This is the scoping step of an LLM test, and you do it before you attack anything. The rule is the same as a web test: you test what the client owns or changed, not the untouched third-party model. So map the setup first, mark what is theirs (in scope) and what is the vendor's (out of scope), and then attack only what is in scope.
The model engine is the third-party piece. If they just call a vendor model (Claude / OpenAI) as-is, the model is out of scope and you test only the wrapper they built. If they self-host it, fine-tune it, or build real logic around it, that part is theirs and in scope. The contract is the final word, so confirm with the client.
Pick how they built it - the diagram shows you what is in scope:
in scope - test it out of scope - vendor's not built here