Sovereign Engineering: A 14-Minute Course on Who Can Read, Stop or Change Your AI

Course 34 · Sovereign Engineering

Sovereignty is usually sold as a place. A place only answers where the data sits. The course asks a narrower question: who outside your jurisdiction and outside your control can read your data, stop your service, or change how it behaves?

A 14-minute course in six modules. This page summarises it. The figures in it are the course’s own, from an invented insurer, and are illustrative.

The Short Answer

The course opens with a story it attributes to press reports. In July 2025 the staff of an oil refiner in India lost their email and meeting software. Nothing had failed in the refiner’s own systems. A European sanctions package had reportedly named the refiner, and its American vendor reportedly cut the access.

The customer sat in one jurisdiction, the vendor in a second, and the rule was made in a third. The course says the location of a server explains none of that.

Its answer is to stop treating sovereignty as a place. Ask who outside your jurisdiction and your control can read the data, stop the service or change how it behaves. Control over those three verbs is bought in rungs, and each rung has a price.

The whole discipline compresses into three instructions: name the verb, buy by the rung, rehearse the exit.

Module 1: Somebody Else’s Switch

The course says an outside party can do three things to a workload: read the data, stop the service or change how the service behaves. Each works through a different mechanism.

A read is legal compulsion aimed at the provider. The course cites an American statute of 2018 that obliges a provider to disclose data in its possession, custody or control, wherever the data is located. The order goes to the provider, not the customer. A read is quiet, because nothing breaks, and the course says firms that hold secrets fear it most.

A stop is the service withdrawn, usually under sanctions or export law, because the provider’s own government requires it. The course cites press reports that an international court’s chief prosecutor lost access to his email account after sanctions. It adds that the vendor later stated it had never suspended its services to the court. Both can be true, the course says, because the court kept its service while one mailbox went dark.

A stop reaches models too. The course says that in June 2026 access to two frontier models was suspended under export controls that applied for 18 days. A stop is loud and immediate, and a name on a list is enough. Firms whose operations halt when a system halts fear it most.

Change is the verb the course says AI added. The service keeps running and behaves differently. A model maker can update it, restrict what it answers or retire it, with published notice periods that run from 60 days to six months. An application that calls a convenience name is changed by someone else, on a date it did not choose.

Most firms fear one verb far more than the others, and the verb differs by workload. A marketing assistant fears none of them much. A claims system fears the stop. A model that drafts regulated advice fears the change. Until the verb is named, the course says, nobody can say which protection is worth buying.

Module 2: The Ladder

Control over the three verbs is bought in seven rungs, in order of rising cost. The course says residency is the first rung, and only the first: a service can be fully resident and fully exposed.

Rung two is the operator, who holds administrative access. It adds local staff and an approval gate before a support engineer touches your systems. The course says to read the exceptions first, because one provider’s documentation says the gate is not triggered by external legal demands. The second rung controls the hands on the system. It does not control the orders those hands can be given.

Rung three is keys. Every cloud encrypts stored data, so what matters is where the key lives. A key the provider stores is a key the provider can be ordered to use. An external key manager keeps the key on hardware you hold, and the cloud calls out for each operation. Revoking the key is a kill switch in your own hands. The course adds that keys protect data at rest, not data in use, and that search and the assistant stop working on that content.

Rung four is law. It asks which governments can give the operator an order it must obey. No configuration setting reaches it, because it is decided by who owns the operator and where that owner is incorporated.

Rung five is the model. A model reached through an interface is rented behavior, while weights on your own disk have no retirement date. The course advises renting the best model you can get and owning one that is good enough to keep the business running. Rungs six and seven, silicon and power, are not for sale to an enterprise. It reads them in its suppliers’ contracts.

Each rung costs more than the one below. For its invented insurer against a public region, the course says place adds nothing, the operator adds 10%, keys 15%, law 25%, and law with a model you run 40%. That extra cost is the sovereignty premium.

Module 3: Building a Sovereign Service

The course says to start with a list of the workloads you run, not with a provider’s catalogue. For each one, ask which verb would hurt, who could exercise it and what the loss is in money per day. The answers give the required rung: the lowest rung at which the named party can no longer act.

The invented insurer runs 12 AI workloads. Four have no named verb and stay on rung one. Three fear the provider’s staff and need rung two. Three need the keys. Claims triage and solvency reporting need law and a model the firm can run.

Then follow one request. The prompt passes a gateway, pulls context from an index, calls a tool and reaches the model. Three more hops are rarely drawn: the log, the trace and the agent’s memory. Ask the three verbs at every hop, because a workload sits at the rung of its lowest hop, not at the rung of its model.

The course says keys stop at the moment of use, because a model cannot reason over encrypted text. Confidential computing encrypts the memory of one workload, and attestation lets you check what runs inside it. It costs roughly 4 to 10% of throughput. It keeps out an operator looking through software, but it cannot keep out the one who holds the machine.

The final protection is the ability to leave, and the course says it is real only if it has been tested. Stand one workload up on a second operator with its data, keys, model, tools and tests. The invented insurer’s first drill took nine weeks, as an illustration. By the third it took nine days. The difference was a gateway the firm owned, keys held outside either provider, and neutral formats.

Then prove the rung. The course lists four kinds of evidence: records the system produces, independent reviews, certificates and the contract. A certificate tells you what an assessor checked on the day of the audit. Only evidence you generate yourself tells you what is true today.

Module 4: The Map of Sellers

The ladder can be explained without naming a company, but somebody has to sell each rung. The course says six kinds of seller appear as it reads 2026, that the names change and the shape changes slowly. One rule makes the map readable: every seller sells the highest rung it can reach, and names the offer after a higher one.

Hyperscaler sovereign offers build a separate region, staff it locally and wrap it in a local entity. The course says they reach the operator rung, and keys when you hold them outside. A sovereign region changes the operator. It does not change the owner.

Trusted-partner clouds license a hyperscaler’s technology and run it under local ownership. They reach law for the services inside their qualification, and for nothing else. Native clouds are owned and built inside the jurisdiction, sell the rung of law outright and charge for it in features.

Model routes decide who holds the weights, because a model you can only call is rented at any rung. National builders put land, power and accelerators inside a border. They reach place and power, and the chips arrive under another government’s license. Rule-makers and certifiers sell nothing. They write the yardsticks by which the other five are judged.

A state reads the same ladder with more tools. The course says no nation owns all seven rungs, because silicon is the exception. The realistic national bundle is six rungs owned and one negotiated, through the permission layer: the export licenses and sanctions through which another government decides whether you may buy a thing or keep using it.

The course says the chip rules changed at least five times in four years, in both directions. A license is a permission, and a permission can be withdrawn. So read every offer at the rung where it stands. Ask where the keys sit, which services the certificate covers, who can change the model and how many megawatts are switched on.

No single seller is the answer, the course says. The hyperscaler has the widest catalogue and the weakest answer on law. The native cloud has the strongest answer on law and the narrowest catalogue. Its engineering response is to read each dependency for its license, keep a second source, prefer shorter reservations and hold a passing model on your own disk.

Module 5: The Economics

The course says the sovereignty premium is paid in four currencies, and only the first appears on an invoice. Money is the first: two reported figures, neither a vendor statement, put sovereign offers about 15% above standard list prices. Features are the second: one sovereign region launched with about 90 services, where standard regions reportedly carry well over 200.

Capability is the third, because new model versions arrive months later. People are the fourth, because someone must run the key manager and serve the model. A buyer who compares list prices sees one currency of four.

The premium is insurance, and insurance can be priced. Divide the yearly premium by the loss if the event happens, and the result is the breakeven probability. In the course’s example, claims triage costs 1 million euros a year, and rungs four and five add 40%, or 400,000 euros. A stop costs 400,000 euros a day, so 20 days cost 8 million euros. The breakeven is 5% a year, or one event in 20 years. Above that chance the premium is cheap.

The course names three things that override the sum: a regulator may require the rung, the loss may be one the firm could not survive, or a customer may not sign without it.

Now price the whole estate. The invented insurer spends 10 million euros a year. Putting everything at rung four costs 25%, or 2.5 million euros. Classifying costs nothing on four workloads, 10% on three, 15% on three and 40% on the two critical ones, which comes to 1.175 million euros, or 11.75% of spend. The saving is 1.325 million euros a year.

The course calls the saving the smaller result. The larger one is that the two critical workloads now sit one rung higher than the blanket put them. A blanket rung feels prudent and is the opposite, it says: it overpays where nothing is at stake and underbuys where the firm is most exposed.

Module 6: Failures, the Five Moves and the Meters

Sovereignty rarely fails because a technology was missing, the course says. It fails because money went to the wrong rung, or to the right rung with a hole in it. It lists ten recurring failures: sovereignty theatre, the resident key, the leaking control plane, the telemetry trail, the orphaned air gap, the model that changed, the isolation tax, the paper exit, the single champion and the blanket rung.

Sovereignty theatre pays for a label that answers no verb. The resident key sits in the provider’s own service. The paper exit has a clause and no rehearsal. The blanket rung protects the marketing drafts and leaves the critical model rented. The ten share one root: in every case a purchase was made before a question was asked.

Five moves carry the method. Name the verb before you buy. Buy by the rung, not the label, because the label is the seller’s claim and the rung is the buyer’s test. Hold the keys and the evidence. Keep a model you can run yourself. Rehearse the exit.

Seven meters show whether the discipline works: classification coverage, the rung gap, key custody, foreign compulsion exposure, runnable model share, exit drill age and the premium ratio. The course leaves out the number of regions, any percent sovereign, certificates counted and gigawatts announced, because they are easy to collect and do not move.

After one illustrative year, the invented insurer’s coverage went from 0 to 100% and its rung gap from 8 to 0. Key custody rose from 10 to 85%. Exposure fell only to 60%, and the remainder was chosen. The course says control is a dial, not a flag: each workload gets its own setting, at a known price, with a known remainder.

Dependence that has been chosen is a commercial arrangement, the course says. Dependence that has only been inherited is an exposure.

Next: Run It With an Agent

A companion video runs the same method with an agent on the same invented insurer, from a list of workloads to a page of meters. See Run It With the Agent.

The Course’s Exercises

1. Module 1: take one workload you depend on. Which verb would hurt most, and who could exercise it?
2. Module 2: take one offer sold to you as sovereign. Which rung does it actually reach, and what does it charge?
3. Module 3: follow one request through your own agent and write down who operates each of the seven hops.
4. Module 4: take the offers in front of you and write beside each one the highest rung its published design supports.
5. Module 5: for your most critical workload, estimate the premium, the daily loss and the duration. Which side of the breakeven do you sit on?
6. Module 6: write the register for three workloads, with the verb, the party, the loss and the rung, then set a date for the first drill.

See It in the News

Aleph Alpha’s Kolibri: 1M Context, Trained to 256K. A news piece on an open-weights model release, the kind of asset the course’s rung five says a firm can hold on its own disk.