Whose control is it?

Before you start

For any control claim in the cloud, exactly one party is structurally capable of producing its truth — you or the provider — and that boundary shifts as you move from IaaS to PaaS to SaaS. You cannot evidence a control you do not own; you can only inherit it. This board makes the boundary a movable line: place each control card on the YOU or PROVIDER side, then move the service-model slider and watch the cards that are model-dependent migrate while the invariant cards stay put. The key is the cited matrix (AWS Shared Responsibility Model, CSA CAIQ, NIST 800-53) — not an authored answer. A wrong placement names itself; it never reveals the answer. A second board sorts cloud actions onto the control plane (the management API — IAM, security groups, KMS) versus the data plane (the workload's request traffic and the bytes it moves). Start with the slider on IaaS.