Sovereignty Is an Architecture Decision

I care about digital sovereignty for political reasons, and I'm not going to pretend otherwise. But if my politics only lived in what I say, they'd just be a feeling. What I want to show here is the version that lives in configuration: five rings for data, four rungs for action, and a handful of decisions from the last few months where the boundary held because I built it in, without relying on anyone to respect it.

Five Rings for Data

Every piece of data I work with sits in one ring, and it only moves outward through something I wrote.

Never touched by AI. Some material lives on an encrypted volume that isn't in any vault. No model reads it, no index touches it, and no sync client sees it. This is the ring people forget to draw. It's the only ring with an absolute rule, and everything else is a question of degree.

Local only. Embeddings for my recall layer are computed on my own machine with a local model and stored in a file-based vector database right next to it. Model serving runs locally too, for whatever fits. Those bytes don't leave the disk.

Gated. My vaults are Markdown, and they're mine, but a model works in them every day. Between the vaults and anything that leaves the machine sits a security gate. It's deterministic code that strips out truly private folders, stages only files that passed, and keeps a manifest so an unchanged rerun stages nothing and an edited note stages only itself. The nightly distiller reads the staging folder and nothing else.

Cloud by contract. The distilled recall layer lives in a hosted database, and hosted models do most of the reasoning. What crosses that line gets shaped first: domains are kept, and granular private specifics are dropped. The contract is whatever the gate lets through, and what the vendor promises to do with it doesn't change that.

Rented compute. Fine-tuning and other heavy jobs run on a cloud GPU I rent by the hour. Data goes up for the job and comes back down with the result, and nothing persistent stays on the box.

The rings aren't a purity ranking. Cloud models are better at reasoning than anything I can run at home, and I use them for most of the work. What matters to me is that I decided every crossing once, in code, so I'm not accepting someone else's default every day.

The Gate Is the Load-Bearing Part

If I lost everything except one component, I'd keep the gate.

The pipeline from a note on my machine to an answer on my phone has six stops, and every arrow between them is a boundary with an invariant attached. The distiller reads staging and writes the database, and only in that direction. No interactive session writes to the recall layer. When a session learns I was wrong about something, the correction goes into the vault, and the pipeline re-distills it the next night. The phone asks through a tunnel and never sees the vault at all.

Those invariants are what let me use hosted models without anxiety. The privacy decision was made upstream, once, by code I can read. The model downstream can't leak what it was never given.

Four Rungs for Action

Data is only half of it. The other half is what an agent is allowed to do.

Read. The corpus, the recall layer, a CRM's schema, the web. This happens on demand, when I ask. It doesn't happen proactively at the start of a session, because a model that reads my life before I've said what I want ends up answering questions I didn't ask.

Propose. A fix, a task, a draft, a diff. It gets shown to me, and then the agent waits. The rule I hold agents to is that a flag is only useful if it waits for my answer. Surfacing a judgment call and resolving it in the same breath takes the decision away from me while making it look like I was offered one.

Write on command. Memory writes happen when I say "remember this," "log this," or "save this." They happen immediately, they're confirmed back to me, and if a new fact conflicts with what's on file, the conflict gets flagged instead of overwritten. Nothing gets remembered automatically.

Never. No agent touches the private volume, writes to the recall layer from any session, or reaches production from a sandbox.

Task management sits above the ladder on purpose. I ran an automated task pipeline for a while and retired it in June 2026, and now I run my tasks by hand. The tooling worked fine, and I dropped it anyway, because the thing I most want to keep is my own sense of what I'm doing next, and the automation was quietly wearing that away.

Two Examples from This Month

While building the preview mode for this site, I put the read token for unpublished content on the production Worker. The standard pattern reads a plain cookie and, if it's there, renders drafts. That's fine on a domain behind a login. On a public domain, though, anyone who sets that cookie in their own browser can read everything unpublished. So the enable route also sets a signed, httpOnly session cookie, keyed with a secret only the Worker holds, and the middleware requires it. Without a valid signature, the perspective cookie on its own doesn't get anyone in.

The same week, the sandboxed agent working on the repository was refused a push to production by a permission classifier, and it couldn't force-push or delete branches through the proxy either. The agent asked me to do those steps myself. That's how it should work. Its reach was set by the environment, and no amount of good intent on its part could widen it.

The Politics, Briefly

Platforms grow by enclosure. Every default that keeps data in a platform's store, procedures in its format, and an agent's actions inside its permission model is a small rent, and it gets paid in the things people can no longer easily do without that platform. When I draw a boundary myself, that's a rent I don't pay.

I hold one standard here, the same one I try to hold everywhere: the vendor I like most gets the same rings and the same rungs as the one I like least. If I only applied sovereignty to the companies I don't like, it would really just be a brand preference.

What It Costs

The cost is friction: a recall layer that's a night stale instead of live, tasks I move by hand, a gate to maintain, and a GPU bill instead of a subscription.

I pay it because the alternative isn't free either. Its price is just deferred, and paid in a currency that's harder to see. Sovereignty that lives in configuration also has something sovereignty as a stance doesn't have, which is that I can point to the diff where each boundary is drawn.