# Five questions that test any AI sovereignty claim Palantir says sovereignty is your alpha. Agreed. Here is how a buyer verifies the claim before signing. > By Saad Bin Shafiq, Founder of Nodes ยท Jul 13, 2026 > Canonical: https://www.nodes.inc/blog/ai-sovereignty-diligence-test --- Sovereignty became the most valuable word in enterprise AI this month, which means it is about to become the least reliable one. Palantir published a white paper arguing that alpha comes from sovereignty over data, model weights, and compute, and the argument is right. Every vendor deck moving through procurement this quarter will contain the word sovereign, and most of them will be describing an API wrapper with a nicer logging page. That is what happens to words that close deals: they get borrowed faster than they can be verified. AI sovereignty needs a test a buyer can run without a lab, and the vendor's own slide is not that test. Here are the five questions I would put to any sovereignty claim, including ours. ## What Karp is right about The white paper, "Sovereignty Is Your Alpha," extends a manifesto Alex Karp has championed, and the strongest parts deserve a fair reading before anyone reaches for a knife. Tokenmaxxing is the paper's word for high-volume consumption of metered API tokens: activity that feels like progress while producing disposable scripts instead of durable systems. The meter runs, the demos multiply, and at the end of the year the enterprise owns nothing it could not buy again next year on the same terms as every competitor. The wealth-tax frame is harsher and more useful. Send proprietary data or customer-owned calibration evidence to an external lab and the lab receives context no competitor could independently assemble. Whatever made your underwriting or distribution record unusual leaves the customer boundary. You pay a fee for the privilege of being commoditized, and for a carrier the exposed asset is decades of governed history no rival could assemble from public data. The sharpest claim is about weights. Weights may encode patterns from governed measured outcomes, while human decisions remain context rather than truth compressed into a file. "Controlling your weights is controlling your fate," the manifesto argues, and the prescription follows directly: open-weight models deployed in strictly controlled environments. We have made the adjacent argument from the data side, that [the moat is the decision history that stays in your VPC](/blog/the-moat-is-the-data-that-never-leaves-your-vpc). ## The five questions None of the five require a benchmark. They are architecture and contract questions, answerable inside a standard security review, and each carries a passing answer and a tell. Five, because each closes a different door: compute, weights, data, interaction, accountability. A vendor with sovereign architecture answers in minutes, because the answers are facts about a system that exists. A vendor with a sovereign slide answers with adjectives. Ask all five in one sitting; the pattern across the answers is the finding. ### Where does inference run? The passing answer: inside your VPC, single-tenant, in an account your own team can inspect. The model comes to the data. The tell is the phrase "private endpoints." A private endpoint into a shared cloud means the road is private while the destination is still a building someone else operates, with other tenants on other floors. Single-tenant matters as much as the address; a dedicated namespace inside somebody else's multi-tenant control plane fails the same way. If the vendor's architecture diagram shows your data crossing an account boundary to reach the model, the sovereignty claim has already failed, whatever the arrow is labeled. Ask for the diagram, then ask who holds root on the account where the GPUs live. ### Who owns the weights, including at exit? The passing answer: you do. The model fine-tuned on your data is your property, named as such in the contract, and if the relationship ends the weights stay in your cloud while the vendor leaves with nothing you value. The tell: "your data is never used for training." That sentence answers a question nobody asked and stays silent on the one that matters, which is who keeps the fine-tuned model. A vendor can honor the training promise to the letter and still hold your weights hostage at renewal. Escrow is the half measure to watch for: a copy you may someday receive is a claim ticket; the model already running in your account is property. Ownership at exit is where the wealth tax Karp describes either exists or does not, so make the contract say the words. ### What leaves the perimeter, ever? The passing answer names the boundary precisely. Customer production records, outcomes, prompts, corrections, and Decision Traces do not leave for inference. If the architecture supports an outbound weight artifact, the contract should require two PII checks and explicit customer approval before same-industry pooling. The vendor should disclose operational telemetry separately and field by field. The tell: "only telemetry." Telemetry is a word that can hold anything from a heartbeat ping to your full prompt stream, and a vendor who leaves it undefined is counting on nobody asking. Request the telemetry schema, field by field, and watch how long it takes to arrive. If any field derives from your data, the perimeter has a door in it, and doors widen under commercial pressure. ### Who sees the prompts and corrections? The passing answer: nobody outside your boundary. The interaction layer is where customer decision context can leak. Every prompt an underwriter writes and every correction a reviewer makes preserves context the enterprise pays salaries to develop, and all of it stays inside. The tell: a pipeline that lets one customer's interactions or calibration artifacts inform products served to other customers. Prompts and corrections are decision context, not learning signal, but exposing them still gives the vendor a customer-owned record competitors cannot independently assemble. This is the version of the wealth tax that survives a data processing agreement, because the DPA may cover the corpus while leaving the evaluation and calibration path vague. Ask what crosses customer boundaries, where candidate evaluation runs, and who can read its inputs. ### What does the trace show for one decision? The passing answer: pick any single decision the system made and get back a queryable trace: what was read, from which system, why it was relevant, and what input a human gave before anything acted. Sovereignty without traceability is just hosting. A model can run entirely inside your walls and still be unaccountable to the people who own it. The tell: the demo pivots to aggregate dashboards. Adoption curves and usage heatmaps are what a vendor shows when no individual decision would survive inspection. Ask for one decision, chosen by your team rather than theirs, and insist on the full trail. The vendor who can produce it will be glad you asked. ## Diligence is where sovereignty is decided Most coverage will read the Palantir paper as an argument about national capacity. A buyer should read it as an argument about procurement, because the security review is the only room where a sovereignty claim meets people paid to disbelieve it. I have watched that gate work. At a Fortune 500 insurance carrier, six AI hiring vendors were rejected in eighteen months, every one on architecture, before evaluation ever reached the product. Architecture reviews fail on the same cosmetic answers everywhere: shared inference behind private endpoints, telemetry nobody will define, no trail for any decision. Model quality never came up, because nobody got that far. The same gate moves fast when the answers pass. With inference in the buyer's VPC and the weights on the buyer's title, there was zero customer production-data egress to negotiate. Legal approval took 17 days and the deployment went from contract to production in 34 days. Reviews run long when every answer opens a new thread to pull. When the answers close threads, the calendar collapses. The five questions cost nothing and eliminate most of the field, so they belong at the front of the process. Buyers tend to run the pilot first and the security review second, which spends the evaluation budget on vendors who were never going to clear architecture. Reverse it. An hour with the five questions before any proof of concept saves the pilot for vendors who can survive the review. One contract term changes the temperature of that room more than any other. Lead with ownership: the customer keeps the model even after the vendor is gone, so the strongest answer to the lock-in objection is that there is no lock. In diligence, that term reads as confidence. A reviewer can feel the difference between a right that was offered and a right that was extracted, and the vendor who volunteers the property title has nothing left to defend. The deeper argument about why the deployment address decides regulated deals is in [the VPC gap](/blog/vpc-gap-system-of-intelligence); the five questions are that argument folded into an instrument a buyer can carry. ## What passing looks like in production Since the five questions are also how Nodes expects to be tested, here is our exam sheet. Inference runs inside the customer's VPC, single-tenant. The customer owns its production model and weights. Production records, outcomes, prompts, corrections, and Decision Traces stay inside. A weight artifact may leave only after two PII checks and explicit customer approval for same-industry learning. The compliance file states SOC 2 Type I and Type II. In governed workflows, a trace records what the system read, where the evidence came from, what it proposed, and what a named human approved, edited, or declined. A separate historical study at one carrier covered four years and 10,765 agents; Nodes has been live there since January 2025. The logging methodology is published in [Decision Traces](https://arxiv.org/abs/2604.19819). Sovereignty reduces to two verifiable facts: a deployment address and a property title. Where does the model run, and who owns it when the relationship ends. Both can be checked in an afternoon of diligence by a buyer holding five questions and the patience to hear every answer all the way out. Karp gave the market the word this month, and the market will respond by printing it on everything. Most of those decks will fail the second question. The questions are how you keep the word honest. --- *Saad Bin Shafiq is the founder of Nodes, serving data-sensitive enterprises. Methodology: [Decision Traces](https://arxiv.org/abs/2604.19819).*