AI Safety, Security, and Governance

This domain tests whether your GenAI system is safe enough to deploy in a real organization. AWS is not only asking whether you can block obviously bad prompts. It is asking whether you can control unsafe inputs and outputs, protect sensitive data, leave a strong compliance trail, and make responsible AI principles operational instead of aspirational.

What AWS is explicitly testing

As of May 11, 2026, the current AWS Documentation exam guide splits this domain into four tasks:

• Task 3.1: implement input and output safety controls
• Task 3.2: implement data security and privacy controls
• Task 3.3: implement AI governance and compliance mechanisms
• Task 3.4: implement responsible AI principles

That split matters on the exam. If the problem is about harmful prompts, jailbreaks, unsafe outputs, hallucination reduction, or defense-in-depth content filters, it belongs in task 3.1. If it is about PII, private data, masked output, retention, isolation, or secure FM environments, it belongs in task 3.2. If it is about lineage, audit logs, policy evidence, compliance frameworks, or continuous governance controls, it belongs in task 3.3. If it is about transparency, fairness, uncertainty, policy-aligned outputs, or explainability, it belongs in task 3.4.

Official task compression

AWS splits Domain 3 into four task areas. The local guide keeps the same shape because each task tests a different control layer.

3.1 Input and output safety controls asks whether you can block harmful inputs, unsafe outputs, jailbreaks, prompt injection, hallucinations, and malformed outputs. Start with 3.1 Input and Output Safety Controls.

3.2 Data security and privacy controls asks whether you can protect PII, private data, logs, retrieval paths, masked data, retention, network boundaries, and access scope. Start with 3.2 Data Security and Privacy Controls.

3.3 AI governance and compliance mechanisms asks whether you can preserve data lineage, audit evidence, model cards, decision logs, policy controls, and continuous governance signals. Start with 3.3 AI Governance and Compliance Mechanisms.

3.4 Responsible AI principles asks whether you can make fairness, transparency, uncertainty, source attribution, and policy-aligned behavior operational. Start with 3.4 Responsible AI Principles.

Current weight in the exam guide

AWS currently weights this domain at 20% of scored content.

Safety decision stack

Use this order when a scenario asks how to secure or govern a GenAI application.

1. Classify the risk first. Decide whether the failure mode is harmful content, prompt injection, hallucination, PII exposure, tenant leakage, policy violation, fairness risk, or weak auditability.
2. Protect before and after the model. Apply input validation, guardrails, content filters, retrieval authorization, structured output validation, and post-processing where each layer can catch a different failure.
3. Secure the data boundary. Treat source documents, chunks, embeddings, prompts, outputs, logs, and evaluation datasets as sensitive data paths when private or regulated information is involved.
4. Preserve governance evidence. Keep lineage, prompt/model versions, decision logs, source attribution, policy checks, escalation records, and monitoring signals tied to releases.
5. Make responsible AI operational. Convert transparency, fairness, uncertainty, and human oversight into product behavior, evaluation criteria, and review workflows rather than policy language only.

Work this domain in order

Start with 3.1 Input and Output Safety Controls to lock down moderation, hallucination reduction, prompt-injection defense, structured outputs, and layered safety controls.

Then move to 3.2 Data Security and Privacy Controls for protected AI environments, access boundaries, privacy-preserving data handling, masking, and retention.

Next review 3.3 AI Governance and Compliance Mechanisms for lineage, audit logs, model cards, policy evidence, and continuous governance monitoring.

Finish with 3.4 Responsible AI Principles for transparency, fairness evaluation, uncertainty signals, source attribution, and policy-compliant AI behavior.

Fast routing inside this chapter

• Go to 3.1 Input and Output Safety Controls when the scenario is about toxic prompts, jailbreaks, harmful responses, hallucinations, structured output controls, safety classifiers, adversarial tests, or layered safety enforcement.
• Go to 3.2 Data Security and Privacy Controls when the scenario is about PII, private documents, VPC endpoints, IAM boundaries, Lake Formation access, masked data, redaction, retention rules, or data isolation.
• Go to 3.3 AI Governance and Compliance Mechanisms when the scenario is about lineage, source tracking, audit trails, policy checks, model cards, decision logs, compliance evidence, governance monitoring, or automated remediation.
• Go to 3.4 Responsible AI Principles when the scenario is about fairness, explainability, uncertainty, transparency, source attribution, bias drift, human oversight, or policy-aligned responsible AI practices.

Control-layer chooser

• For toxic or disallowed content, think guardrails, moderation workflow, pre-processing, post-processing, and safety evaluation.
• For prompt injection or jailbreak attempts, think instruction hierarchy, input sanitization, tool validation, prompt-injection detection, and adversarial tests.
• For hallucinated answers from enterprise content, think grounding, retrieval quality, source attribution, confidence/evidence checks, and structured output validation.
• For PII in prompts or logs, think PII detection, masking/redaction, log minimization, retention control, and access restrictions.
• For tenant or private-data leakage, think authorization before retrieval, metadata filters, IAM/KMS boundaries, network isolation, and audit logs.
• For compliance review requests, think lineage, decision logs, model/prompt versions, policy evidence, model cards, source tracking, and continuous monitoring.
• For fairness or transparency concerns, think representative evaluation, bias monitoring, explanation/evidence display, uncertainty signals, and human oversight.

High-yield decision rules

• If the scenario says guardrails, still ask what happens before the model, after the model, in retrieval, in logs, and during escalation.
• If the scenario says audit, do not log everything blindly. Preserve useful evidence while minimizing sensitive prompt, context, output, and user data.
• If the scenario says prompt injection, protect tool calls and retrieved context, not just user input text.
• If the scenario says compliance, connect policy to lineage, ownership, monitoring, controls, and evidence.
• If the scenario says responsible AI, look for operational signals such as uncertainty, source attribution, evaluation, bias monitoring, human review, and user-facing transparency.

Common traps

• using one guardrail feature as if it solves every safety problem
• treating privacy, governance, and responsible AI as one undifferentiated “safety” bucket
• securing the model endpoint but not the retrieval, logging, or output path
• logging everything for audit without thinking about privacy boundaries
• treating transparency and fairness as policy language rather than production controls
• applying a content filter after sensitive data has already been logged or cached
• using model-card documentation as if it were runtime enforcement
• monitoring safety events without owner, threshold, escalation, or rollback behavior

In this section

• AIP-C01 Input and Output Safety Controls Guide
  Study AIP-C01 safety controls for harmful prompts, jailbreaks, hallucination reduction, structured outputs, and defense-in-depth filtering.
• AIP-C01 Data Security and Privacy Controls Guide
  Study AIP-C01 data security for VPC isolation, IAM boundaries, PII detection, masking, retention, and privacy-preserving FM interactions.
• AIP-C01 AI Governance and Compliance Mechanisms Guide
  Study AIP-C01 governance for lineage, model cards, audit logs, policy evidence, compliance frameworks, and continuous governance controls.
• AIP-C01 Responsible AI Principles Guide
  Study AIP-C01 responsible AI for transparency, fairness, uncertainty signals, source attribution, and policy-compliant AI behavior.