Genesis: Human Experience in the Age of Artificial Intelligence | Synthesis: The Superintelligence Protocol

Subscribe

Genesis: Human Experience in the Age of Artificial Intelligence | Synthesis: The Superintelligence Protocol

admin Avatar

By

Luke Soon

·

—

The Wrong Test for Sovereign AI

The World Economic Forum is right that not all AI should be sovereign, but it is measuring the wrong thing: in the agentic age, sovereignty is not where your AI lives but who can stop it, swap it and switch it back on.

I. The tyranny of the top-secret stamp

Every bureaucracy learns the classification paradox eventually: stamp everything secret and nothing is, and the vault fills with lunch menus. So I cheered when I read the WEF Centre for AI Excellence piece of 12 October, “Governments want to safeguard their tech. But not all AI should be sovereign”. Two McKinsey partners, writing for the Forum, put the point better than most of the sovereignty literature has managed in two years: “declaring every workload sovereign-critical works about as well as stamping every file top secret”.

Their argument is tidy. “Sovereignty” breaks down into four kinds of control: territorial (where data and compute physically sit), operational (who runs and secures the systems), technological (who owns the stack and its intellectual property) and legal (whose courts govern access). Each workload should be classified by the sensitivity of its data. The default is not sovereign, and a workload escalates only when that sensitivity clears a defined bar. Sovereignty is costly: sovereign offerings run 10 to 30 per cent dearer, migrations take three to four years, and up to $600bn of AI spending could be shaped by sovereignty by 2030. Infrastructure that cannot be staffed or upgraded, they add, merely swaps one dependency for another.

I agree with almost all of it. The figures are the firm’s own and their methods undisclosed, but outside evidence points the same way: independent analysis puts the AWS European Sovereign Cloud at roughly 15 per cent above Frankfurt. The premium is real and bounded. All-or-nothing sovereignty, the national frontier model as a flag on the moon, deserved its demolition.

And yet the piece has a blind spot. It is not a small one, and it sits exactly where the next five years will be decided.

II. A storage-era answer to an agentic-era question

The WEF piece triggers sovereignty on data sensitivity, which is to say on confidentiality. That is the right instinct for an era when AI mostly stored and retrieved things. It is the wrong one for an era when AI acts.

Look at the two incidents of the past eighteen months that actually hurt. In May 2025, after the United States sanctioned the International Criminal Court’s chief prosecutor, Microsoft disconnected his email account, and the court later began moving to openDesk, a German open-source suite. (Microsoft has disputed that it blockaded the court’s mail.) Then, on 9 June 2026, Anthropic released Claude Fable 5 and Claude Mythos 5. On 12 June it suspended access to both models to comply with US Department of Commerce export controls. The Department lifted those controls on 30 June, and Anthropic restored access on 1 July. The models vanished at once from every cloud marketplace that carried them, according to the Cloud Security Alliance, whose conclusion was blunt: a commercial frontier model “can be withdrawn from operation by administrative order at any time”.

In neither case did the data move. Nobody’s records were exfiltrated, and no residency rule was breached. The service simply stopped. Data residency, sovereign regions, partner-operated clouds and carefully negotiated contract terms offered no protection, because the restriction applied to the thing being run, not to the place it ran. Lawyers advising affected firms told clients to keep dependent integrations switched off “unless and until lawful access is confirmed“. That is not a confidentiality problem. It is a continuity problem.

The WEF article’s own example shows the gap. It describes a hospital that keeps patient records in-country while running foreign-built diagnostic models. Under a confidentiality test, that is exemplary. Now ask what happens to the hospital on the morning the diagnostic model is withdrawn. The framework classifies the records. It does not classify the dependency.

Agents make this sharper. I have described the past three years as a journey from Prompts → Loops → Loop Governance: from judging single answers, to agents that take a goal, call tools and iterate with no human in between, to the discipline of designing, bounding and owning those loops. When a chatbot disappears, someone loses a convenience. When the model under an agentic loop disappears, it leaves a half-finished process: a claims queue, a reconciliation run, a triage list. A storage-era framework asks where the data sleeps. An agentic-era framework has to ask what the system is doing while it is awake, and who can intervene.

III. A confession, and a step forward

Honesty requires a short detour through my own back catalogue. In November 2025 I wrote, in “The Rise of Sovereign AI”: “Don’t just “adopt AI”. Architect your national intelligence stack.” That was, at best, premature. By July 2026, in “The Sovereignty Mirage..”, I had concluded that buying, building and leasing are all dependencies with different contract lengths, and I summarised the doctrine in four words: “Not autarky. Optionality.” Then, in my kill-switch post of 17 October, I argued that sovereignty “is about who can switch it off, and who can switch it back on.”

I stand by both, but neither is enough. Optionality was a principle and the kill switch a metaphor; neither tells a board which workloads to protect, or how it would know it had. What follows supplies a test, a list of powers and a drill.

IV. Schmitt in the server room

Carl Schmitt, whose later politics make him a guest one cites with the windows open, gave political theory its most quoted sentence: “Souverän ist, wer über den Ausnahmezustand entscheidet“, sovereign is he who decides on the exception. I use it here as a diagnostic, not as an endorsement. It is uncomfortably precise.

The Westphalian imagination pictures sovereignty as a walled garden, though Andreas Osiander has shown that baseline rests on “a past that is largely imaginary“. Krasner called sovereignty organised hypocrisy: no state has ever held every kind at once, so the real question is which kinds to buy, and at what price.

Translate Schmitt into the agentic age and the sentence rewrites itself. The exception is the outage. The sovereign is whoever can still act during it. In June, the decision on the exception was taken in one capital, for customers in every other. Reasonable people differ on the merits of that export policy, and this piece takes no view on them. The structural fact for every buyer outside the United States is the same whatever one thinks: the power to decide on the exception was held somewhere else. Britain’s Tom Tugendhat caught the mood in a single line: “sovereignty is more about code than cannons“. I would add one refinement: it is about code that you can still run on the day someone else’s code stops.

V. Four taps and a poisonous shrimp

Singapore has been here before, with a resource far more existential than tokens. The city-state has drawn water from Johor under a 1962 agreement for its entire independent life, and the government’s own account is plain: “Water has always been a strategic and existential issue for us.” The fear, as Al Jazeera recorded it, was that Malaysia “may one day turn off the tap.”

What Singapore did next is the most useful sovereignty lesson I know. It did not stop importing. It built the Four National Taps: local catchment, imports, NEWater (recycled water, from 2003) and desalination. Dependence remained, but it could no longer be weaponised. That is sovereignty by redundancy, not by ownership, and it is the governing metaphor for everything that follows.

It also reconciles two old Singaporean instincts. One is Lee Kuan Yew’s poisonous shrimp, “Some shrimps are poisonous: they sting.“, the small state that cannot be swallowed cheaply. The other is his insistence, decades later, that “If we are not connected to this modern world, we are dead.” Connection without redundancy is vassalage. Redundancy without connection is a moat around an empty castle. The four taps did both.

Singapore’s ministers already talk this way about AI. Vivian Balakrishnan, relaying Deputy Prime Minister Gan’s view, said in May: “Singapore is not likely to be at the frontier of model development. But we can be at the frontier of deployment at scale.” Josephine Teo reached for aviation at a World Economic Forum panel in January. Singapore does not build aircraft but manages its airspace, and “Sovereignty comes through by being able to exercise the necessary controls when there is a demand for it“. In February she described the aim to “operate as a trusted node” in a world some see as balkanised. After June, the ministry’s parliamentary answer committed to “partnerships with multiple providers“. It stated no continuity threshold and no acceptable lag behind the frontier. That missing number is the fourth tap that has not yet been built.

The rest of Asia is running the same experiment in different keys. Japan’s second AI Basic Plan, adopted in July, calls for “an open approach to AI sovereignty” that avoids dependence on particular vendors or countries. India has trained Sarvam’s models from scratch while practising what its foreign minister calls “multi-alignment or multi-vector” diplomacy: more partners, not fewer. Korea, which went furthest towards a national foundation-model contest, now has its ICT ministry reviewing whether to proceed to the final round, and one Seoul op-ed warned that “The real danger lies in mistaking foundation model development for an end in itself“. Bilahari Kausikan’s realism explains why the middle path is open at all: great-power rivalry “gives small countries like us manoeuvre room.”

Then there is the irony I cannot resist. Singapore’s flagship regional model, SEA-LION, moved its base from Meta’s Llama to Alibaba’s Qwen in November 2025: a sovereign model on a foreign base, which swapped one superpower’s foundation for the other’s. Purists call that a contradiction. I think it is the whole point. The sovereign asset was never the base model. It was the ability to change it. Eric Schmidt warns that governments will standardise on Chinese open models “not because they’re better, but because they’re free.” In August I worried aloud about standards capture. The resolution is more precise than either cheerleading or alarm. Open weights end the availability dependency, because they cannot be recalled. They do not end the provenance dependency. A fallback you have not assured is not a fallback.

VI. From where AI sits to what AI does

Here is the reframe. Sovereignty is moving from where AI sits to what AI does, and to who can stop it, swap it and restart it. McKinsey’s default survives: most workloads should not be sovereign. What changes is the escalation trigger. One bar becomes three.

AxisThe questionWhat a high score demandsExample of a high scorer
1. Data sensitivityHow bad is it if this data is seen or compelled by a foreign authority?Territorial and operational control: residency, local keys, local operatorsPatient records, citizen identity data
2. Continuity criticality and substitutabilityHow long can this stop, and how fast can another model take over the loop?Legal and technological control: a tested second supplier, an open-weight fallback, exit termsClaims adjudication, payments screening, port logistics
3. Delegated autonomyWhat may this system do without a human?Runtime control: local credentials, local telemetry, a local stop outside the modelAgents that pay, trade, dispatch or prescribe

The WEF framework scores the first column well and ignores the other two. The June episode was entirely about the second. The coming decade will be dominated by the third. Josephine Teo has already stated the principle for that third axis better than any consultancy: “The bigger the potential impact of an AI-enabled action, the stronger the safeguards and human oversight should be.” Note the noun: action, not data.

A workload that scores high on the second and third axes needs what I call runtime sovereignty. It has five powers, and each one should have a named holder:

  1. Authorise. Who grants the agent its credentials and tool permissions, and under whose law?
  2. Observe. Whose telemetry records what the agent did, and can it be read without the vendor’s cooperation?
  3. Stop. Who can halt the agent at the moment of action? My enforceability test applies here without modification: can the control refuse a specific action “by a rule that does not run on the model it is meant to restrain”? A stop that depends on the model’s cooperation is a request, not a control.
  4. Swap the model. Can a tested alternative take over the loop without breaking customer commitments? June showed that this is a legal and contractual exercise as much as a technical one.
  5. Decide when it comes back on. Who restores the system, and on what evidence?

In June, every one of these powers was exercised from outside the affected countries. Authorisation was withdrawn by a licence requirement, the stop was executed by the vendor at its government’s direction, substitution was left to each customer to improvise, and restoration was decided in Washington. None of the leading frameworks I reviewed assigns the fifth power to anyone. That includes the WEF article, the think-tank tiering models and, so far, Singapore’s own admirable stack. Whoever writes restoration authority into a standard first will define what sovereignty means in the agentic age.

That brings me to the drill. From suspension on 12 June to restoration on 1 July was nineteen days. So here is the most practical sovereignty test I can offer:

The 19-day drill. Which of your agentic workflows must keep running for nineteen days without your primary model, withdrawn by a decision you do not control? And have you rehearsed it?

Nineteen days is a floor, not a forecast. The next suspension could be shorter, longer or permanent. The University of Surrey’s sovereignty paper sets the right ambition, to “arrange never to be helpless“, and it reminds us that a trailing fallback is a floor, not parity. In the kill-switch post I wrote that an unrehearsed switch is worse than a hope; the same is true of an unrehearsed fallback. Optionality you have never exercised is a brochure, not a capability. The drill turns my July principle into something an auditor can watch happen.

The cost is modest: Surrey sizes inference sovereignty at an indicative tens to low hundreds of millions of dollars, far less than a national frontier model and rather more than a data-residency clause. That is where the right answer lands.

VII. Follow the invoice

There is an old rule in political economy: when someone hands you a definition, check what they sell. Every major player in this debate defines sovereignty around the layer it monetises.

Chipmakers sell compute sovereignty. Nvidia’s sovereign revenue more than tripled to over $30bn in its 2026 fiscal year, and its pitch is that every nation needs its own AI factory. Hyperscalers sell residency and key sovereignty: data boundaries, local operators, customer-held keys. Some go further. Google’s air-gapped Distributed Cloud “cannot be remotely shut down by Google“, and Microsoft has pledged to contest orders to cease providing cloud services to European governments, a promise not yet tested against an export or sanctions directive. Challenger labs sell jurisdictional sovereignty: open weights and non-American origin. Mistral deserves credit for conceding, in its own launch material, that “control over where AI runs, however, is only one part of AI sovereignty“. Consultancies sell tiering: workload classification as an advisory engagement. The WEF piece does not mention that its authors’ firm sells exactly that. Brookings, to its credit, discloses its hyperscaler donors in its own sovereignty report. Bloomberg’s Lionel Laurent said of the chipmakers’ pitch that “if there were prizes for irony, it’s a concept that might win a few.“

None of this makes the definitions wrong; each captures something real. But distrust any definition of sovereignty that happens to match the definer’s product line exactly.

That rule applies to me as well. Runtime sovereignty sits uncomfortably close to what I build. As I wrote in August: I sell the gate. Weigh my enthusiasm accordingly. The fairest test I can offer is whether the argument survives if you buy nothing from anyone. It does. The nineteen-day drill costs a calendar invite and an uncomfortable afternoon.

VIII. My usual panel

As usual, I convened my panel of AI’s leading voices, in their own words. They fall into three camps.

The maximalists: own it, or be owned.

My rejoinder. June was the maximalists’ best month, and they used it well. Gomez is right that renting carries risk, but full control is available only to two continental powers; even Europe’s gigafactories will run on American accelerators. Mensch defines sovereignty as weight rather than walls, which puts him closer to the steerers than his marketing suggests. Sovereignty on someone else’s rails is a fine product, but it is a product. The maximalist error is to answer a continuity problem with an ownership solution: owning the factory does not help if the chips, the base weights or the export licence sit elsewhere.

The steerers: interdependence, open weights, choice.

My rejoinder. This is my camp, more or less, and so it deserves the hardest questions. Kai-Fu Lee’s sentence is the best one on this panel, but having a second choice is not the same as being able to use it on day one. Choice that has never been exercised is theoretical, and a fallback that has not been tested may not work when it is needed. Ng frames sovereignty as preventing a cut-off. The more realistic goal is surviving one, since a mid-sized economy cannot prevent a superpower’s decision. LeCun’s open platforms solve availability but not provenance. The steerers have the right destination. What they lack is the drill.

The safety-first camp: control the compute, build the coalition.

My rejoinder. The safety camp’s sovereignty runs the other way from everyone else’s. It wants control concentrated among a few trusted hands rather than spread to every capital, and it treats “sovereign AI for everyone” as a proliferation risk. June made the tension concrete: a control exercised by one state for safety reasons looked, to every other state, like a foreign kill switch. Runtime sovereignty is how the two can coexist. Let the developer and its home state hold the stop at the source. Let each deploying jurisdiction hold the stop, the swap and the restart at the point of use. Bengio’s coalition logic then becomes practical: middle powers pooling assured fallbacks, rather than each building a lonely fortress.

IX. Long-AND, and the fork in the road

The sovereignty debate is still conducted as a Short-OR: build or buy, global or sovereign, frontier access or national control. The honest answer is a Long-AND: global AND sovereign, frontier access AND a rehearsed fallback AND local assurance AND talent that can run the switch. The Tony Blair Institute put the cost of the Short-OR well: “Failing to access and apply the best systems is itself one of the greatest threats to sovereignty today.” Isolation is not safety. It is simply a slower way to fall behind.

Which returns me to The Fork. One road leads to Star Trek: a federation of interoperable, redundant, mutually assured nodes, in which dependence is normal and coercion is expensive. The other leads to Mad Max: AI islands, fortress stacks and every capital hoarding GPUs and suspicion. BCG’s line, “You can nationalize the artifact, but not the capability“, is a warning against the second road. Singapore’s four taps are a map of the first.

None of this is free. Building fallbacks, writing restoration clauses, paying a premium for the minority of workloads that need it, and rehearsing an outage nobody wants to imagine: this is the short-term turbulence. The long-term abundance is a world where frontier AI can flow across borders precisely because no single border can switch it off. Short-term turbulence for long-term abundance, but only for those who build the redundancy before they need it.

X. Monday morning

For boards and governments, seven things to do this week, not this decade:

  1. Re-score your AI portfolio on three axes, not one. Keep not-sovereign as the default, but escalate on continuity and delegated autonomy as well as data sensitivity.
  2. Run the 19-day drill. List every agentic workflow that must survive nineteen days without its primary model, fail it over to the alternative in a rehearsal, and put the next rehearsal in the diary.
  3. Name a holder for each of the five powers (authorise, observe, stop, swap, restart) for every high-scoring workflow. A blank cell is a finding.
  4. Hold the stop locally and outside the model. Make it deterministic and bound to local credentials, so that it does not depend on the vendor’s cooperation.
  5. Write restoration authority down. Decide who switches the system back on, and on what evidence. Put it in the runbook and in the contract.
  6. Contract for continuity, not just residency. Include suspension-notice clauses, model-substitution rights and disclosure of any vendor model swap.
  7. Governments: publish a continuity threshold and assure the fallbacks. Say which national functions must pass the drill and how far behind the frontier they can afford to be. Then use the assurance machinery you already have to test the open-weight fallbacks those functions will rely on.

Singapore did not win its water security by owning every raindrop. It won by making sure that no single tap could be used against it. Intelligence deserves the same treatment: sovereign enough to say no, open enough to stay relevant, and redundant enough that the no is survivable. In the agentic age, the sovereign is not whoever owns the model. It is whoever is still running on day nineteen.

Sources

Trigger and economics

Incidents

Philosophy and history

Singapore and Asia

Frameworks, vendors and think tanks

Panel

Earlier Genesis posts referenced

Leave a Reply

Short-term Turbulence for Long-term Abundance.

lumelalabs.ai