What RMF artifact establishes the scope of protection for an IS and encompass people, process, and info tech that are part of the system?

The System Boundary is the critical RMF artifact that establishes the precise scope of an information system, clearly delineating what is and is not part of the system for security purposes. This definition includes hardware, software, firmware, information, services, and the people and processes associated with its operation.

The Risk Management Framework (RMF) is a structured process for managing security and privacy risk, not an artifact that defines a system's scope.

Authorize is a step in the RMF process, specifically the decision to operate a system, not an artifact defining its scope.

Categorization is an RMF step that determines the impact level of an information system, but it does not define its operational scope or boundaries.