Sector
Sovereign & critical infrastructure
National platforms, public data estates, and residency that is not negotiable.
India DPDP Act
Data residency & localization
Sectoral critical-infrastructure rules
Data residency & localization
Sectoral critical-infrastructure rules
The problem in one sentence
When the platform is national, the failure mode is not a customer complaint. Governance has to be demonstrable to a body that can compel disclosure.
Where it breaks
| Failure point | What actually happens |
|---|---|
| Residency | Agent inference frequently crosses borders invisibly through provider routing. Most architectures have never traced where a prompt physically goes. |
| Consent & purpose | DPDP binds processing to stated purpose. Agents generalize across purposes by nature — that has to be constrained architecturally. |
| Sovereign dependency | An agent stack that cannot function without a foreign provider is a resilience question before it is a compliance question. |
| Attestation to the state | Evidence has to satisfy an examiner with statutory powers, not an internal dashboard. |
The Sovereign & critical infrastructure regime references above are checked against their primary sources on an ongoing basis. Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
Next step
If any of this is live for you
The fastest route is a conversation. Bring the architecture you are worried about — the first useful thing usually surfaces inside twenty minutes.