PDS
Finding the right tool
A supply room with a good concierge. Say what you need; get the five tools that fit — and the only door in or out.
The institutions that win the next decade will own the intelligence they create — here is a working architecture for keeping it.
The intelligence your institution creates — its judgment, its hard-won knowhow, the way it actually wins — is the one asset it cannot buy back once it is gone. In the age of AI, that asset is quietly under transfer to whoever you rent your models from. Institutions are being taught that their choices here are narrower than they are: that intelligence must be rented, that the terms are fixed, that the future belongs to whoever holds the largest model. None of that is true. You have complete agency over how AI is deployed against your data and your knowhow — and sovereignty is simply the decision to use it. This is a guide through the decisions that one contains, and an architecture for making them on purpose.
Every institution is differentiated by one thing that cannot be bought: its tribal knowledge — the operational knowhow, the judgment, the workflows that make it good at what it does. In the age of AI, that asset is under quiet transfer.
Every time your people work through a model you do not control, a little of that knowhow is encoded somewhere you cannot reach. The rational posture is not paranoia; it is arithmetic. Model providers have a structural incentive to migrate as much of your intelligence into their weights as they can — because once it lives there, they can lease it back to your competitors, price against your highest-margin work, or, in the limit, enter your market themselves. If your incentives were truly aligned, they would charge you a share of the value they help you create. They charge you per token instead. That single fact tells you who the flywheel is built for.
None of this requires bad actors. It requires only ordinary commercial pressure and enough time. As the financial demand to grow revenue mounts, the provider who was your tool this year has every reason to become your competitor the next — and the raw material for that competition is the data you have been feeding it all along. Sovereignty is the decision to keep the flywheel pointed at yourself. It rests on four things you can actually own: your data, your weights, your runtime, and your learning loop. Everything that follows is a way to own more of each. I hold nine convictions about this. They are the test I apply to every decision.
Your sovereignty dictates your institution's future.
Your data is the treasure; transfer it at your peril.
Tokenmaxxing hijacks your sense of value.
Control your weights and you control your fate.
Sovereignty and alpha are not in tension.
Do not let sovereignty become a political costume.
Real expertise is existential.
Learn from institutions that actually win.
Track record is the only signal.
Sovereignty is not one decision. It is a series of them, made deliberately across three layers of the technology stack. Two of those layers you should hold as tightly as you can. The one in the middle you should hold loosely, on purpose.
At the bottom is compute — the physical substrate everything else runs on. In the middle are the models — increasingly commoditized intelligence, interchangeable inputs. At the top is the control layer — the workflows, the ontology, the agents; the place where your knowhow is captured, structured, and compounded into advantage. The value is created at the top and secured at the bottom. The middle is a market you want to stay free to move around in.
Get the direction of ownership right and everything downstream gets easier. Own the top, because that is where your alpha accrues. Own or verify the base, because that is where your data physically lives while it is being reasoned over. Keep the middle interchangeable, because the moment you are locked to a single model you have handed a supplier the ability to change the terms — on price, on retention, on availability — and call it a policy update.
The first move toward data sovereignty is the most concrete one. Before anything else, decide where your intelligence is allowed to go — and prove it stays there.
Zero Data Retention (ZDR) means none of your data — prompts, outputs, or telemetry — is kept beyond the instant required to answer a request. Not stored to disk, not used to train, not read by another human. Most enterprise contracts nominally promise the last two. ZDR makes them structural rather than a matter of trust: it presents a barrier to misuse instead of a pinky-swear against it. Consider litigation risk alone. Providers have written into public, non-ZDR contracts that they will delete retained data "unless legally required to retain" it — and discovery can sweep up millions of stored interactions. Data fed to a model under a true ZDR was never stored, so it cannot be reached.
But ZDR is negotiated per provider, and it is porous exactly where the wording is porous. Safety-classifier logs and the metadata derived from your content often sit outside the phrase "customer content," which means a lab can promise not to retain what you sent while quietly retaining what it inferred about it. And ZDR erodes the moment you lose the leverage that won it — the pull toward a single, convenient provider is precisely the pull that dissolves your negotiating position. Treat ZDR as a floor you must keep re-pouring, and use every breakthrough with one provider as leverage against the next. It is a necessary condition of data sovereignty. It is not a sufficient one.
An extraction-prone model is any third-party model, used without a retention guarantee, that is trained by a firm with a structural incentive to compete with you. These pose the double risk: your knowhow extracted into the weights, and that knowhow later wielded against your interests. The correct default is zero-trust — assume any non-guaranteed frontier model is extraction-prone. This is not hostility toward the frontier; the frontier is genuinely useful. It is refusing to hand your compounding advantage, uncounted, to the one party structurally motivated to commoditize it.
Follow ZDR to its conclusion and you arrive at something stronger than any contract clause. For your most sensitive work, the data should never leave your walls at all — inference running on hardware you own or control, where no query reaches a third-party cloud and the claim is not a promise but a fact you can put a packet capture behind. I call this the Sovereign Inference Guarantee: not "we probably won't misuse your data," but "your data was physically never somewhere it could be misused." A guarantee you can demonstrate on a network trace is worth more than any number of assurances you cannot audit. Not every workload needs it. The ones that carry your real edge do.
Your AI agents are a new kind of workforce — and most institutions are running them the way you would never run a human one: no badge, no assigned office, no manager, no record of who did what. A handful of assistants you can watch. Fifty agents touching real money, real customer data, and real production systems are a different animal, and every organization in history has had to solve the same problems to operate a workforce at scale.
You can design for those problems in a few weeks, or discover them one public incident at a time over a couple of years. I have named them in advance. I call the set of them the Spine — the organizational structure for a company's AI workers. Six of its concerns are the daily jobs of that workforce; two are the foundations everything else stands on. The map below is the whole thing at a glance; the sections after it take each concern in turn.
The six jobs — the daily work of the AI workforce.
A new hire does not get all two hundred tools dumped on their desk on day one; they say "I need to do X," and a good concierge hands them the five that fit. That is what this layer does for an agent — narrow an overwhelming universe of tools down to the handful a task actually needs. It is also the only door in or out: an agent can use only what it is handed here, so there is no side entrance to your systems or your data.
Without it: the agent drowns in choices and grabs the wrong one — a hammer for a screw — or reaches somewhere it was never meant to reach.
Separation of duties, applied to machines. The agent that proposes is deliberately not the agent that approves; a planner does the work and a distinct evaluator tries to break it. The check has to come from somewhere structurally independent, or it is not a check at all.
Without it: when several agents collaborate, the "checker" simply agrees with the "maker" — they are effectively one worker nodding at their own homework — and mistakes sail straight through.
A newsroom's fact-checking desk for the outside world. Every external signal — a port closes, a price spikes, a supplier wobbles — arrives stamped with where it came from, when, and how reliable it is. Provenance travels with the fact.
Without it: the agent acts on a rumor, and later, when someone asks "why did you do that?", no one can prove where the information came from — or whether it was ever true.
A credit score that shows its work. Not one mystery number, but the parts that composed it, how confident the estimate is, and how it was adjusted for the specific situation in front of it. A risk score you cannot decompose is a risk score you cannot defend.
Without it: "the computer said the risk was a four" — with no way to explain it, defend it to a regulator, or know what would change it.
Building security: badge access plus a tamper-proof entry log. The doors an agent is not cleared for do not open — not a sign that asks it politely, a lock that physically will not turn. And every action is written into a record no one can quietly edit later. Policy is enforced at the protocol layer, not left to the good behavior of a model that can be talked out of it.
Without it: a clever prompt talks the agent into something it never should have done, and there is no reliable record of what actually happened.
A proper shift-handover log. When one agent clocks out and the next clocks in — or picks a job back up after two weeks — it reads a durable record of what is done, what is open, and where things stand, and continues exactly there. Memory that survives the session, and the passage of time.
Without it: every new shift walks in with amnesia — it redoes finished work, or assumes half-finished work is done and stops. On a long-running job, the work quietly stalls or ships half-built, and no one notices until it is expensive.
The two foundations — quieter, load-bearing, and the source of the worst surprises when they are missing.
The official company dictionary plus a locked records room. Everyone — every person and every agent helping them — works from the same agreed definition of things ("revenue" means this; "an active customer" means that) and pulls from the same official numbers, not a private spreadsheet. And the records room is locked: an agent can retrieve only the specific records the person behind it is cleared to see, enforced at the level of the data itself.
Without it: two agents answer the same question with two different numbers because each defined it its own way — and an executive cannot tell which is right. Or worse, an agent cheerfully surfaces a salary, a deal, a record that whoever asked was never allowed to see.
An always-current staff directory and equipment register. One master list of every agent, every tool, and every system: who owns it, whether it is approved, and whether it is the current version. The supply room and the security desk both work from this one list, so they never disagree about what exists.
Without it: no one can confidently answer "what AI do we even have running?" Unapproved "shadow" agents operate off the books, and the discovery and governance layers work from different, out-of-date lists — one handing out a tool the other does not even know exists.
Put the eight together and you get the thing a leader actually wants: clarity when something goes wrong. A well-run hospital, after a bad outcome, can tell you exactly which step failed — the diagnosis, the lab, the chart, the second opinion. A badly-run one just says "the hospital made a mistake," and every investigation touches everything and teaches nothing. The Spine gives your AI that same clarity: bad customer data traces to discovery, a bad outside fact to the signal fabric, a bad plan or a rubber-stamped check to coordination, a broken rule to governance, a lost thread to durable context, a wrong definition or a leaked record to grounded data, and an agent nobody approved to the registry. Every failure becomes a specific, ownable ticket instead of an abstract shrug.
Naming the eight concerns is not enough on its own. Two rules turn the architecture into something a boardroom can actually trust: how an agent earns its place, and how you tell your own agents apart from everyone else's.
You do not put a brand-new employee straight onto the floor handling real money. They start in a practice room — a safe sandbox where they can experiment and fail without breaking anything real — and they move to production only by passing a checkpoint. I call that checkpoint the Spine Gate. To cross it, an agent must prove its identity, hold only the tools its job needs, carry clean and private memory, draw on trustworthy signal, touch only data it is cleared for, appear in the master list, and sit at a risk level low enough for what it is allowed to do. The riskier the job, the higher the bar. One funnel, from practice room to production floor — so a company can let a hundred ideas bloom and still be certain only the trustworthy few ever go live.
The second rule is the difference between the tools you buy and the agents you build — and it is what keeps the whole thing honest.
Outside AI tools sign in at the front desk, wear a visitor pass, and enter only the rooms you allow. They never touch your data except through the concierge.
Your own agents carry full badges and live in the building. And the building never lets a visitor wander the halls pretending to be staff.
And none of this is proprietary. The Spine's specifications are open — published on GitHub, free to read, implement, and adapt on any stack you control. That openness is the whole point, and I come back to why below.
There is a layer most sovereignty conversations skip entirely: where your agents actually execute. It is the difference between an architecture on a whiteboard and one that runs.
The Spine describes how your AI workforce should be organized. The Sovereign Runtime Spine is where that workforce lives and works — the building itself. Every agent is bound to an identity, so no work is ever anonymous. Each works in its own room with the door closed and the room cleared out at the end of every shift, so one agent's failure or compromise cannot spread to another. Keys are per-room and per-job, tightening as the stakes rise. And everything is on camera and in a permanent logbook, so any incident can be reconstructed exactly.
The point that matters most is where the building stands. This runtime is something you host on infrastructure you already control — your cloud account, your servers, a rack of machines in a closet — not a place you rent inside a vendor's walls. It is portable across substrates by design: adopting it locks you to no one, including to the person who designed it. A runtime you cannot take with you is not sovereignty; it is a nicer cage.
Not every workload deserves the same protection, and pretending otherwise is how sovereignty programs die of their own weight. The discipline is to grade your work honestly and match each piece to the strongest assurance it actually needs — no more, no less.
Assurance comes in two forms, and the distinction is worth internalizing: contractual assurance is a promise you are trusting; structural assurance is a property you can verify. A retention clause is contractual. An air-gapped machine is structural. The higher the stakes of the data, the further you should move from promises you cannot check toward properties you can. That gives you three broad tiers of compute, and most institutions need all three at once.
For the compute you do not own outright, the obligation does not disappear — it shifts to verification. Demand real visibility into where your models run and under what conditions, and prefer arrangements where execution can be attested rather than simply asserted. The goal across all three tiers is the same: know, with evidence, where your intelligence physically is at the moment it is most exposed — while it is being reasoned over.
Owning your runtime protects the present. Owning your learning loop is how you compound into the future — and it is the piece most institutions give away without noticing.
Usage generates signal; signal is captured and structured into knowhow; knowhow improves the system; the improved system generates more usage. It is a genuine flywheel — but it only turns for the party that captures the signal. If that capture happens inside a model company's system, you have handed away the compounding, and they can productize your unique insight and sell it onward.
To keep the loop, you have to own its ingredients. That means private evaluations that measure whether a model is getting better at the outcomes you care about — not at a public leaderboard. It means private training, where models grow stronger on your real work. And it means an institutional memory you can query, so what the organization learns accrues to the organization. Because many frontier terms of service forbid training your own models on their outputs, owning the loop in practice means owning weights: using capable open-weight models as teachers, updating weights you hold, on infrastructure you run. There is a real capability trade here — the largest closed models still lead on raw ability — but most work does not require the frontier, and a fine-tuned open model on a loop you own beats a better model whose improvements accrue to someone else. This loop, not any single task it automates, is the new intellectual property of the institution.
Sovereignty sold back to you as a platform you rent is not sovereignty. It is dependency with better branding.
There is a version of everything above that the market will happily sell you: buy the platform, embed our engineers in your walls, and let us hold the ontology, the entitlements, and the runtime on your behalf. It is powerful, and it is a trap dressed as a solution — because the moment your architecture exists only inside one vendor's product, your sovereignty is a lease. You cannot lift the pattern out and run it on your own stack. You cannot take it with you. You have swapped a dependency on a model for a dependency on a platform, and called it freedom.
The alternative is to treat these as named concerns, not a product. The canonical model, the data-level entitlements, the coordination and governance, the registry, the runtime — every one of them is an architecture you can adopt on any substrate you already control, and keep even if you fire every vendor you have. That is the whole difference, and it is why I publish the specifications instead of selling them. The most complete proprietary systems in this space are, in the end, one instance of this architecture — the abstraction they declined to publish. A pattern anyone can implement creates no lock-in, travels in a memo, and costs nothing to adopt. Sovereignty that depends on a single supplier to exist was never sovereignty at all.
None of this requires permission. Every decision here is one you already have the standing to make; the only question is whether you make it deliberately or by default.
Stand up a small team and run the review this week. Walk your stack and ask the plain questions at each layer. Compute — do you have real visibility into where your models run, and can you move your most sensitive work onto hardware you control? Models — can you switch providers on your own terms tomorrow, or has your knowhow already begun leaking into weights you don't own? Control — are your most valuable workflows running on infrastructure you own, capturing the signal they generate the moment it is created? Then grade each workload honestly, match it to the strongest assurance it needs, name the eight concerns for the agents you run, and put a gate between your sandbox and your production floor.
Do it in that order and none of it is exotic. It is the ordinary discipline of running a workforce, applied a few years earlier than the incidents would otherwise force you to. The institutions that compound over the next decade will not be the ones with access to the largest model — everyone will have that. They will be the ones who kept the intelligence they created, who understood early that in an age when capability is rented by the token, the last durable advantage is ownership. Sovereignty and alpha were never in tension: sovereignty is how you keep the alpha. Go and hold it.