A Small And Good Enough model is the smallest model that meets the task’s acceptable quality, latency, and cost requirements. The concept shifts selection away from prestige or size and toward measurable sufficiency for the specific production use case.
Expanded Definition
A Small And Good Enough model is not simply a compact AI model. It is a production choice that balances task accuracy, response time, compute cost, and operational risk against the actual requirement set for one workload. In practice, the standard is sufficiency, not size. That makes the term distinct from “small model” as a generic label and from “efficient model” as a purely engineering preference.
Within AI operations, the concept is used to prevent over-provisioning. A model may be “good enough” for document classification, routing, summarisation, or extraction while remaining unsuitable for higher-stakes decisioning. The right threshold is usually determined by measurable acceptance criteria, including error tolerance, latency targets, and the consequences of failure. This aligns with the risk-based thinking reflected in the NIST Cybersecurity Framework 2.0, even though no single standard formally defines this phrase yet.
Definitions vary across vendors and practitioners because “good enough” depends on context. A model that is acceptable in internal support automation may be inappropriate for customer-facing advice or security-sensitive workflows. The most common misapplication is treating “small” as inherently safer or cheaper, which occurs when teams ignore task-specific quality thresholds and hidden operational costs such as rework, escalation, or manual review.
Examples and Use Cases
Implementing a Small And Good Enough model rigorously often introduces a validation burden, requiring organisations to weigh lower inference cost against the effort of proving acceptable performance for the exact use case.
- Customer support triage where a smaller model classifies ticket intent accurately enough to route cases without using a larger general-purpose model.
- Knowledge-base summarisation where the model only needs to extract key points from approved internal content, not reason across open-ended topics.
- Security alert enrichment where a compact model labels events, correlates fields, or drafts analyst notes, while humans retain final judgement.
- NHI and agentic AI workflows where the model supports tool selection or message drafting, but governance rules restrict it from making autonomous access decisions.
- Edge or constrained environments where latency and compute budget are tight, making a leaner model operationally preferable if it stays within defined quality bounds.
For AI governance teams, the useful reference point is not model prestige but measurable fit for purpose. That is why structured risk assessment and evaluation discipline matter, as described in NIST Cybersecurity Framework 2.0-style outcome thinking, where the control objective comes first and the implementation follows.
Why It Matters for Security Teams
Security teams need this concept because model size often becomes a proxy for trust, even when it should not. Overbuilding AI systems can expand attack surface, increase secrets exposure, raise infrastructure cost, and create harder-to-audit decision paths. Underbuilding them can be just as risky if the model fails silently, misclassifies sensitive content, or produces outputs that trigger insecure downstream automation.
The identity connection is especially important in NHI and agentic AI use cases. A Small And Good Enough model may be appropriate for classification or recommendation, but not for decisions involving privilege, authentication, or release of secrets. Those boundaries should be enforced through governance, evaluation gates, and workflow design rather than by assumptions about model scale. In practice, this helps prevent a small model from being over-trusted simply because it is inexpensive or fast.
Organisations typically encounter the real cost of poor model selection only after a production incident, at which point Small And Good Enough becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST AI 600-1 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | AI RMF frames risk-based model selection and fit-for-purpose evaluation. | |
| NIST AI 600-1 | The GenAI profile supports disciplined evaluation of model performance and limits. | |
| NIST CSF 2.0 | GV.RM-01 | CSF 2.0 emphasises risk management and outcomes over technology preference. |
| OWASP Agentic AI Top 10 | Agentic AI guidance stresses bounded autonomy and safe tool use. | |
| OWASP Non-Human Identity Top 10 | NHI guidance addresses model-adjacent workflows that touch secrets and access. |
Use profile-driven testing to verify the model is adequate for the intended task.
Related resources from NHI Mgmt Group
- How can organisations tell whether their context model is good enough for agentic AI?
- How do teams decide when a lower-cost model is good enough for security scanning?
- How should teams decide whether a cheaper model is good enough?
- How do teams decide whether model-assisted review is good enough for production use?
