> For the complete documentation index, see [llms.txt](https://intuitem.gitbook.io/ciso-assistant/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intuitem.gitbook.io/ciso-assistant/concepts/foundations/perimeters.md). # Perimeters A **perimeter** is an *optional* scope refinement an assessment or risk study can be attached to, inside a domain. Where a domain defines *who* owns the work and *what* they can see, a perimeter narrows the assessment to *exactly what is being assessed* — a product, a system, a process, a contract. Perimeters are optional everywhere they appear: an assessment without a perimeter is scoped to its domain only. Use them when you need to track several distinct scopes inside the same domain, or to roll up assessments by scope rather than by domain.

Three perimeters inside a single domain

## When to use a domain vs a perimeter The two concepts solve different problems — and the choice matters because it shapes both *who can see what* and *how reports roll up*. * **Use a domain (or a sub-domain)** when the boundary needs to enforce **IAM scoping** or anchor **reporting**. Domains are where roles are granted, where permissions stop, and where dashboards aggregate. Pick a domain when different teams must have different levels of access, or when leadership wants to see one number per business unit / subsidiary / regulated entity. * **Use a perimeter** when the boundary is purely **logical**, inside an already-scoped domain. Perimeters split the work into distinct named scopes — a product, a system, a process, a contract — so you can run separate audits or risk studies against each without spinning up extra IAM machinery. Everyone with access to the domain sees every perimeter inside it; there's no per-perimeter access control. A useful mental check: *"Do these two scopes need different people seeing them?"* — if yes, they're domains (or sub-domains). *"Do these two scopes need separate assessments but the same audience?"* — they're perimeters. ## Related * [Domains](/ciso-assistant/concepts/foundations/domains.md) * [Audits](/ciso-assistant/concepts/compliance/audits.md) * [Risk assessments](/ciso-assistant/concepts/risk/risk-assessments.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://intuitem.gitbook.io/ciso-assistant/concepts/foundations/perimeters.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.