Data residency is no longer enough: Advanced Intelligence makes sovereignty a question of control
The sovereignty conversation is shifting from where data resides to who controls how it is used.
Enterprises need visibility and governance over where models operate, what they can access and what actions they can take.
Maintaining control, enforcing policy, auditing activity and ensuring continuity are becoming essential as AI environments grow more autonomous.
Imagine a digital agent handling a loan application. It retrieves a customer’s credit data, assesses risk and finally initiates a disbursement, with each step governed by a different set of rules. If the data is stored within the country, the organization may meet a residency requirement. But does the agent have permission to access relevant systems? More importantly, can its actions be audited, and can the organization halt the process if required?
This is a key challenge connected intelligence introduces to data sovereignty. As enterprises move from using AI to generate information to deploying agents that can make decisions and take action, sovereignty can no longer be defined by data residency. Organizations need greater authority over the systems, models and processes that use it.
Commenting on how connected intelligence complicates the trusted cloud, Jean Coumaro, president and CEO of Bleu, said, “The challenge, to put it plainly, is staying fully in control of all data flows associated with LLM [large language model] usage. That is easier said than done. It touches on multiple layers of the overall architecture, and it is one of the defining technical and governance challenges for sovereign advanced intelligence in a trusted cloud environment.” Bleu is a French sovereign cloud services company jointly created by Capgemini and Orange.
Operational sovereignty: Control vs. location
It is here that the concept of operational sovereignty, or OpSov, gains significance. While data residency determines where data is stored or processed, operational sovereignty seeks to define who has the authority to access, manage and control the systems. More fundamentally, it asks who retains final authority when interests diverge: who can still say no to whom?
It is emerging as an effective strategy for organizations to address increasingly complex compliance and regulatory requirements while boosting network resilience. Operational sovereignty is ultimately about retaining authority over how a digital environment is governed, including controlling access, enforcing policy, maintaining visibility and preserving the ability to keep critical workloads running during a disruption.
This becomes harder to manage as intelligent workloads move across data centers, cloud platforms, on-premises infrastructure and edge environments. Organizations need to manage how data moves between them while maintaining visibility and control across workflows.
For AI deployments, that control needs to translate into practical capabilities. Organizations must be able to define which users, agents and services can access particular systems and data and what actions they are authorized to perform. Organizations also need visibility into which models are being used, what information they can access and where processing takes place. Further, they must be able to enforce organizational, legal and sector-specific compliance across workflows. Most importantly, the organization must retain the ability to override, constrain or terminate an autonomous agent if required. Visibility shows what an agent has done; governance determines what it is permitted to do; operational sovereignty means retaining the authority to stop it and keep critical systems operating.
Kate Johnson, CEO of Lumen Technologies, describes the growing role of orchestration as enterprises deploy advanced intelligence at scale. “You can’t do that without an orchestration layer,” she said, referring to the need to move data seamlessly between the different environments in which digital agents operate. This orchestration, she argues, is central to providing enterprises with networking solutions that support their intelligent transformation ambitions.
Orchestration therefore becomes more than a mechanism for coordinating intelligent workloads across different environments. It becomes part of the sovereignty layer itself: the point at which an enterprise determines where workloads run, which infrastructure they use, what policies apply and whether they are permitted to proceed. Organizations also need clear control over infrastructure, access and the policies governing those workloads.
Microsoft’s sovereign-cloud approach addresses this need by offering public- and private-cloud options, depending on where workloads run and the level of control required. This is determined by the sensitivity of the data, regulatory requirements and the organization’s operational needs. For instance, an organization may need to establish where sensitive data is processed, which administrators or services can access it, how policies are enforced and what happens if a critical service becomes unavailable.
For digital agents, the test is especially demanding. An organization needs not only to understand the agent’s access and authority but also to monitor what it does and retain the ability to intervene if required. It also needs to consider whether critical workloads can continue operating if a provider or jurisdiction is no longer available.
Its approach focuses on offering solutions based on three types of control: technical, contractual and operational. Technical controls govern data residency, encryption, access and security, while contractual controls establish legal rights, protections and obligations governing the infrastructure. Lastly, operational controls address who can make changes to the system. Operational sovereignty works when all three types of control work together to address data residency, legal compliance and operational control.
The sovereignty debate has focused on data localization for several years. Now, as connected intelligence becomes more autonomous and geopolitical issues reshape technology decisions, organizations face a tougher question: Who is in control? Data residency asks where the data lives. Sovereignty asks who controls the machines that use it. That is the test of operational sovereignty: when interests conflict, systems fail or an autonomous agent does something its owner does not want, who retains the authority to say no - and make that decision stick?
Explore digital sovereignty
See how questions of control, resilience and technological dependence are playing out in The Sovereignty Era, a documentary from FNTV and Microsoft. Watch the first episode!
Learn more about Microsoft’s approach to digital sovereignty: https://www.microsoft.com/en-us/sovereignty.
Stay connected with Fierce Network and Microsoft for more upcoming resources on operational sovereignty!