Sovereign compute is necessary and not sufficient. What an autonomous workforce still has to answer once the data centre is certified — where each number came from, which rule applied, who signed, and how much autonomy that decision has earned.
Arup Maity, Founder and CEO, Xamun Technologies. The governed workforce — the seventh paper in the series, following Paper No. 6, You bought the outcome. You paid for the effort. The full argument is on this page; the PDF is the formatted paper.
The UAE’s infrastructure operators have made the case for sovereign compute, and made it well: an agentic economy cannot run on foreign data centres, uncertified clouds, or fragmented local hardware. This paper begins where that argument stops. A certified data centre answers one question — where did the work run? It does not answer the four an auditor, a regulator, or a board will ask next: where did this number come from, which rule applied and on what date, who decided and why, and how much autonomy did this decision earn. Answering them takes a roster of agents each serving one named role on a schedule; a fixed order of two minds in which code computes and decides and a language model only drafts; rules cited to their instrument as of the date of the event; a single place where a person is interrupted; autonomy earned per decision and capped for irreversible work; and a ledger in which hours returned are measured against a declared baseline rather than claimed. Model choice — open-weight on sovereign hardware or frontier behind a residency boundary — turns out to be a consequence of this architecture rather than a feature of it.
When the model never holds a number and never makes a decision, it becomes the one component that can be swapped without touching the record.
In September 2026 du Tech published a white paper on what it calls the sovereign agentic infrastructure: a 1GW, liquid-cooled AI park; Oracle Cloud run in-country under a sovereign-operator model; high-density compute nodes; a national hypercloud certified by the UAE Cyber Security Council; and a hybrid framework that routes lighter agent workloads to public edge nodes and anchors regulated processing on private infrastructure. It followed a June memorandum with an orchestration partner, signed in the presence of the Council’s head, to run sovereign GPU orchestration on that hypercloud. Earlier in the year the Government of Dubai set a direction for private-sector adoption of agentic AI, and the federal target of half of government services delivered through AI agents by 2028 stands behind both.
This paper takes that infrastructure argument as correct. A workforce of agents that reasons over confidential records, transacts on behalf of an institution, and runs continuously cannot depend on compute that sits outside the jurisdiction, on a cloud the national security authority has not examined, or on hardware that a supply shock can take away. Papers earlier in this series argued that the value in enterprise AI concentrates at the point where the workflow itself is rebuilt around governed intelligence; that rebuild needs a floor to stand on, and the floor is now being poured. Sovereign compute is a national good, and the operators building it are doing the country a service.
It is also, on its own, an answer to a question nobody in a bank, a hospital, or a ministry will be asked. When a regulator opens the file, the question is not where did this run? It is where did this number come from, under which rule, and who decided? Those questions belong to a different layer. The infrastructure paper defines its subject clearly — the compute spine — and leaves that layer open. This paper is about that layer.
A certificate on the building says where the work ran. It says nothing about what was decided, under which rule, or by whom.
The word sovereign is doing three different jobs in the current conversation, and the three are routinely collapsed into one. It helps to separate them.
| Sovereignty | The question it answers | What supplies it |
|---|---|---|
| Infrastructure | Where does the work run, and who can reach it? | In-country data centres, certified clouds, national networks |
| Model | Whose weights read the organisation’s data, and where do they execute? | Open-weight models on sovereign hardware; frontier models behind a residency boundary |
| Decision | Where did this number come from, which rule applied on that date, who signed, and how much autonomy has this decision earned? | The architecture of the agent itself: what computes, what drafts, what records, and who is interrupted |
Figure 1 — Three sovereignties. A data centre supplies the first; the third cannot be delegated to the host.
The first is the subject of the infrastructure operators, and they are right that it comes first. The second is a live question for every regulated buyer and is addressed in §9. The third is the one this series has been circling since its first paper, and it is the one an autonomous workforce cannot delegate to its host.
Consider the definition of an agent the infrastructure paper offers: instead of executing pre-programmed code, an autonomous agent uses a deep reasoning model to break down abstract goals, optimise its own tasks, and collaborate with other agents. That is a fair description of what most agent frameworks now do. It is also a precise description of the model being the decision-maker. If the model decomposes the goal, chooses the steps, and executes them, then the model produced the number in the report, the model chose which rule to apply, and the model decided the case was ready. Certify the data centre as heavily as you like; the provenance of that decision is still a language model’s output, and trust me is still not a control.
The use cases the infrastructure paper describes make the point sharper, because they are the right use cases. Municipal payments processed by agents. Visa allocations and corporate licences completed within minutes. Compliance certifications issued without a person in the loop. These are exactly the routine, high-volume, rule-heavy tasks where a governed workforce returns the most hours. They are also customer-facing, regulator-facing, and in several cases irreversible. Whether an agent may do them at all is not the question. The question is how fast it earns the right to do them unattended, and what evidence that right rests on. That is decision sovereignty, and it is the subject of the rest of this paper.
The first architectural choice is the one most vendors get wrong by default, because it is the one the tooling makes easiest: the chat box. A chat assistant presents a blank field, waits for a request, and answers it. It is a general-purpose surface, which is exactly why nobody can say in advance what it will be asked to do or what it will produce. A general-purpose surface cannot be governed, only monitored after the fact.
A governed workforce has no box to type into, by design. It is a roster. Each agent serves one named role — sales analyst, business analyst, compliance analyst, vendor manager — and does one task for that role: the daily sales pack, the weekly management pack, the KYC readiness check, the vendor SLA reconciliation. Each runs on a schedule or when a record arrives, through the same gate, and each run produces a row. The organisation decides what the agent does when it is configured, not when it is prompted.
This sounds like a limitation and is the opposite. It is what makes the other properties in this paper possible. Because the task is fixed, the calculation can be written in code and tested. Because the role is named, the person who signs the output is known before the run starts. Because the trigger is a schedule or an event, nobody can ask the agent to do something outside its remit, and there is no free-text instruction to audit. And because every run is a row, the question what did this agent do last Tuesday? has a single, complete answer.
A chat assistant produces none of this. An RPA script produces the first two and hard-codes the third. The row is the unit of decision sovereignty; everything else in this paper is a rule about what may write to it.
Paper One and Paper Two in this series introduced the architecture this series calls two minds: a deterministic mind that computes and decides, and a language model that drafts, over one shared memory. This paper describes how that order is enforced inside a workforce, because enforced is the operative word. The order is not a prompt instruction. It is a property of the code and of the tests that gate the build.
Code loads the data. Code computes every figure the output will contain — the gross, the mix, the variance against the trailing mean, the overrun against the contract clause. Code resolves which rules are in force on the date being judged. And code decides whether the run may proceed at all: if a blocking rule fires, the run stops at the gate and the model is never called. A KYC case with a screening hit does not get a beautifully drafted readiness memo. It gets a row that says which rule blocked, and a fork for a compliance reviewer.
When the run does proceed to a draft, the language model is shown the names of the figures, never their values. It writes prose around placeholders. Every number in the final output is substituted from the calculation record; a figure the model invents, or a placeholder it fails to use, fails the run. The model cannot round, cannot estimate, cannot adjust, because it never had the number to begin with. This is the mechanical answer to the hallucination problem that Paper One reframed: hallucination is a feature of a language model, and it is never allowed in the ledger because the ledger is never in the model’s hands.
The third rule is the one buyers find hardest to believe and vendors find hardest to keep. No free-text input from a person — not a question, not a note, not the reason a reviewer gave at a fork — is ever passed to a language model. The reason is recorded for the audit and stops there. This closes the injection surface that every chat-shaped product leaves open, and it is enforced by a guard test that fails the build if any code path passes a person’s text to a model. The property is not promised; it is tested.
Before anyone sees a draft, a set of deterministic validators checks it: that every placeholder was substituted; that mandatory disclosures are present; that no personal data appears where it should not; that a bilingual output is at parity across languages; that the wording obeys the rules in force for that document type. A validator failure opens a fork. It does not reach an inbox.
The model is shown the names of the figures, never their values. A number it invents fails the run. That is not a prompt. It is a test.
A rule that lives in a script is a rule nobody can inspect. When a compliance reviewer asks why did this block?, the answer must name the instrument, the article, and the version of the rule pack that was in force, and it must say whether the rule was resolved from a live regulatory memory or from an offline copy. A governed agent hard-codes nothing. It asks a regulatory knowledge base which obligations apply to a record of this type, in this jurisdiction, on this date, and it writes the answer — with citations — into the row.
The phrase on this date matters more than it looks. Regulation changes. A case submitted in June is judged by June’s instrument even if the run happens in September, and the row says so. A workforce that applies today’s rule to last quarter’s record produces a decision that is wrong on its face and indefensible in front of a regulator. As-of resolution is a property of the knowledge base, not a feature the agent can be told to remember.
Not every rule in a regulatory memory is settled. Some entries are curated obligations, tied to a published instrument and reviewed by a person; some are placeholders awaiting curation, marked as such. The distinction is visible on every screen and enforced in the gate: a curated obligation may block a run; a placeholder may only warn. A workforce that lets an unreviewed rule stop a payment, or lets a reviewed one merely warn, has confused its own confidence with the law’s.
The regulatory memory receives amounts, flags, and risk tiers. It never receives names, identifiers, or nationality. The rule is resolved against the shape of the record, not its subject. This is one of the few places where infrastructure sovereignty and decision sovereignty touch directly: the knowledge base can sit anywhere the organisation’s residency policy allows, because nothing that identifies a customer ever crosses to it.
The infrastructure paper describes agents that complete transactions without human intervention, and treats that as the goal. This series has argued since Paper Two that the goal is subtler: a person should be interrupted at judgement forks and nowhere else. Too many interruptions and the workforce has returned no hours. Too few and the organisation has delegated its judgement to a model. The fork is the design that holds the line.
A fork opens in four circumstances only: a rule blocks; a required fact is missing; a draft fails a validator; or a decision is held for sign-off because its autonomy stage requires it. A fork never asks a question. It names the thing — the rule’s own sentence, the record it concerns, the citation beneath — and it offers a choice. Two forks from one agent are never the same card twice, because each is bound to its own record and rule.
Who may close a fork is not a matter of who is available. A fork raised by a statutory, regulatory, or Sharia obligation belongs to a compliance reviewer, whoever the pack was addressed to. Everything else is signed by the role its decision names. The server refuses any other signatory. This is the point at which the organisation chart becomes a control: the person who signs is the person whose role the rule names, and the row records that it was so.
At a fork, a person chooses, gives a reason, and the choice is recorded. Nothing is preselected, so silence is not consent. Nothing is undone, so a decision is not a draft. Approving a pack sends it. The reason is kept for the audit and, as §4 said, never reaches a model. The result is a decision trail in which every human judgement has a name, a role, a timestamp, a reason, and the rule it concerned — the record a regulator asks for, existing before the regulator asks.
Too many interruptions and the workforce has returned no hours. Too few and the organisation has delegated its judgement to a model. The fork holds the line.
The phrase autonomous workforce implies a binary: a task is either done by a person or done by an agent. That binary is where most agentic deployments fail, because it forces the organisation to choose between trusting a vendor’s promise and getting nothing. Autonomy should be a dial, and the dial should be per decision, not per agent, not per system.
| Stage | What happens | What the person does |
|---|---|---|
| Suggest | The system computes, applies the rules, drafts — and proposes. | Acts on the proposal, or not. The human process continues as before. |
| Approve | The system does the work and holds the result. | Signs it. Approving releases it. |
| Autonomous | The system does the work and releases it. | Audits a sample. Marks what was right and wrong. |
Figure 2 — The autonomy dial. Set per decision, never per agent or per system.
Three rules govern the dial.
The consequence is that autonomy in a governed workforce is always a statement of fact about the past, not a promise about the future. The board can ask which decisions run unattended, and on what evidence? and receive a list, with the runs and the approvals and the reader feedback behind each entry. That is a different thing from a vendor’s assurance of absolute trust, and it is the only version of trust an auditor will accept.
The loudest claim any workforce product makes is the hours it saves, so the ledger has to be built to survive the question that follows the claim. Most vendors report a figure computed from an assumption — an average task time, a benchmark, an estimate supplied by the vendor. The figure is unfalsifiable and the board knows it.
A measured ledger works differently. It begins with a baseline: a declaration, by a named person, of how long the human process took, with a stated basis — a time study, a manager’s estimate, the organisation’s own timestamps. Every line of the ledger shows who declared the baseline, when, and on what. Then:
This is the same discipline Paper Three applied to delivery timelines and Paper Six applied to outcome-based pricing: the number has to be one the buyer could have computed themselves, from evidence they hold. A ledger of this kind does not make the workforce look better. It makes the workforce look true, which is the only property a board can act on.
An agent that costs more to review than it saves is exactly what a pilot exists to find. A ledger that cannot go negative cannot be trusted when it is positive.
The infrastructure paper’s mandate to enterprise leaders includes an instruction that deserves to be taken seriously: do not run critical business workflows on black-box, off-shore models. The question is what follows from it, and the answer depends entirely on where the model sits in the architecture.
If the model is the decision-maker — decomposing goals, choosing steps, producing the numbers — then model choice is the most consequential decision in the deployment, and it is also a trap. An open-weight model on sovereign hardware satisfies the residency requirement and may lag a frontier model on reasoning; a frontier model behind a residency boundary offers the capability and imports a dependency. Either way the organisation has bet its decision quality on a vendor’s weights, and cannot change the bet without changing every decision the workforce has made.
If the model only drafts, the question dissolves. Because the model never holds a value and never makes a decision, it is the one component in the architecture that can be replaced without touching the calculation, the rule resolution, the gate, the fork, or the ledger. An agent whose outputs are regulator-facing can run on an open-weight model inside the certified hypercloud, where nothing sensitive would be at risk even if the draft were poor, because the draft is validated before anyone reads it. An agent whose prose demands more can run on a frontier model through a residency-compliant boundary, and the same validators apply. The two can coexist in one roster. Either can be swapped per agent, and the row records which was used.
This is what it means to say that model sovereignty is a consequence of decision sovereignty. An organisation that has put the decision in code and the draft in the model has made the choice of model reversible — which is the only kind of choice a regulated institution should make about a technology that changes every quarter. The infrastructure operators are right that the model should be local where it can be. The architecture is what makes where it can be a question the organisation can answer differently for every agent, and change its mind about without cost.
Paper Four argued that an AI strategy for a mid-sized company is a ranked list of operations, not a list of tools, and that the strategy should be revisited quarterly against evidence. A governed workforce is where that evidence comes from. Because every run is a row, the workforce reports upward in a form a strategy layer can read — not summaries, not claims, but the entries themselves.
| What the strategy layer asks | What the workforce reports |
|---|---|
| Where are hours actually being returned, by role? | The ledger’s entries, each with its baseline and the provenance of that baseline. |
| Which decisions run unattended, and on what evidence? | The autonomy stage of every decision, and the runs, approvals, and reader feedback behind each promotion. |
| What is our compliance posture on the routine work? | Every rule evaluation with its instrument and citation — what blocked, what warned, what is still a placeholder awaiting curation. |
| Where is human judgement still required, and why? | The fork record: how often a person was needed, in which role, for which rule or missing fact. |
Figure 3 — What a governed workforce reports to the strategy layer: the entries themselves, not summaries.
One property makes this reporting trustworthy rather than merely available: the strategy layer and the workforce reason from the same regulatory memory. The law the strategy reasons about is the law each agent applied, on the date it applied it. A strategy built on a different reading of the rules than the operations that execute it is the ordinary condition of most organisations, and a shared substrate is the only thing that removes it.
This is also the answer to the question the infrastructure paper’s readers raised most often in response: how does sovereign compute reach the small and mid-sized businesses that make up most of the economy? Not by giving them GPUs. By giving them a roster of agents that does the routine work of named roles, reports in rows, and returns hours they can count — running on whatever sovereign compute the operators provide.
The series has ended each paper with something a buyer can use. These six questions apply to any product that calls itself an agentic or autonomous workforce, including the one this paper describes. A vendor who cannot answer them in a live system, from the record, is selling infrastructure or selling trust; neither is a workforce.
None of these questions concerns the data centre. All of them will be asked by the same regulator who was reassured by the certificate on the building. The infrastructure operators have answered the question of where the work runs, and the country is better for it. The question of what was decided, under which rule, by whom, and on what evidence is the one the organisation cannot outsource — and the one a governed workforce is built to answer, one row at a time.
The infrastructure operators have answered the question of where the work runs. What was decided, under which rule, by whom, and on what evidence is the one the organisation cannot outsource — and the one a governed workforce answers, one row at a time.
Questions a buyer should ask
No. A certified data centre answers one question — where did the work run? It does not answer the four an auditor, a regulator or a board will ask next: where did this number come from, which rule applied and on what date, who decided and why, and how much autonomy did this decision earn. Those are questions about the decision, not the infrastructure, and no certificate on the building settles them. Sovereign compute is necessary and not sufficient.
Infrastructure sovereignty answers where the work runs and who can reach it, and is supplied by in-country data centres, certified clouds and national networks. Model sovereignty answers whose weights read the organisation’s data and where they execute — open-weight models on sovereign hardware, or frontier models behind a residency boundary. Decision sovereignty answers where a number came from, which rule applied on that date, who signed, and how much autonomy the decision has earned. Only the architecture of the agent itself supplies it: what computes, what drafts, what records, and who is interrupted.
Six, answered in a live system from the record. Show me a number in last week’s output — where did it come from? Which rule applied to this decision, and which instrument is it from? Who decided, and can I read their reason? How much autonomy does this decision have, and what did it earn it? How many hours has it returned, and against whose baseline? Can a person type a request into it? A vendor who cannot answer them is selling infrastructure or selling trust; neither is a workforce.
From a calculation on a run record, substituted into the draft — never from the model. In a governed workforce code loads the data, computes every figure, resolves which rules are in force on the date being judged, and decides whether the run may proceed. The language model is shown the names of the figures, never their values, and writes prose around placeholders. A figure the model invents, or a placeholder it fails to use, fails the run.
Irreversible and outward-facing ones. Anything sent to a customer or a regulator is approved by a person every time and cannot be promoted to autonomous; the server refuses the promotion. Autonomy is a dial set per decision — suggest, approve, autonomous — and the stage governs release, never the gate: a blocking rule stops a run at every stage. Promotion needs a record of clean runs, and a single reader marking the output wrong holds it until answered.
Against a baseline declared by a named person, with a stated basis — a time study, a manager’s estimate, the organisation’s own timestamps. No baseline, no number: an unpriced decision reads not measured, never zero. A run stopped at the gate returns nothing. A run a person had to sign returns the baseline minus the review time, and the result can be negative. Baselines are kept as they stood, and there is no trend line until there is a month of data. A ledger that cannot go negative cannot be trusted when it is positive.
If the model only drafts, either — and the choice is reversible. When the model never holds a value and never makes a decision, it is the one component that can be replaced without touching the calculation, the rule resolution, the gate, the fork or the ledger. A regulator-facing agent can run on an open-weight model inside a certified hypercloud; an agent whose prose demands more can run on a frontier model through a residency-compliant boundary, with the same validators. Both can coexist in one roster, and the run record says which was used. Model sovereignty is a consequence of decision sovereignty.
At judgement forks and nowhere else. A fork opens in four circumstances only: a rule blocks; a required fact is missing; a draft fails a validator; or a decision is held for sign-off because its autonomy stage requires it. A fork never asks a question — it names the rule, the record and the citation, and offers a choice. Forks raised by a statutory, regulatory or Sharia obligation belong to a compliance reviewer, and the server refuses any other signatory. The person’s reason is recorded for the audit and never reaches a model.
The complete paper, formatted for reading and circulation, with every table and the full source list. No form — take it.
Related: WorkForceOS — a governed agent roster · Dubai’s agentic-AI mandate · AI governance for UAE tenders · the Two Minds architecture
The placement mechanics — how the deterministic mind intercepts, binds, and audits the model’s output — are the subject of implementation work and outside the scope of this series. The regulatory substrate referred to throughout is compliance support, not a legal opinion. © 2026 Xamun Technologies. Version 1.0, September 2026.
The Xamun position-paper series