Abstract

Your Data Never Left Europe. Your Decision Did. Sovereign Storage Is Not Sovereign Execution: Jurisdiction-Bound Execution Finality for Cross-Border Cloud, AI, Payment and Critical-Infrastructure Systems

Abstract

Governments, banks and enterprises are paying for sovereign clouds and data boundaries so that sensitive data and decisions stay under the right law. But a decision can be approved in one jurisdiction and executed in another without any hacking at all. A workload is authorised while running in an approved region. Then a disaster-recovery failover, a cross-region queue, a service reroute, a remote administrator, a change of key-control domain or a substituted destination moves the actual effect somewhere else. Identity is still valid, the token is still authentic, the platform is still attested, and the data at rest may never have left. Yet the payment, model output, disclosure or control command takes effect under a context the policy never allowed. Storing data in one region does not prove where it is processed, administered, decrypted, transmitted or finally released.

This disclosure makes jurisdiction an effectuation-time property of each exact action. A proposed action (a Candidate Act) stays non-effective until the Finality Sink, the point where the effect first becomes real, establishes a current Jurisdiction Execution Context (JEC). The sink then verifies that context against an authoritative, machine-readable jurisdiction policy.

The JEC is a typed set of dimensions:

  • workload identity
  • compute and processing domain
  • storage region
  • destination
  • operator and control domain
  • key-control domain
  • remote-access state
  • sovereign boundary
  • trust state
  • policy and topology generations

Each dimension has its own trusted evidence source, assurance class, freshness rule and corroboration rule. The architecture adds the following safeguards:

  • Fail-closed on doubt. Unknown, stale, conflicting or unavailable dimensions never silently become “allow”.
  • Targeted revalidation. A generation vector forces revalidation only when a load-bearing dimension changes.
  • Equivalent failover only. Failover is permitted only between policy-equivalent contexts.
  • Consistent evidence. Cross-dimension consistency stops evidence from different workloads being mixed.
  • Final atomic check. An atomic section re-checks the exact act, current context and path coverage before committing.

The disclosure includes formal predicates, a bounded prevention argument, a state machine, pseudocode, an attack analysis and nineteen required test-vector classes. OAuth RAR, Resource Indicators, JWT, WIMSE, RATS and SCITT supply inputs; the contribution is the effectuation-time invariant. The architecture enforces deployment-selected policy and does not determine which law applies.

Industry relevance (AI-generated): the architecture concerns publicly described sovereignty programmes that can supply JEC inputs. These include Microsoft EU Data Boundary, the AWS European Sovereign Cloud, Google Cloud Sovereign Controls by Partners, the Oracle EU Sovereign Cloud, partner-operated national clouds, NVIDIA GPU attestation and Arm Confidential Compute Architecture. It also concerns sectors including government, confidential AI inference, payments and CBDC, telecom, critical infrastructure and health. Regulatory context includes GDPR international-transfer rules, EU Data Act safeguards against unlawful third-country access, DORA and NIS2. These programmes are named only as examples of controls that could feed the architecture. Naming them does not allege any deficiency, non-compliance or infringement, and does not imply endorsement. A deployment that already enforces all required jurisdiction dimensions at the actual, non-bypassable consequence boundary already satisfies the core property. This industry-relevance material is AI-generated and must be cross-checked against the original PCT filings and primary sources before drawing any conclusion. Technical enforcement is not legal advice.

This technical disclosure is based on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026 (WO 2026/150382). That application claims priority from PCT/IB2026/053385, filed 7 April 2026 and publicly disclosed 4 June 2026 (WO 2026/115520). The jurisdiction-finality details are as published in Internet-Draft draft-das-jurisdiction-bound-execution-finality-00 on 16 September 2026. Related family applications can be cross-checked on WIPO PATENTSCOPE.

Licensed under CC BY-NC 4.0. The author is open to acquihire or strategic collaboration.

Keywords

digital sovereignty; sovereign cloud; data residency; EU Data Boundary; AWS European Sovereign Cloud; Google Sovereign Controls; Oracle EU Sovereign Cloud; cross-border data transfer; jurisdiction-aware authorisation; disaster-recovery failover; workload migration; remote administration; key-control domain; external key management; confidential computing; NVIDIA attestation; Arm CCA; RATS; WIMSE; OAuth RAR; SCITT; execution finality; Finality Sink; fail-closed; generation vector; TOCTOU; GDPR Chapter V; EU Data Act; DORA; machine enforcement.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS