The Roles & Boundaries Framework: a visual map of your AI supply chain
By Iain Barclay ·
When an AI product reaches a person, a chain of parties made it. Someone gathered the data, someone trained a model, someone built that model into a product, and someone put the product to work on a real decision. When it goes wrong, the person on the receiving end rarely knows any of them. Boundsmap's Roles & Boundaries Framework is a way of drawing that chain so the question of who is responsible for what has somewhere to land.
Where it comes from
The framework began in research. It first appeared in a 2021 paper I wrote with Will Abramson, Identifying Roles, Requirements and Responsibilities in Trustworthy AI Systems (UbiComp-ISWC '21 Adjunct), and I developed and tested it during my PhD research at Cardiff University, submitted in 2022. To test the framework I put it in front of nine practitioners from industry, government and academia, and asked whether it described their experience.
In the research, I called the boundaries between the roles "trust frontiers": the points where one party has to rely on another's work without being able to see all of it. One practitioner said: "I like the different trust frontiers, I run into that a lot." They described the problem at a boundary as "is the data good, or is your model good at synthesising this, or did curation reach a certain level of quality", and said the framework was "a really clear way to delineate that".
Boundsmap's version of the R&B Framework generalises that earlier work. It keeps the structure and drops the jargon, so that it works for any AI-enabled product, large or small.
Five layers
The framework places the parties in an AI system into five layers. They are occupants, not stages: a layer is who is there, not what step comes next.
- Source Materials: the underlying AI model, and the data it was trained on.
- Capability Builders: whoever turned that model into something that does a job, such as reading receipts or ranking CVs.
- Integrators: whoever put that capability into a product people use.
- Operators: the organisations that use the product to do their work.
- Affected Parties: the people the product's output is about or lands on.
One company can sit in more than one layer. A startup that calls a general-purpose model with its own prompts and logic, and sells the result, is both a Capability Builder and an Integrator. Sometimes a third party developer will be the Integrator.
The fifth layer is different in kind. Affected Parties sit outside the chain: they supplied nothing to the system and run none of it, yet they carry the consequences of every layer above them.
Four boundaries
Where one layer hands something to the next, there is a boundary. There are four of them, and every one has the same shape:
- Source Materials to Capability Builders: what the data is and where it came from, and what the AI model provides - perhaps described by a model card.
- Capability Builders to Integrators: what the finished capability built on that model can and can't do, handed to the people who build it into a product.
- Integrators to Operators: what the product is for, and its limits, handed to the people who use it.
- Operators to Affected Parties: what the people on the receiving end are told, and what they can do about it.
At each boundary, there are two questions to answer:
- What has to cross? What does the party on the receiving side need to know to do its own job responsibly?
- What is the party handing it over entitled to keep back? Trade secrets, personal data and safety are all legitimate reasons. Is that reason real here, or is it being used to hold back something that should cross?
Most arguments about transparency turn out to be about the second question. Knowing that before you enter one helps.
In Boundsmap, each boundary shows what the law asks there, whose obligation it is (often your customer's or your supplier's, not yours), and any question it needs you to answer. Where the law itself hasn't decided, it says "not settled" rather than guessing.
Two things the map shows
Visibility falls, and exposure builds up, in the same direction. The people at the end of the chain can see least about how the system was made, and they absorb the combined effect of every boundary above them working imperfectly.
A failure surfaces further down than it started. A problem in the data does not stay in the data. It passes through each layer and lands on someone, often unrecognisable as a problem that began four layers away. It is easier to catch at the boundary where it happened.
Why the law cares
The map can clearly show where responsibility and accountability lies, which is a key component of AI governance. Interestingly, we've also found that the UK and EU obligations Boundsmap covers can be placed at boundaries too, which gives each team a clearer picture of what it has to have in place.
Data protection law, for example, treats the company that builds the capability and receives your customers' data as a supplier handling it on your behalf. That is a Boundary 2 obligation, and the law says what has to be true of it. In our Who's who in your AI supply chain? article, we work through a full example.
Laying the system out on the five layers also shows where the law has not decided. The question of who counts as the provider under the EU AI Act is one: it depends on which layers a company occupies, and for some systems the Act doesn't say.
Boundsmap applies the Framework
The Roles & Boundaries Framework provides a map of an AI product or AI system - it provides a way to see your own system clearly: who is in each layer, what passes at each boundary, and whose responsibility each part is. Our Boundsmap tool offers an easy way to apply the R&B Framework to your AI product. It takes your short description of the system, places it on the five layers and four boundaries, and then applies UK and EU law to each one. You can check and correct the map as you go, and you don't need to know the law to use it: where the map needs a fact only you know, such as which kind of account you use, it asks.
If you'd like to see what one looks like, open an example map. You need no account for that. To map your own product, start here. Explorer is free: map one AI product.