PDS
Finding the right tool
A supply room with a good concierge. Say what you need and get the five tools that fit. Also the only door in or out.
The institutions that win the next decade will own the intelligence they create. Here is how to keep yours.
The intelligence your institution creates, its judgment, its hard-won knowhow, the way it actually wins, is the one asset you cannot buy back once it is gone. Right now that asset is quietly transferring to whoever you rent your models from. You have more agency here than the market wants you to believe, and sovereignty is simply the decision to use it. This essay walks through the decisions that one contains.
Every institution runs on tribal knowledge: the operational knowhow, the judgment, the workflows that make it good at what it does. That is the asset. In the age of AI, it is leaking.
Every time your people work through a model you do not control, some of that knowhow gets encoded somewhere you cannot reach. Model providers have a structural incentive to pull your intelligence into their weights. Once it lives there, they can lease it back to your competitors, price against your best work, or enter your market themselves. If your incentives were truly aligned, they would charge you a share of the value they help create. They charge you per token. That tells you who the flywheel serves.
None of this needs bad actors. Ordinary commercial pressure and enough time will do it. Sovereignty is the decision to keep the flywheel pointed at yourself, and it rests on four things you can actually own: your data, your weights, your runtime, and your learning loop. I hold nine convictions about this. They are the test I apply to every decision.
Your sovereignty dictates your institution's future.
Your data is the treasure; transfer it at your peril.
Don't let the token meter become your measure of worth.
Control your weights and you control your fate.
Sovereignty and alpha are not in tension.
Do not let sovereignty become a political costume.
Real expertise is existential.
Learn from institutions that actually win.
Track record is the only signal.
Sovereignty is a series of decisions across three layers of the stack. Hold the top and the bottom tightly. Hold the middle loosely, on purpose.
Compute sits at the bottom, the physical substrate everything runs on. Models sit in the middle, increasingly commodity, increasingly interchangeable. The control layer sits on top: the workflows, the ontology, the agents. That is where your knowhow gets captured and compounded into advantage.
Own the top, because that is where your alpha accrues. Own or verify the base, because that is where your data physically lives while it is being reasoned over. Keep the middle interchangeable. The moment you are locked to a single model, the supplier can change the terms on price, retention, or availability and call it a policy update.
Data sovereignty starts with the most concrete decision of all: where your intelligence is allowed to go, and how you prove it stays there.
Zero Data Retention (ZDR) means none of your data is kept beyond the instant needed to answer a request. Not stored, not used for training, not read by a human. Most enterprise contracts promise the last two. ZDR makes the promise structural instead of a matter of trust. Consider litigation alone: providers have written into public contracts that retained data will be deleted "unless legally required to retain" it, and discovery can sweep up millions of stored conversations. Data that was never stored cannot be reached.
But ZDR is negotiated per provider, and it is porous exactly where the wording is porous. Classifier logs and derived metadata often sit outside the phrase "customer content," so a lab can promise not to retain what you sent while retaining what it inferred about it. Treat ZDR as a floor you have to keep re-pouring. Necessary, not sufficient.
An extraction-prone model is any third-party model, used without a retention guarantee, trained by a firm with an incentive to compete with you. The right default is zero trust. The frontier is genuinely useful. Handing it your compounding advantage, uncounted, is not.
Follow ZDR to its conclusion and you get something stronger than any contract clause. For the work that carries your real edge, the data should never leave your walls: inference on hardware you own or control, where no query touches a third-party cloud and the proof is a packet capture, not a promise. I call this the Sovereign Inference Guarantee. Not every workload needs it. The ones that carry your edge do.
Your AI agents are a workforce, and most institutions run them like no workforce in history: no badge, no manager, no record of who did what. A handful of assistants you can watch. Fifty agents touching real money and production systems are a different animal.
Every organization solves the same problems to run a workforce at scale. You can design for them up front, or discover them one incident at a time. I have named them in advance, and I call the set the Spine: the organizational structure for a company's AI workers. Six concerns are the daily jobs. Two are foundations. The map below is the whole thing at a glance.
The six jobs.
A new hire does not get two hundred tools dumped on their desk. They say what they need and a good concierge hands them the five that fit. That is this layer. It is also the only door in or out, so there is no side entrance to your systems or your data.
Without it: the agent drowns in choices, grabs the wrong tool, or reaches somewhere it was never meant to reach.
Separation of duties, applied to machines. The agent that proposes is never the agent that approves. A planner does the work and a distinct evaluator tries to break it. A check that is not structurally independent is not a check.
Without it: the checker simply agrees with the maker, one worker nodding at its own homework, and mistakes sail through.
A fact-checking desk for the outside world. A port closes, a price spikes, a supplier wobbles. Every signal arrives stamped with where it came from, when, and how reliable it is. Provenance travels with the fact.
Without it: the agent acts on a rumor, and nobody can later prove where the information came from or whether it was ever true.
A credit score that shows its work: the parts that composed it, the confidence around it, the adjustments made for the case in front of it. A risk score you cannot decompose is a risk score you cannot defend.
Without it: "the computer said the risk was a four," with no way to explain it, defend it, or know what would change it.
Building security: badge access plus a tamper-proof entry log. Doors an agent is not cleared for do not open. Not a sign asking politely, a lock. Every action lands in a record no one can quietly edit later.
Without it: a clever prompt talks the agent into something it never should have done, and there is no reliable record of what happened.
A proper shift-handover log. The next agent reads what is done, what is open, and where things stand, then continues from exactly there. Memory that survives the session and the passage of time.
Without it: every shift starts with amnesia. Finished work gets redone, half-finished work ships, and nobody notices until it is expensive.
The two foundations. Quieter, load-bearing, and the source of the worst surprises when they are missing.
The official company dictionary plus a locked records room. Every person and every agent works from the same agreed definitions and the same official numbers, not a private spreadsheet. And the records room is locked: an agent retrieves only what the person behind it is cleared to see, enforced at the data itself.
Without it: two agents answer the same question with two different numbers. Or an agent cheerfully surfaces a salary the asker was never allowed to see.
An always-current staff directory and equipment register. One master list of every agent, tool, and system: who owns it, whether it is approved, whether it is the current version. The supply room and the security desk work from this one list.
Without it: nobody can answer "what AI do we even have running?" Shadow agents operate off the books, and discovery and governance work from different, out-of-date lists.
Put the eight together and you get the thing a leader actually wants: clarity when something goes wrong. A well-run hospital can tell you exactly which step failed after a bad outcome. A badly-run one says "the hospital made a mistake," and every investigation touches everything and teaches nothing. The Spine gives your AI workforce that same clarity. Every failure becomes a specific, ownable ticket.
Naming the concerns is not enough. Two rules make the architecture something a boardroom can trust: how an agent earns production, and how you tell your own agents from everyone else's.
You do not put a brand-new employee straight onto the floor with real money. They start in a practice room and move up by passing a checkpoint. I call that checkpoint the Spine Gate. To cross it, an agent proves its identity, holds only the tools its job needs, carries clean memory, draws on trusted signal, touches only cleared data, appears in the master list, and sits at a risk level acceptable for what it is allowed to do. The riskier the job, the higher the bar. A company can let a hundred ideas bloom and still be certain only the trustworthy few go live.
The second rule is the difference between the tools you buy and the agents you build.
Outside AI tools sign in at the front desk, wear a visitor pass, and enter only the rooms you allow. They never touch your data except through the concierge.
Your own agents carry full badges and live in the building. And the building never lets a visitor wander the halls pretending to be staff.
None of this is proprietary. The Spine's specifications are published on GitHub, free to read, implement, and adapt on any stack you control. That openness is the point, and I come back to why below.
Most sovereignty conversations skip the layer where your agents actually execute. It is the difference between an architecture on a whiteboard and one that runs.
The Spine describes how your AI workforce is organized. The Sovereign Runtime Spine is the building it works in. Every agent is bound to an identity, so no work is anonymous. Each works in its own room, cleared out at the end of every shift, so one compromise cannot spread to another. Keys are per-room and per-job, tightening as the stakes rise. Everything lands in a permanent logbook, so any incident can be reconstructed exactly.
What matters most is where the building stands. You host this runtime on infrastructure you already control: your cloud account, your servers, a rack in a closet. It is portable by design, so adopting it locks you to no one, including me. A runtime you cannot take with you is not sovereignty. It is a nicer cage.
Not every workload deserves the same protection. Pretending otherwise is how sovereignty programs die of their own weight.
Assurance comes in two forms. Contractual assurance is a promise you trust. Structural assurance is a property you can verify. A retention clause is contractual; an air-gapped machine is structural. The higher the stakes, the further you move from promises toward properties. That gives you three tiers of compute, and most institutions need all three at once.
For the compute you do not own, the obligation shifts to verification. Know, with evidence, where your intelligence physically is at the moment it is most exposed: while it is being reasoned over.
Owning your runtime protects the present. Owning your learning loop is how you compound, and it is the piece most institutions give away without noticing.
Usage creates signal. Signal, captured and structured, becomes knowhow. Knowhow improves the system, and the improved system drives more usage. The flywheel is real, but it only turns for the party that captures the signal. If that capture happens inside a model company's product, the compounding is theirs, and your unique insight becomes a feature they sell onward.
Keeping the loop means owning its ingredients: private evaluations that measure the outcomes you care about, private training where models improve on your real work, and an institutional memory you can query. Most frontier terms of service forbid training your own models on their outputs, so owning the loop in practice means owning weights: capable open-weight models as teachers, updated on infrastructure you run. There is a real trade here. The largest closed models still lead on raw ability. But most work does not need the frontier, and a fine-tuned model on a loop you own beats a better model whose improvements accrue to someone else. This loop is the new intellectual property of the institution.
Sovereignty sold back to you as a platform you rent is not sovereignty. It is dependency with better branding.
There is a version of everything above that the market will happily sell you: buy the platform, embed our engineers in your walls, let us hold the ontology and the runtime on your behalf. It is powerful. It is also a trap, because the moment your architecture exists only inside one vendor's product, your sovereignty is a lease.
The alternative is to treat these as named concerns, not a product. Every one of them can be adopted on any substrate you already control and kept even if you fire every vendor you have. That is why I publish the specifications instead of selling them. A pattern anyone can implement creates no lock-in, travels in a memo, and costs nothing to adopt. Sovereignty that depends on a single supplier was never sovereignty at all.
None of this requires permission. Every decision here is one you already have the standing to make. The only question is whether you make it deliberately or by default.
Stand up a small team and run the review this week. Compute: do you know where your models run, and can you move your most sensitive work onto hardware you control? Models: could you switch providers tomorrow, or has your knowhow already started leaking into weights you don't own? Control: are your most valuable workflows capturing their own signal on infrastructure you own? Then grade each workload, match it to the assurance it needs, name the eight concerns for the agents you run, and put a gate between your sandbox and your production floor.
Done in that order, none of it is exotic. It is the ordinary discipline of running a workforce, applied a few years before the incidents would force it. The institutions that compound over the next decade will not be the ones with the largest model. Everyone will have that. They will be the ones who kept the intelligence they created. Sovereignty and alpha were never in tension. Sovereignty is how you keep the alpha. Go and hold it.