Why sovereignty needs to be structural, not contractual
Most claims of data sovereignty rest on paperwork. A provider commits, in a contract or a regional service description, that data stays within a named territory. The commitment may be sincere, but it is enforced by legal process rather than by the infrastructure itself, and it can be reinterpreted by a change of ownership, a change of policy, or a foreign legal instrument that reaches the provider rather than the customer.
For a regulator supervising a grid operator, a central bank, or a defence supplier, that is a weak guarantee. The question is not whether a provider intends to keep data in-country, but whether the platform is technically capable of moving it out. A sovereign AI domain answers that question by making residency and control properties of the system rather than promises about it.
The design goal is simple to state and demanding to implement: every request to compute, to storage, and to model weights is evaluated against policy before it is served, and the policy engine sits below the workload, where an application, an administrator, or an autonomous agent cannot negotiate with it.
The four control planes of a sovereign AI domain
A sovereign AI domain is built from four control planes, each answering a different question about a request.
Geographic control answers where. Physical location, jurisdiction, and network path are treated as first-class attributes. Compute nodes, storage volumes, key material, and backups are pinned to declared territory, and replication or failover targets outside that territory are not merely discouraged — they are unrepresentable in policy, so they cannot be configured by mistake.
Device control answers what is asking. Every node, accelerator, gateway, and endpoint carries a cryptographic identity established at provisioning and attested at run time. Hardware that cannot prove which platform it is, and in what state it booted, does not join the domain and cannot receive workloads or keys.
Workload control answers what is running. Containers, model training jobs, and inference services are admitted on the basis of provenance, signed images, and declared data classifications. A workload labelled for restricted grid telemetry is schedulable only on nodes whose geographic and device attributes satisfy the label, which means classification travels with the job rather than living in a spreadsheet.
AI-agent control answers what an autonomous actor may do. Agents receive their own identities, scoped permissions, and explicit action envelopes. An optimisation agent may be permitted to read telemetry, propose a setpoint, and write to a staging channel, while being structurally incapable of issuing a control command or exporting a dataset. Every action is authorised individually and recorded.
How they combine
The planes are useful in combination rather than isolation. A request carries claims from all four and is evaluated as a single decision: this attested device, in this jurisdiction, running this signed workload, acting as this agent, requests this data for this purpose.
Because evaluation is continuous, the decision is revisited as conditions change. A node that fails re-attestation after a firmware change loses its workloads. An agent whose behaviour drifts from its envelope is suspended before it acts, not after an audit. A dataset reclassified as restricted immediately narrows the set of nodes able to serve it.
The output of that evaluation is also the audit trail. Because the platform must record the claims it acted on to make each decision, evidence is generated as a by-product of operation rather than reconstructed from logs at review time.
What this enables
An operator running this architecture can offer regulated customers something a contractual model cannot: enforcement they can inspect. Residency is demonstrable, agent authority is bounded and reviewable, and proprietary model weights remain inside a perimeter the customer controls throughout training and inference.
That changes the commercial position of sovereignty. Instead of a compliance surcharge bolted onto a global platform, in-jurisdiction AI becomes the default property of the domain — and the operator's intellectual property, along with its customers', stays a defensible asset.