{
  "catalog": {
    "uuid": "58ef20ae-d3d3-5eb7-a4f6-e34906da3845",
    "metadata": {
      "title": "CoSAI AI Shared Responsibility Framework \u2014 Accountability Matrix",
      "last-modified": "2026-06-16T05:35:13+00:00",
      "version": "1.0",
      "oscal-version": "1.1.2",
      "props": [
        {
          "name": "keywords",
          "value": "AI, shared responsibility, accountability, CoSAI, SRF"
        },
        {
          "name": "source",
          "ns": "https://aisharedresponsibility.com/ns/oscal",
          "value": "https://aisharedresponsibility.com/data/matrix.json"
        }
      ],
      "links": [
        {
          "href": "https://aisharedresponsibility.com/",
          "rel": "canonical"
        },
        {
          "href": "https://aisharedresponsibility.com/framework/",
          "rel": "reference",
          "text": "SRF framework reference"
        }
      ],
      "remarks": "Each control encodes the SRF accountability assignment for one enterprise architecture layer (L1-L5) under one operating model. Groups are SRF layers; controls are layer-by-operating-model accountability cells. Industry vertical schemas are independently proposed extensions and are not part of the official CoSAI release. Generated from data/matrix.json."
    },
    "groups": [
      {
        "id": "l1",
        "class": "srf-layer",
        "title": "L1: AI Business & Usage",
        "props": [
          {
            "name": "personas",
            "ns": "https://aisharedresponsibility.com/ns/oscal",
            "value": "AI System Users, AI System Governance"
          }
        ],
        "controls": [
          {
            "id": "srf-l1-ai-saas",
            "class": "srf-accountability",
            "title": "L1 \u00b7 AI-SaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "AI-SaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "shared",
                "class": "Shared"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "provider-managed",
                "class": "Provider"
              }
            ],
            "parts": [
              {
                "id": "srf-l1-ai-saas-stmt",
                "name": "statement",
                "prose": "In the AI-Enabled SaaS (AI-SaaS) operating model, accountability for L1 (AI Business & Usage) is: customer = Shared; provider = Provider."
              }
            ]
          },
          {
            "id": "srf-l1-ai-paas",
            "class": "srf-accountability",
            "title": "L1 \u00b7 AI-PaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "AI-PaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "customer-owned",
                "class": "Customer"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "N/A",
                "class": "N/A"
              }
            ],
            "parts": [
              {
                "id": "srf-l1-ai-paas-stmt",
                "name": "statement",
                "prose": "In the AI Platform as a Service (AI-PaaS) operating model, accountability for L1 (AI Business & Usage) is: customer = Customer; provider = N/A."
              }
            ]
          },
          {
            "id": "srf-l1-agent-paas",
            "class": "srf-accountability",
            "title": "L1 \u00b7 Agent-PaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "Agent-PaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "customer-owned",
                "class": "Customer"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "N/A",
                "class": "N/A"
              }
            ],
            "parts": [
              {
                "id": "srf-l1-agent-paas-stmt",
                "name": "statement",
                "prose": "In the Agentic Platform as a Service (Agent-PaaS) operating model, accountability for L1 (AI Business & Usage) is: customer = Customer; provider = N/A."
              }
            ]
          },
          {
            "id": "srf-l1-iaas",
            "class": "srf-accountability",
            "title": "L1 \u00b7 IaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "IaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "customer-owned",
                "class": "Customer"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "N/A",
                "class": "N/A"
              }
            ],
            "parts": [
              {
                "id": "srf-l1-iaas-stmt",
                "name": "statement",
                "prose": "In the Infrastructure as a Service (IaaS) operating model, accountability for L1 (AI Business & Usage) is: customer = Customer; provider = N/A."
              }
            ]
          }
        ]
      },
      {
        "id": "l2",
        "class": "srf-layer",
        "title": "L2: AI Information",
        "props": [
          {
            "name": "personas",
            "ns": "https://aisharedresponsibility.com/ns/oscal",
            "value": "Data Provider"
          }
        ],
        "controls": [
          {
            "id": "srf-l2-ai-saas",
            "class": "srf-accountability",
            "title": "L2 \u00b7 AI-SaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "AI-SaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "shared",
                "class": "Shared"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "provider-managed",
                "class": "Provider"
              }
            ],
            "parts": [
              {
                "id": "srf-l2-ai-saas-stmt",
                "name": "statement",
                "prose": "In the AI-Enabled SaaS (AI-SaaS) operating model, accountability for L2 (AI Information) is: customer = Shared; provider = Provider."
              }
            ]
          },
          {
            "id": "srf-l2-ai-paas",
            "class": "srf-accountability",
            "title": "L2 \u00b7 AI-PaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "AI-PaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "shared",
                "class": "Shared"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "shared",
                "class": "Shared"
              }
            ],
            "parts": [
              {
                "id": "srf-l2-ai-paas-stmt",
                "name": "statement",
                "prose": "In the AI Platform as a Service (AI-PaaS) operating model, accountability for L2 (AI Information) is: customer = Shared; provider = Shared."
              }
            ]
          },
          {
            "id": "srf-l2-agent-paas",
            "class": "srf-accountability",
            "title": "L2 \u00b7 Agent-PaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "Agent-PaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "shared",
                "class": "Shared"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "shared",
                "class": "Shared"
              }
            ],
            "parts": [
              {
                "id": "srf-l2-agent-paas-stmt",
                "name": "statement",
                "prose": "In the Agentic Platform as a Service (Agent-PaaS) operating model, accountability for L2 (AI Information) is: customer = Shared; provider = Shared."
              }
            ]
          },
          {
            "id": "srf-l2-iaas",
            "class": "srf-accountability",
            "title": "L2 \u00b7 IaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "IaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "customer-owned",
                "class": "Customer"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "N/A",
                "class": "N/A"
              }
            ],
            "parts": [
              {
                "id": "srf-l2-iaas-stmt",
                "name": "statement",
                "prose": "In the Infrastructure as a Service (IaaS) operating model, accountability for L2 (AI Information) is: customer = Customer; provider = N/A."
              }
            ]
          }
        ]
      },
      {
        "id": "l3",
        "class": "srf-layer",
        "title": "L3: AI Application",
        "props": [
          {
            "name": "personas",
            "ns": "https://aisharedresponsibility.com/ns/oscal",
            "value": "Application Developer, Agentic Platform & Framework Providers"
          }
        ],
        "controls": [
          {
            "id": "srf-l3-ai-saas",
            "class": "srf-accountability",
            "title": "L3 \u00b7 AI-SaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "AI-SaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "N/A",
                "class": "N/A"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "provider-managed",
                "class": "Provider"
              }
            ],
            "parts": [
              {
                "id": "srf-l3-ai-saas-stmt",
                "name": "statement",
                "prose": "In the AI-Enabled SaaS (AI-SaaS) operating model, accountability for L3 (AI Application) is: customer = N/A; provider = Provider."
              }
            ]
          },
          {
            "id": "srf-l3-ai-paas",
            "class": "srf-accountability",
            "title": "L3 \u00b7 AI-PaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "AI-PaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "customer-owned",
                "class": "Customer"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "shared",
                "class": "Shared"
              }
            ],
            "parts": [
              {
                "id": "srf-l3-ai-paas-stmt",
                "name": "statement",
                "prose": "In the AI Platform as a Service (AI-PaaS) operating model, accountability for L3 (AI Application) is: customer = Customer; provider = Shared."
              }
            ]
          },
          {
            "id": "srf-l3-agent-paas",
            "class": "srf-accountability",
            "title": "L3 \u00b7 Agent-PaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "Agent-PaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "shared",
                "class": "Shared"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "provider-managed",
                "class": "Provider"
              }
            ],
            "parts": [
              {
                "id": "srf-l3-agent-paas-stmt",
                "name": "statement",
                "prose": "In the Agentic Platform as a Service (Agent-PaaS) operating model, accountability for L3 (AI Application) is: customer = Shared; provider = Provider."
              }
            ]
          },
          {
            "id": "srf-l3-iaas",
            "class": "srf-accountability",
            "title": "L3 \u00b7 IaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "IaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "customer-owned",
                "class": "Customer"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "N/A",
                "class": "N/A"
              }
            ],
            "parts": [
              {
                "id": "srf-l3-iaas-stmt",
                "name": "statement",
                "prose": "In the Infrastructure as a Service (IaaS) operating model, accountability for L3 (AI Application) is: customer = Customer; provider = N/A."
              }
            ]
          }
        ]
      },
      {
        "id": "l4",
        "class": "srf-layer",
        "title": "L4: AI Platform",
        "props": [
          {
            "name": "personas",
            "ns": "https://aisharedresponsibility.com/ns/oscal",
            "value": "AI Platform Provider, AI Model Serving"
          }
        ],
        "controls": [
          {
            "id": "srf-l4-ai-saas",
            "class": "srf-accountability",
            "title": "L4 \u00b7 AI-SaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "AI-SaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "N/A",
                "class": "N/A"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "provider-managed",
                "class": "Provider"
              }
            ],
            "parts": [
              {
                "id": "srf-l4-ai-saas-stmt",
                "name": "statement",
                "prose": "In the AI-Enabled SaaS (AI-SaaS) operating model, accountability for L4 (AI Platform) is: customer = N/A; provider = Provider."
              }
            ]
          },
          {
            "id": "srf-l4-ai-paas",
            "class": "srf-accountability",
            "title": "L4 \u00b7 AI-PaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "AI-PaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "N/A",
                "class": "N/A"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "provider-managed",
                "class": "Provider"
              }
            ],
            "parts": [
              {
                "id": "srf-l4-ai-paas-stmt",
                "name": "statement",
                "prose": "In the AI Platform as a Service (AI-PaaS) operating model, accountability for L4 (AI Platform) is: customer = N/A; provider = Provider."
              }
            ]
          },
          {
            "id": "srf-l4-agent-paas",
            "class": "srf-accountability",
            "title": "L4 \u00b7 Agent-PaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "Agent-PaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "N/A",
                "class": "N/A"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "provider-managed",
                "class": "Provider"
              }
            ],
            "parts": [
              {
                "id": "srf-l4-agent-paas-stmt",
                "name": "statement",
                "prose": "In the Agentic Platform as a Service (Agent-PaaS) operating model, accountability for L4 (AI Platform) is: customer = N/A; provider = Provider."
              }
            ]
          },
          {
            "id": "srf-l4-iaas",
            "class": "srf-accountability",
            "title": "L4 \u00b7 IaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "IaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "customer-owned",
                "class": "Customer"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "shared",
                "class": "Shared"
              }
            ],
            "parts": [
              {
                "id": "srf-l4-iaas-stmt",
                "name": "statement",
                "prose": "In the Infrastructure as a Service (IaaS) operating model, accountability for L4 (AI Platform) is: customer = Customer; provider = Shared."
              }
            ]
          }
        ]
      },
      {
        "id": "l5",
        "class": "srf-layer",
        "title": "L5: AI Model Provider",
        "props": [
          {
            "name": "personas",
            "ns": "https://aisharedresponsibility.com/ns/oscal",
            "value": "Model Provider"
          }
        ],
        "controls": [
          {
            "id": "srf-l5-ai-saas",
            "class": "srf-accountability",
            "title": "L5 \u00b7 AI-SaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "AI-SaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "N/A",
                "class": "N/A"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "provider-managed",
                "class": "Provider"
              }
            ],
            "parts": [
              {
                "id": "srf-l5-ai-saas-stmt",
                "name": "statement",
                "prose": "In the AI-Enabled SaaS (AI-SaaS) operating model, accountability for L5 (AI Model Provider) is: customer = N/A; provider = Provider."
              }
            ]
          },
          {
            "id": "srf-l5-ai-paas",
            "class": "srf-accountability",
            "title": "L5 \u00b7 AI-PaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "AI-PaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "model-evaluation",
                "class": "Model evaluation"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "provider-managed",
                "class": "Provider"
              }
            ],
            "parts": [
              {
                "id": "srf-l5-ai-paas-stmt",
                "name": "statement",
                "prose": "In the AI Platform as a Service (AI-PaaS) operating model, accountability for L5 (AI Model Provider) is: customer = Model evaluation; provider = Provider."
              }
            ]
          },
          {
            "id": "srf-l5-agent-paas",
            "class": "srf-accountability",
            "title": "L5 \u00b7 Agent-PaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "Agent-PaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "shared",
                "class": "Shared"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "shared",
                "class": "Shared"
              }
            ],
            "parts": [
              {
                "id": "srf-l5-agent-paas-stmt",
                "name": "statement",
                "prose": "In the Agentic Platform as a Service (Agent-PaaS) operating model, accountability for L5 (AI Model Provider) is: customer = Shared; provider = Shared."
              }
            ]
          },
          {
            "id": "srf-l5-iaas",
            "class": "srf-accountability",
            "title": "L5 \u00b7 IaaS",
            "props": [
              {
                "name": "operating-model",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "IaaS"
              },
              {
                "name": "customer-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "customer-owned",
                "class": "Customer"
              },
              {
                "name": "provider-responsibility",
                "ns": "https://aisharedresponsibility.com/ns/oscal",
                "value": "N/A",
                "class": "N/A"
              }
            ],
            "parts": [
              {
                "id": "srf-l5-iaas-stmt",
                "name": "statement",
                "prose": "In the Infrastructure as a Service (IaaS) operating model, accountability for L5 (AI Model Provider) is: customer = Customer; provider = N/A."
              }
            ]
          }
        ]
      }
    ]
  }
}