Deploy agents where their data is allowed to exist, not where inference is cheapest

I deploy agents where their data is allowed to exist, not where inference happens to be cheapest. The routing order matters: first resolve the tenant’s residency and sovereignty constraints, then choose among the compliant regions for latency, capacity, and price. Reversing that order turns governance into an exception path, and exception paths eventually become data transfers nobody intended.

Residency and sovereignty are not interchangeable labels. Residency asks where conversation history, documents, tool results, checkpoints, and outputs are stored and processed. Sovereignty asks which jurisdiction can compel access to them. An EU data centre can satisfy the first while its operator’s foreign legal obligations complicate the second. I therefore treat geography as a runtime constraint and jurisdiction as an organizational and contractual constraint; both must be evaluated before a task receives an execution target.

The cleanest enforcement pattern is regional queue isolation. An EU-scoped task enters an EU queue, is claimed only by EU workers, calls a geo-locked EU inference endpoint, writes to EU-local state stores, and emits logs to an EU ingestion endpoint. VPC egress rules and service-mesh policy deny non-permitted destinations, so an agent cannot route around the rule because another model endpoint is faster or discounted. Failover remains inside the permitted zone; if no compliant region is healthy, the honest outcome is degraded service, not silent export.

Remote agents make this harder because the sensitive object is not merely the prompt. A long-running session accumulates tool outputs, working files, credentials, messages, and checkpoints; reconnect and resume mechanisms can move that state independently of the compute process. I bind the session to a residency zone and make every rehydration target prove compatibility before restoring it. Moving a container is operational scheduling. Moving its durable session is a governed data transfer.

That binding has to survive delegation. A parent agent cannot receive EU-scoped data, call a sub-agent in a cheaper region, and claim that only an intermediate computation crossed the boundary. Governance metadata must propagate with the task, and provenance must record each activity, artifact, agent, authorization context, and processing location as the workflow runs. A shared correlation identifier across organizations makes the chain queryable; signed records make it attributable. Without location-bearing provenance, residency is a configuration claim rather than evidence.

Regional isolation does not remove distributed-systems trade-offs; it makes them explicit. Global task deduplication can require a strongly consistent idempotency check so a retry routed elsewhere does not execute twice, yet a global dedupe store must not become a covert replication path for payloads or personal identifiers. Quotas have a similar tension: eventual regional counters admit brief overspend, while central arbitration adds latency and a failure dependency. I separate minimal coordination metadata from governed content, then choose strong dedupe and regional quota budgets with reconciliation where policy permits.

My bounded concession is that cheapest-region routing is reasonable for stateless, non-sensitive workloads whose inputs, outputs, logs, and provider terms have been explicitly classified as unconstrained. Inside that boundary, price and latency should drive placement. The concession ends as soon as a session persists customer material, a tool result introduces regulated data, or sovereignty rules restrict the operator: the task must be reclassified or denied, not allowed to inherit yesterday’s cheap route.

This is why I want residency policy expressed as executable admission and egress rules, not deployment documentation. The platform should reject an invalid route before inference, preserve the decision in provenance, and keep state, queues, logs, and recovery within the same allowed envelope. Cheap inference is a useful optimization inside that envelope. It is not a principle for deciding where an agent—and all the state that makes it an agent—may exist.