Sovereignty is not ownership,
but control over capability

1. The talk's place in the day

The event runs for three days, and the first day is devoted to owning your AI stack. The talk comes after two presentations: one was about an agent's duties toward a person, the second about personal memory and verifiable personhood. The third talk approaches from another side, namely from the side of ownership rights and the ability to dispose.

The point of the third angle is that the first two answer the questions "who is on whose side" and "what the agent thinks with". There remains a question that is usually considered settled and that in fact is not: what it means to own a system if it cannot be carried away, if its parts lie in someone else's data centers, and if the right to stay running depends on someone else's signature. The speaker calls this a conversation about control and builds the entire talk as a legal instruction manual for that conversation.

2. The definition from which everything else grows

The talk begins with an agreement about words, and this is the right move, because the term is overloaded. Three familiar readings are examined: where the system runs and where the data lies, who owns the models and the hardware, and, finally, who disposes. The first two, in the speaker's view, describe placement and ownership. The third describes control, and it is the one that becomes the working definition.

Next comes an industry formulation from which the definition is taken. Sovereignty is autonomy, that is, the authority to decide how, where, and by whom your intelligent systems are governed. Two important corrections follow from this. First: organizations are not in two states but on a scale of control, that is, sovereignty is a dial, not a fortress. Second: full self-sufficiency is impossible and economically absurd, so the goal is not independence from everyone but managed dependence.

The speaker takes the second support not from the engineering camp but from the state camp: sovereignty is operational control under load, not geography. The formulation is short and useful, because it shifts attention from the registration address of servers to the ability to act at the moment when something breaks or when a supplier changes the terms.

3. Why "owning everything" is not a strategy

The argument is built on external data. A national security research center maintains an index of state sovereign AI projects, and according to its latest data there are 184 projects across 67 countries, 41 of them added in the first half of 2026. The breakdown by layer is this: infrastructure 59 percent, models 32 percent, data 9 percent. Disclosed investments in tracked projects are estimated at $83.9 billion, with more than 80 percent concentrated in two regions, namely the Middle East and East Asia.

The practical conclusion the speaker draws: even states build sovereignty on someone else's hardware and someone else's models. In the recording two figures were cited in support, namely the share of projects on chips from a single manufacturer and the share of sovereign models built on a single open model. I could not confirm these two figures in the current version of the index, so in this analysis they are marked as unverified. The general thesis does not suffer from this, because it is confirmed by the very structure of the market: the concentration of compute and models in two countries is described in the index as the initial condition of the problem.

4. Three postures: renter, builder, controller

Next a simple typology is offered, and it is worth remembering, because it explains the choice that really faces a company.

The renter takes a black box via API. This is fast, cheap, and convenient, but the position is dependent: the supplier can change the model, the price, and the terms, and there is nowhere to go. The speaker calls this posture a convenient trap and notes that it is fine exactly as long as the workload has not become sensitive.

The builder tries to own as many layers as possible. This is an honest but unattainable position: as noted in the talk, no one mines their own copper or builds a turnkey data center without someone else's services. Autarky loses economically before it loses technically.

The controller is the proposed posture: accept dependence and engineer where it matters. Dependence in a FAQ bot can be tolerated, dependence in deal review or in access to sensitive materials cannot. It follows that the question "our stack or theirs" is posed incorrectly, and the right question sounds like "what level of control does this particular workload need".

5. A change of criterion: control depends on the workload, not the supplier

The most practical part of the talk, and it is worked out through three examples from one company with the same contractors.

Pilot with a chatbot. The bot answers frequent questions, calls the supplier's API, the model has not changed. Here it does not matter where it runs: swapping the contractor takes weeks, which means the dependence is tolerable. There are almost no control requirements.

Assistant in the deal room. It reads documents on mergers and acquisitions, that is, materials capable of moving the market. Here concrete questions appear: who reads the prompts, who holds the keys, who grants access and by what procedure, where and how long the history of requests is stored.

An agent that hands out access itself. It sorts participants into access levels, decides who to send to the clean room and who not, and distributes materials among recipients. Here it is the same contractor, the same model, and possibly the same data center, but the control requirements are fundamentally different: you need a delegation record, a delineated scope of authority, and a working revocation test.

The conclusion worth putting on its own line: one supplier can serve all three workloads, and this does not make them equally acceptable. The level of control is determined by the sensitivity of the operation, not by whom the access is bought from. This is the same principle that in the first two talks sounded like "the duty depends on whose side the agent works for".

6. Title versus control: what exactly lawyers distinguish

Now the legal part begins, and it holds the main thesis of the whole talk. Ownership, that is, title, is a claim to something. Control is a capability. These are different things, and confusing them is costly.

The capability breaks down into four actions, and these are then used as a verification matrix: to use the object, to prevent others from using it, to move it, and to prove that you are the one who disposes of it. The last, in its modern form, means confirmation with a cryptographic key.

To explain it, an everyday analogy is offered that the speaker uses throughout the talk: the coat check. You hand in your coat and get a ticket. The coat is not in your hands, but you are the one who disposes of it. Control without ownership and ownership without the ability to dispose are two different states, and commercial law figured out how to distinguish them long before computing power existed.

7. The sheep case of 1601: why continued use counts as control

Next the speaker goes back four centuries, and this is not decoration but a foundation. An English case is examined in which a debtor, the owner of sheep and other property, owed one creditor £400 and another £200. He secretly transferred the property to the first creditor, but kept the sheep himself, continued to use them, and behaved as their master.

The Court of Star Chamber found this transfer fraudulent. The logic of the ruling is precisely the logic of control: the title was rewritten on paper, but the sheep remained in the field, which means the debtor still disposed of them, and the other creditors have the right to reach this property, that is, to enter the bankruptcy estate. Title is a claim, sheep in the field is control.

The parallel with today is drawn directly and it is exact. If a supplier keeps the right to use your data, to read your logs, or to continue processing what you handed over, then formally you may be the owner of the record while he is the one who disposes of it. This is the same ticket, only instead of a coat on the hanger there is a workload, and instead of sheep in the field there lie the data and the history of requests. Continued use is precisely the modern sign that control has stayed on the other side.

8. Evolution: from sheep to records, and the same question at every step

Next comes a short history of commercial law, and it is useful as a frame, because every step arose from the same failure.

Possession. The first era: control was taken to be physical holding. As long as the thing is with you, you dispose of it. The problem began when trade grew beyond a single yard.

Paper. Documents of title appeared, and control moved to the level of the document. A problem arose that today would be called a paper jam.

Intermediaries. In the late sixties, exchange settlement was drowning in paper: the volume of unprocessed trades was measured in billions, and starting June 12, 1968, the exchange stopped trading on Wednesdays to clear the backlog. Out of this grew the system of intermediaries, in which the clearing organization became the single source of truth about who owns what. In the recording the speaker dates the crisis to the period from 1968 to 1973; according to the documents the backlog spans 1967 to 1970.

Electronic records. Then came laws that recognized the force of electronic documents and signatures, and the document ceased to require a paper medium.

Digital assets and distributed ledgers. The last step: entries in distributed ledgers began to be recognized as carriers of value, and commercial law was updated to describe what it means to control such a record.

At every step the law asks the same question: when an object cannot be taken in hand, what does it mean to dispose of it. It is precisely this question the speaker transfers to AI, and the transfer is honest: he states plainly that the rules about records do not govern models.

9. The failure with keys: what loss of control looks like

An example the speaker examines as illustrative, and it is familiar to anyone who has worked with crypto assets. A large crypto platform offered a yield program, and clients believed that the funds in their accounts belonged to them. After the bankruptcy it emerged that the platform disposed of the keys and the accounts were part of the bankruptcy estate. The clients ended up in the queue of creditors, that is, at the end, not the beginning.

The formula the industry drew from this is short: not your keys, not your coins. In the terms of this talk: there was a legal expectation but no capability to dispose. It is precisely this gap that he proposes to close in advance, not at the moment a supplier changes the terms or disappears.

10. Control as demonstrable powers: four tests

The climax of the legal part: a statute has been added to commercial law describing control over controllable electronic records. The speaker states plainly that this is law about records, not about models, and that he himself applies it as a working frame, not as a norm. The caveat matters, and it makes the analysis correct.

The essence reduces to four tests that can be applied to any asset, including compute, keys, and agent authority.

The value of this table is that it turns the conversation about sovereignty from a declaration into a verifiable checklist. If even one of the four tests fails, you do not dispose of the system, even if it stands in your rack.

11. The fifth freedom: the right to keep running

Next the speaker compares his frame with the Open Source AI Definition adopted at the end of 2024. It contains four familiar freedoms: to use without permission, to study the design and take it apart, to modify for any task, to distribute without changes.

To these a fifth is proposed, and it sounds like the right to keep running. The argument: you can copy the weights, but if you have nowhere to run them, the freedom remains a declaration. Captivity is determined not by the license but by a dependence that can neither be checked nor broken.

This is the strongest idea in the talk from an engineer's point of view, because it shows where the license ends and availability begins. Open weights settle the question of whether the model can be taken. Compute settles the question of whether it can be kept in the fight.

12. The physical layer: why everything comes down to a single point

After the legal part the talk turns to hardware, and the transition is logical. If control is a capability, then a capability has a physical limit. The speaker calls it the most expensive stretch of the whole construction: data centers, power, grid interconnection, the electrons themselves that today set computation in motion.

What follows is a description of an asymmetry that explains a great deal. On the software side everything looks boundless: open weights, rentable instances, the ability to spin up almost anything. On the execution side everything also looks dynamic: agents that generate new tasks and new loads. But both pass through a single bottleneck, and that bottleneck expands slowly and expensively. Bringing new capacity online is measured in years, not days.

13. The meter as a model of control

The most successful illustration in the talk, and it is worth unpacking, because it shows what a working control is made of. Take an electricity meter. Millions are calculated from its readings every few minutes, and no one demands a re-check, because trust in the reading is not built on a verbal assurance. Trust is built on three things: a verified instrument, a public standard, and a legal remedy.

This model is then carried over to the compute layer, and the speaker describes a ladder of three rungs. The first: trusting someone's word. The second: obtaining confirmation, that is, attestation, which shows that the system really is as claimed and operates within set bounds. The third: moving to policies that enforce themselves, that is, that block an action exceeding the permitted parameters with no human in the moment.

The practical meaning of this ladder is that control stops being a promise and becomes a mechanism. As long as it rests on a word, it is checked only once something has already happened. When it rests on an executable policy, it works before the event, not after it.

14. The agent-to-megawatt matrix

What follows is the talk's main working tool, and it is also the most convenient for practical use. Four incidents of authority, taken from the legal framework, are laid out across the layers of the stack, from the agent to the power facility, plus a separate layer of contracts that tie it all together.

The speaker explicitly notes that this is his personal extension: the legal framework describes commercial assets, and here it is applied to compute capacity and contracts. That is precisely why it is useful as a way of checking, and not as a norm.

A further point is emphasized on how to use this in practice: take the questions from the table and bring answers to them. The most useful example of a question cited in the talk sounds like this: can we revoke its authority right now. Such a question requires no legal training, but immediately shows where control is nominal and where it is real.

15. The agent layer: limits, the delegation record, the revocation test

The agent layer is examined in detail, and here concrete engineering formulations appear. The first example: a support bot that is permitted to issue refunds, but not above a certain amount per transaction. The speaker insists that the limit must be enforced at the level of the mechanism, not formulated in the prompt. The difference is fundamental: a restriction in the instruction is a request, a restriction in the refund pool is a property of the system.

The second example: an agent operating in a deal room together with a counterparty. Here three mandatory elements are named: the delegation record, a defined scope of authority, and a working revocation test. The idea is that access to sensitive materials cannot be granted by word and cannot be taken back retroactively. Authority must be granted in a documented way, limited in scope, and revocable at any moment.

For practice this is the most applicable part of the whole talk, because it translates into three questions for any agentic system: where is it recorded who permitted what exactly; what bounds the scope; how to check that revocation really works.

16. Subsurface: leasing the surface versus rights to the contents

The second image the speaker uses to explain the difference between regimes. In real property one can own the surface of a plot, while the rights to the subsurface belong to another, who is entitled to install a drilling rig and extract what lies beneath the ground.

Carried over to compute it looks like this: renting capacity is leasing the surface, and the subsurface is the weights, the prompts, and the results of the work. One can lease the surface and at the same time retain the rights to the contents, that is, to one's own data, one's own context, and one's own results. With the same model, two entirely different arrangements are possible: in renter mode the vendor sets the terms, establishes the procedure, and holds the keys; in controller mode all of this is arranged differently.

The speaker emphasizes that open weights make the second column, that is, the possibility of movement, real rather than theoretical. As long as the weights are closed, the question of transfer does not even arise. When the weights are open, transfer becomes technically possible, and only the question of the contract and of capacity remains.

17. The economics of movement: why open models are cheaper and why they are not adopted

The key economic part of the talk, and the figures here are the most useful of the whole presentation. A study by the Massachusetts Institute of Technology and the Georgia Institute of Technology is cited, based on observation of the real traffic of an inference platform.

The results are as follows. Open models at the moment of release reach about 90 percent of the quality of closed ones and quickly narrow the gap. The cost of a run differs sharply: $1.86 per million tokens for closed versus 23 cents for open, that is, cheaper by roughly 87 percent. At the same time closed models capture about 80 percent of tokens and almost 96 percent of revenue, that is, the market pays for something that does not deliver a proportional gain. Redistributing demand from closed to open would save the industry about $25 billion a year.

The question the speaker asks next is logical: if the price difference is so large, why does no one switch. The answer is simple and engineering-based: switching is expensive. Moving the load to another model requires work, quality checks on one's own tasks, retraining of prompts, sometimes rebuilding the whole pipeline. So the question is not whether the open model is better, but what prevents it from being adopted. This is exactly where the link to law appears: if portability is secured by documents and formats, the cost of switching falls, and the economics of movement become real.

18. The bottom layer: identical megawatts, different rights

The last layer the speaker examines is the physical infrastructure, and here he draws the most vivid conclusion of the whole talk. One can take two facilities with identical capacity, identical accelerators, and identical throughput, and at the same time they will have a completely different level of sovereignty. The difference lies not in the hardware but in the document.

A concrete example: power comes as interruptible, when the vendor is entitled to withdraw the load during peak demand, or as firm, when the limits are assessed and fixed in advance, and therefore the uptime is known with high accuracy. It is firm power that large operators rely on, and it is exactly what costs more.

From this follows a practical conclusion that in the talk sounds almost like a definition: the level of control is determined by the vectors written into the contract, not by those visible in the rack. Two identical sites differ not in capacity but in the terms of its selection.

19. How to talk to a lawyer: a set of questions instead of a dispute about principles

A separate part of the talk is devoted to how an engineer and a product team can obtain the sign-off of the legal department. The advice is simple in form: bring answers, not opinions. The speaker formulates a set of questions by which a project is checked for its level of control.

• What exactly must remain our decision, and what can be delegated outward.
• Through what mechanism this decision is implemented and who takes part in it.
• Who receives the evidence of agent activity, who extends it, and who checks it.
• How revocation is arranged: what happens to already granted authority and to retained data.
• What information about the operation of the system is available to us after the vendor has changed the terms.

The point of this list is that it translates the conversation about sovereignty into a plane where an answer can be given and where the answer can be checked. The talk states directly that the tool was created after many years of work on this side of the table, that is, by a person who earlier answered such requests himself and therefore knows what is wanted from him.

20. The talk's conclusion and what was left off screen

The conclusion is formulated in one line: sovereignty is not a status that is declared, but a state of the machine that is managed, whereas control is a capability, not an entry in a register. The practical part of the talk was not shown: the demonstration on the deal room did not fit into the time, and the speaker offered to be contacted directly. The control framework has been posted for discussion, that is, at the time of the presentation it is open for comments.

For practical use this means that the material is in the state of a working draft, and this is worth bearing in mind: the construction is useful as a checklist, but it is not yet either a standard or a norm.

21. What is not proven here

22. Three risks that are not in the talk

The first: control over the physical layer does not solve the problem of a change of owner. If your workloads live in someone else's circuit, a change of owner or of site policy changes your terms regardless of how well the contract is drafted. The only remedy is the existence of a real relocation plan, and it costs money and time.

The second: the matrix of authority does not provide a metric. All four tests can be passed formally while in fact possessing none. The talk does not offer a way to measure the level of control as a number, so two different specialists can assess one situation differently. Without a metric the framework remains a language for conversation, not a tool for measurement.

The third: openness of weights and openness of capacity are different markets. Even if the weights are open and portability is secured, access to compute capacity remains a constrained resource, and therefore a free choice of vendor exists only where that resource is available. In the talk this gap is named but not resolved.

23. Numbers and facts on a single screen

24. Glossary of the talk

25. Twenty questions for self-check

• Why is sovereignty a scale and not a fortress?
• How does operational control under load differ from geographic placement?
• Why is the builder's position unattainable, and what does this say about strategy?
• What is the difference between a renter and a controller under the same vendor?
• Why do three workloads of one company require different levels of control?
• How does title differ from control?
• What does the wardrobe analogy prove?
• Why did the fact of continuing use become decisive in the 1601 case?
• How does this sign carry over to a modern model vendor?
• What do the paper jam of the sixties and today's conversation about agents have in common?
• Why is the example of the failed crypto platform considered telling?
• List the four tests of control.
• Which questions from the matrix should be asked about the agent layer?
• Why should the limit live in the mechanism and not in the prompt?
• What should the delegation record contain?
• What is the point of the analogy with the surface of a plot and the subsurface?
• Why are open models cheaper, and what prevents the transition?
• How does interruptible power differ from firm power, and why is this a question of sovereignty?
• What does the freedom to keep running, which is absent from the definition of open AI, mean?
• Name the three risks that were not mentioned in the talk.

26. Where to check the primary sources

• Event: Open Source x Sovereign AI, part of SF Tech Week, the first day devoted to owning the stack, program curated by Tricia Wang and Advanced AI Society. Irina Marinescu's talk is titled Getting to Yes with Security, Legal, and Compliance: Sovereignty as a Control Issue.
• Industry formulations on sovereignty and the four pillars: Red Hat materials on sovereign AI.
• Survey: Linux Foundation Research report on the state of sovereign AI, published in October 2025, 233 respondents.
• Index of government projects: Sovereign AI Index of the national security research center, version 2.0, data as of June 30, 2026, 184 projects in 67 countries.
• The 1601 fraudulent conveyance case is examined under the name Twyne's Case, a decision of the Star Chamber.
• Law: Article 12 of the Uniform Commercial Code on controllable electronic records, the section on control. The text of the article is reproduced in open databases of state legislation.
• Economics: the study by Frank Nagle and Daniel Yue on moving the load from closed models to open ones, published in a preprint database, with an exposition on the MIT Sloan website.
• Open AI definition: Open Source AI Definition version 1.0, October 2024, four freedoms.

The analysis is made from the transcript of the talk. Names, titles, and figures distorted by automatic transcription have been restored from primary sources and marked with a verification status. Two figures from the talk, namely the share of projects on chips from a single manufacturer and the share of sovereign models on one open model, could not be confirmed in the current version of the index. The period of narrowing of the gap between open and closed models was checked only against the exposition of the study.