Phase 1 of 6
Scoping & Data-Sovereignty Constraints
Define tenant verticals, jurisdictions, isolation posture, and the regulatory perimeter that determines every downstream silicon, platform, and operating decision.
0/9
Phase Progress
Required Recommended Optional Open-Source Proprietary Trinidy
Tenant Vertical & Contract Surface
Identify regulated tenant verticals in scope
Why This Matters
Each vertical carries a different combination of data-residency, isolation, attestation, and audit-log retention obligations, and a single sovereign platform cannot satisfy all of them with one configuration. The choice of anchor vertical also determines whether you build against HIPAA, FedRAMP High, or CMMC 2.0 as the ceiling control set — all three are supersets of most commercial postures, but they are not interchangeable. Starting from the most stringent expected tenant collapses the later decisions rather than expanding them.
Note prompts — click to add
+ Which vertical is our anchor tenant for the first 12 months, and what is its binding control set?+ Do we have a single offering or do we plan to certify one platform against multiple frameworks in parallel?+ Have we validated with tenant counsel that the frameworks they cite are the ones that will actually apply to the AI workload?Confirm which regulated enterprise verticals the sovereign inference product will serve.
Select all that apply
Define sovereignty and jurisdiction boundary
Why This Matters
Schrems II (CJEU C-311/18) invalidated the EU-US Privacy Shield and requires supplementary measures whenever personal data leaves the EU, which in practice makes hyperscaler-routed inference legally fragile for EU tenants. EU data residency commitments are increasingly enforced at the contract and DPA level rather than the policy level, and any cross-border replication — even for telemetry — can break them. The architectural decision is made once at scoping, not at deployment.
Note prompts — click to add
+ Does the contract data-residency commitment match where we physically place the silicon, or are we making promises we cannot mechanically enforce?+ Have we mapped Schrems II supplementary-measures language for any EU tenants?+ Is control-plane telemetry (metrics, logs) covered by the same residency envelope as inference data?Select the jurisdictional data-residency envelope the platform must guarantee.
Single choice
Trinidy — Carrier-hosted inference at tower or central-office sites lets you commit to a specific jurisdictional boundary at contract time. Trinidy deploys to the physical site the tenant selects — no hidden cross-border replication in the platform layer.
Establish tenant isolation model
Why This Matters
The isolation model is the single most scrutinized element of a sovereign inference claim, and the one most often oversold — shared accelerators with only software-enforced separation do not meet ITAR or CMMC Level 2 expectations even if the marketing page says "isolated". NVIDIA H100 confidential computing and AMD SEV-SNP / Intel TDX offer hardware-attested separation that holds up to regulator scrutiny, but they require full-stack adoption (firmware, hypervisor, orchestration, driver). The difference between "partitioned" and "dedicated" is economic and contractual as much as technical, and it must be explicit in the tenant agreement.
Note prompts — click to add
+ Which isolation claim are we willing to put in a contract, and does the implementation technically support it end-to-end?+ Have we chosen a confidential-computing substrate (TDX / SEV-SNP / H100 CC) or are we still on non-attested isolation?+ What is our answer when an auditor asks for hardware attestation logs proving isolation across a tenant's workloads?Select the physical/logical isolation posture the platform will guarantee between tenants.
Single choice
Define inference latency SLA by tenant workload
Why This Matters
Nokia Bell Labs measurements on carrier-hosted H100 MIG partitions showed sub-12ms end-to-end inference for private LLM queries versus 85–140ms to hyperscaler public cloud, and that gap is exactly what justifies the 3–5× ARPU premium this product commands. A latency SLA is only meaningful when it survives cross-traffic, noisy neighbors, and failover — which is where carrier-edge deployments outperform traditional colo or hyperscaler regions. The SLA must be written per workload class, not as a single platform number.
Note prompts — click to add
+ What are the dominant inference workloads our first three tenants will run, and do they have the same latency requirement?+ Is our latency SLA measured end-to-end (tenant network edge → response) or only at the accelerator?+ Have we stress-tested under multi-tenant noisy-neighbor conditions or only in single-tenant pilots?Select the p99 latency envelope the platform must hold for the tenant inference surface.
Single choice
Trinidy — Carrier-hosted edge inference at tower or metro sites removes hyperscaler round-trip variance. Tenant workloads land inside a 10–15ms metro envelope rather than a 50–150ms hyperscaler round-trip — and the envelope is contractable.
Map compliance framework inheritance model
Why This Matters
A carrier-hosted sovereign AI platform can hold "inheritable" attestations that materially reduce each tenant's own audit burden — this is measurably where the 67% audit-prep reduction reported by Deutsche Telekom T-Systems tenants comes from. FedRAMP High in particular takes roughly 18–24 months and low-seven-figures to achieve, and a single platform ATO collapses that cost across all federal tenants. The ATO strategy is a go-to-market decision as much as a security one.
Note prompts — click to add
+ Which attestation is on the critical path for our anchor tenant, and what is its realistic timeline?+ Do we pursue FedRAMP High at the platform level or rely on each tenant running in their own ATO boundary?+ How do we handle the gap period — bridge letters, compensating controls, or delayed GA?Confirm which frameworks the platform itself will hold attestations for, versus inherited by the tenant.
Select all that apply
Confirm shared-responsibility contract with tenant
Why This Matters
The single clearest differentiation versus hyperscaler "sovereign cloud" offerings is the clean separation where the carrier manages silicon and power but never holds tenant key material or touches tenant data at rest or in inference. This contract is what satisfies the most stringent financial-services and healthcare auditors, and it cannot be retrofitted — it has to be a first-principles design decision. Every ambiguity in this split becomes a tenant objection in the sales cycle.
Note prompts — click to add
+ Does our platform architecture mechanically prevent carrier operators from reading tenant data, or only by policy?+ Do we offer BYOK / HYOK with hardware root-of-trust attestation?+ Is there a written shared-responsibility matrix that a regulator could read and approve?Document who owns the model, the data, the training, the inference runtime, and the logs.
Select all that apply
Identify sector-specific deal-breakers early
Why This Matters
A sovereign AI program is won and lost on the per-vertical deal-breakers that never appear in the general compliance package — ITAR workforce citizenship rules, IRS Pub 1075 background-check requirements, or FDA 21 CFR Part 11 electronic-record rules are each capable of disqualifying an otherwise-compliant platform at the last mile. Surfacing these in scoping rather than in procurement diligence is where first-mover carriers separate from hyperscalers attempting to retrofit. These constraints often flow through to workforce, not just technology.
Note prompts — click to add
+ Have we inventoried the deal-breakers for each vertical we plan to serve, or only the headline frameworks?+ Does our operations workforce hold the citizenship / clearances required by our defense pipeline?+ Which constraints flow through to the physical site (e.g., TEMPEST / SCIF) rather than the platform?Capture per-vertical constraints that, if missed, disqualify the platform entirely.
Select all that apply
Define deployment footprint and site topology
Why This Matters
Site footprint determines both the latency story and the sovereignty story — a single-metro pilot is right for anchor-tenant proof but will fail a national BFSI RFP that expects multi-region redundancy. Carrier-neutral and tower sites typically have physical-security controls that hyperscaler regions do not expose to tenants, which matters for CMMC and FedRAMP High. Expanding footprint after contracts are signed is painful; sizing it correctly during scoping is cheap.
Note prompts — click to add
+ Does our first anchor tenant need redundancy today, or is single-site acceptable for pilot?+ Which of our sites are already cleared / hardened for defense or federal workloads?+ Do we treat tenant-premises cages as in-scope for the platform, or out-of-scope tenant responsibility?Select the physical footprint the sovereign inference fabric will span.
Single choice
Define platform risk appetite and residual-risk register
Why This Matters
Even an attested, hardware-isolated sovereign platform retains a residual risk profile — supply-chain, insider, side-channel, and the emerging category of model-level risks under the EU AI Act. Naming the residual risks and assigning a governance owner is what distinguishes a mature program from a marketing claim, and it is explicitly required under ISO/IEC 42001 and the NIST AI RMF 1.0. The register should be reviewed on a fixed cadence, not only at deal-close.
Note prompts — click to add
+ Who owns the platform-level residual-risk register, and on what cadence is it reviewed?+ Have we enumerated insider, supply-chain, and side-channel risks specific to confidential computing?+ Does our tenant onboarding disclosure align with what our residual-risk register actually says?Confirm governance ownership of residual risks the platform does not eliminate.
✓ saved