Sovereign & critical infrastructure
National platforms, public data estates, and residency that is not negotiable.
The problem in one sentence
When the platform is national, the failure mode is not a customer complaint. Governance has to be demonstrable to a body that can compel disclosure.
Where it breaks
Residency
Agent inference frequently crosses borders invisibly through provider routing. Most architectures have never traced where a prompt physically goes.
Consent & purpose
DPDP binds processing to stated purpose. Agents generalize across purposes by nature — that has to be constrained architecturally.
Sovereign dependency
An agent stack that cannot function without a foreign provider is a resilience question before it is a compliance question.
Attestation to the state
Evidence has to satisfy an examiner with statutory powers, not an internal dashboard.
The Sovereign & critical infrastructure regime references above are checked against their primary sources on an ongoing basis. Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
If any of this is live for you
The fastest route is a conversation. Bring the architecture you are worried about — the first useful thing usually surfaces inside twenty minutes.