Residency is only one control
Data residency can be important, but sovereignty is broader. Organisations also need to decide who controls model access, prompts, retrieval sources, logs, evaluation routines, infrastructure choices, supplier dependencies and operational response.
Agent authority must be bounded
When AI systems can act through tools, the control model must describe what an agent can see, what it can do, which actions require approval and how exceptions are escalated. This is where architecture and governance need to meet.
Human ownership remains part of the design
Accountable people need usable review points. A sovereign AI design should make it clear where human judgement is required, how decisions are recorded and how the organisation can inspect what happened after the fact.