the model provider follows the agreed processing. If an answer causes a wrong decision, the using organization retains review and appeal duties.

Name an owner, control, evidence and response for every risk. “The provider handles it” fails when the contract covers only infrastructure. “A person reviews it” also fails without stating what they see, how much time they have, what they can block and how disagreement is recorded. The matrix prevents service convenience from creating an ownerless zone.

Contract three: what customization means

The announcement described tuning a private copy with examples. Define the objective first: style, classification, extraction or knowledge. Teaching tone examples does not turn a model into an updated database; supplying documents does not guarantee that every answer is supported by them.

Adaptation data needs provenance, permission, quality and a cutoff date. Separate training from evaluation so the task is not scored on its teaching examples. Keep the base model as a reference too: if customization worsens safety or generality, the team must see it.

Customization raises dependency. Examples, hyperparameters, transformations and metrics should be exportable or documented. If only an opaque artifact remains inside the platform, changing models means starting again even when the API advertises variety.

Contract four: evaluation tied to harm

The January 2023 NIST AI Risk Management Framework organized work around govern, map, measure and manage. It stressed that risk depends on context and laboratory measurements may differ from real operation.

Begin with a human or prior-system baseline. Then create normal, boundary and adversarial cases. Contract summarization tests missed obligations, fabrication, attribution and recognition of missing information. Image generation adds rights, prohibited content and correspondence with the brief.

The threshold follows harm. A draft always reviewed by a specialist can tolerate more error than an automatic decision about credit, health or employment. Fluency does not offset false certainty; the primary indicator may be how many severe errors survive review.

Contract five: operation and recovery

An API removes servers from the team, not incidents. The application needs time and spending limits, idempotent retries, stop circuits, access control, prompt versions and traces sufficient to reconstruct an output without retaining unnecessary data.

Prepare a degraded route: another approved model, a non-generative function or human intervention. Automatically switching to whichever candidate is available can change privacy, cost and behavior. Failover is a product and risk decision, not merely an availability setting.

Monitoring separates technical health from semantic quality. Latency and HTTP errors can remain healthy while fabrications rise. Reviewed samples, complaints, discrepancies and distribution shifts complement infrastructure metrics.

Contract six: exit

Run a substitution test before integration. Can another model receive the inputs, produce the format, respect controls and meet the threshold? Calculate changes to prompts, embeddings, filters, evaluations, latency and price. A common API reduces some switching costs, not all.

Define what happens to customized models, logs and keys when the relationship ends. Exit includes deletion, evidence export, permission revocation and communication. Portability is not a button for another model; it is the ability to change without losing control or knowledge.

Bedrock made complex models more accessible inside AWS by absorbing infrastructure and easing integration. The customer retains the work of understanding the allocation: version, data, adaptation, evaluation, operations and exit. Only those six contracts turn a simple API call into a governable system.