Engagement Responsibility Model¶
Organization: Cloudnaut Technologies LLP
Classification: Internal
Document status: Effective
Version: 1.0
Owner: Management / Security Owner
Effective date: 2026-10-15
Review cycle: Annual; interim revision upon a new delivery model
Contract precedence
This model states Cloudnaut’s default position. The customer contract and statement of work determine actual responsibilities for each engagement and take precedence.
Document control¶
| Role | Name |
|---|---|
| Prepared by | Management / Security Owner (Cloudnaut) |
| Reviewed by | Sandeep AC |
| Approved by | Sandeep AC |
Revision history¶
| Version | Date | Summary | Reviewed by | Approved by |
|---|---|---|---|---|
| 0.1 | 2026-10-15 | Initial draft: four delivery models. | Sandeep AC | — |
| 1.0 | 2026-10-15 | Initial effective release. | Sandeep AC | Sandeep AC |
Purpose¶
Cloudnaut works inside environments owned and operated by its customers. This document states, for each of Cloudnaut’s delivery models, which security responsibilities belong to Cloudnaut, which to the customer, and which are shared, so that neither party assumes the other covers a control.
Scope¶
All Cloudnaut customer engagements. Where Cloudnaut works as a subcontractor, “customer” includes the prime contractor as the contract defines; see the Engagement Role Boundaries and Security Governance Policy.
Responsibilities common to all models¶
Cloudnaut is always responsible for: screening, NDAs, and training of its personnel (HR Security Policy); security of Cloudnaut endpoints (Endpoint Security Policy); protecting credentials issued to its personnel and requesting their removal (Access Control and Identity Management Policy); separation between engagements (Engagement Access Isolation Policy); reporting incidents to the customer (Incident Response and Management Policy); and following the customer’s policies while working in its environment.
The customer is always responsible for: its infrastructure, accounts, identity provider, production operations, security monitoring, backup and disaster recovery, data classification decisions, and acceptance of risk in its environment — unless the contract assigns a specific, defined part to Cloudnaut.
Responsibility by delivery model¶
Legend: C = Cloudnaut, Cu = Customer, S = Shared (as the SOW defines).
| Control area | Staff augmentation | AWS professional services | Amazon Connect / Lex | GenAI / agentic AI |
|---|---|---|---|---|
| Direction of daily work | Cu | C (to SOW) | C (to SOW) | C (to SOW) |
| Personnel screening, NDA, training | C | C | C | C |
| Cloudnaut endpoint security | C (or Cu if customer issues device) | C | C | C |
| Customer account/infrastructure security controls | Cu | Cu | Cu | Cu |
| Issuing and revoking access to Cloudnaut staff | Cu issues/revokes; C requests | Cu issues/revokes; C requests | Cu issues/revokes; C requests | Cu issues/revokes; C requests |
| Secure design of delivered solution | Cu (C follows customer standards) | C, Cu approves | C, Cu approves | C, Cu approves |
| Secure coding, review, scanning of delivered code | Customer SDLC; C follows it plus Cloudnaut baseline | C (Secure SDLC) | C | C |
| Change approval and production deployment | Cu | S | S | S |
| Production monitoring and incident response | Cu | Cu (C supports if contracted) | Cu (C supports if contracted) | Cu (C supports if contracted) |
| Backup and DR operation | Cu | Cu | Cu | Cu |
| Data protection decisions (classification, retention, residency) | Cu | Cu, C implements | Cu, C implements | Cu, C implements |
| Model/use-case risk acceptance | n/a | n/a | n/a | Cu |
| Reporting incidents involving Cloudnaut staff or deliverables | C | C | C | C |
Staff augmentation¶
Cloudnaut personnel work under the customer’s direction, inside the customer’s processes, tools, and SDLC. The customer’s policies govern the work; Cloudnaut remains accountable for its personnel’s suitability, training, endpoint (unless the customer issues the device), conduct, and incident reporting. Cloudnaut does not claim ownership of the customer’s security controls or delivery outcomes it does not direct.
AWS professional services¶
Cloudnaut delivers defined outcomes (for example migration, modernization, data platforms) under a SOW. Cloudnaut is responsible for the security quality of what it designs and builds, per the Secure SDLC Policy and Cloud Security Policy. The customer owns the AWS accounts, approves designs and changes, and operates the result after handover unless the SOW includes a defined support period.
Amazon Connect and Amazon Lex¶
Cloudnaut designs and builds contact flows, Lex bots, Lambda integrations, and reporting in the customer’s Amazon Connect instance. The customer owns the instance, telephony configuration, agent accounts, contact data (recordings, transcripts), retention, and compliance obligations (for example payment card or call-recording consent rules). Cloudnaut follows the contact-center requirements in the Cloud Security Policy.
GenAI and agentic AI engineering¶
Cloudnaut designs and builds GenAI and agentic systems (for example on Amazon Bedrock) in the customer’s account. The customer owns the use case, the data provided to the system, approval of models, acceptance of AI-specific risks, and the decision to put the system into production. Cloudnaut applies the engineering requirements in Part B of the AI Governance and Acceptable Use Policy.
Exceptions¶
Any departure from this model (for example Cloudnaut operating production monitoring) must be written into the contract or SOW, with the specific controls Cloudnaut operates listed.
Records¶
Contract or SOW responsibility clauses and the engagement access plan, held in the internal engagement record.