Enterprise AI under customer control
AI creates value by connecting models to enterprise data and systems. Agentic AI goes further by choosing tools, retrieving context, and taking action. Each added capability expands the control problem because leaders must know where processing happens, whose authority an agent carries, what data and actions are in scope, and whether the resulting evidence can withstand review.
The cost of weak controls is already becoming apparent. IBM reported an average U.S. breach cost of $10.22 million in 2025. In the subset of organizations reporting AI-related breaches, 97% lacked proper AI access controls.
$10.22M
Average cost of a U.S. data breach, 2025
97%
Of AI-related breaches involved orgs lacking proper AI access controls
Kamiwaza approaches sovereignty and security as one operating model. The platform is designed to run in customer-controlled infrastructure, send inference toward governed data, regulate collaboration and agent activity inside Workrooms, apply relationship-aware authorization on configured protected paths, and expose evidence at instrumented boundaries.
01
Inference goes to data
Route model execution to customer-selected compute near governed data, reducing unnecessary movement.
02
Authority stays bounded
Apply identity, workload, resource, and task-specific controls on configured paths.
03
Evidence stays usable
Capture decisions and activity at instrumented boundaries, with durable records for selected controls.
Takeaway
Sovereignty is not simply where a model is hosted. It is the ability to keep deployment, data access, execution, authority, collaboration, and evidence aligned to enterprise policy as AI acts across distributed environments.
01 Data sovereignty
Enterprise control must follow the entire AI data path.
Data sovereignty describes the laws, policies, contractual commitments, and internal rules that apply to data based on location, ownership, sensitivity, and access. For AI, those obligations extend beyond source systems. Derived context can appear in prompts, retrieval pipelines, embeddings, caches, logs, outputs, and tool activity.
The complete AI data footprint
Source records are only the start of the audit trail. Prompts, retrieval context, embeddings, caches, logs, tool calls, outputs, evaluations, and human feedback can each create location, access, retention, and transfer questions.
Sovereignty therefore requires operational control over where processing occurs, which identities can act, what crosses a boundary, and what evidence remains after the interaction.
Cloud regions and contractual assurances remain useful, but they cannot answer those questions alone. Enterprises need architectural controls that can be mapped to data classes, jurisdictions, teams, applications, and agent workflows. The objective is not isolation for its own sake. It is controlled use of data wherever the business is permitted to create value from it.
Regulatory reality
A defensible operating model answers four questions before a workload scales:
Location
Where do source data, context, model execution, logs, and outputs reside or transit?
Authority
Which person, service, or agent can access each resource and perform each operation?
Boundary
What may cross from one environment, tenant, Workroom, or jurisdiction to another?
Evidence
Can the organization reconstruct the request, authorization decision, execution path, result, and action?
Control expands where AI can operate
A governable architecture turns sovereignty from a deployment constraint into an expansion strategy. Leaders can approve more use cases across business units, infrastructure environments, and jurisdictions because location, authority, boundaries, and evidence are designed into the operating model.
02 Inference to data
Reduce unnecessary movement while preserving enterprise choice.
Many AI platforms start by sending data to a single remote model endpoint. Kamiwaza instead coordinates three capabilities across customer-selected environments. The Distributed Data Engine connects to governed sources where they reside. Context Manager maintains the semantic relationships needed to interpret those sources. Inference Mesh routes and schedules model execution across available cloud, data-center, and edge compute.
The architecture is critical, as movement creates copies, transit paths, credentials, retention questions, and additional jurisdictions to govern. Bringing execution toward the data can reduce those exposures and let infrastructure, security, and data teams choose where workloads run based on sensitivity, performance, cost, and policy.
Enterprise applications and agents
Submit governed requests and receive authorized results
▼
Kamiwaza orchestration layer
Distributed Data Engine
Connects and queries governed sources
Context Manager
Maintains meaning and relationships
Inference Mesh
Places execution on selected compute
▼
Customer-selected environments
Cloud
Governed data + available compute
Data Center
Governed data + available compute
Edge
Governed data + available compute
Security, policy, telemetry, and audit evidence span every layer
Kamiwaza sends model execution toward governed data instead of making centralized data movement the default. Source records and model compute can remain in customer-selected environments, while only the context, results, or evidence authorized for a given workflow may cross a boundary. Architecture review then defines what stays local, what may transit, and where each artifact is retained.
Move compute, not control
By routing model execution toward governed data, Kamiwaza lets enterprises use on-premises, edge, and cloud resources without making an external service the center of gravity. Teams retain infrastructure choice while reducing unnecessary replication and the control surface it creates.
03 Contextual security
Apply policy to the specific work, relationship, resource, and action.
The risk
Traditional role-based access control asks whether a user has a broad role, but agentic systems need more context. An authenticated user may be entitled to view a record but not export it, combine it with another source, or delegate access to an autonomous process. An agent may also call tools at machine speed, turning one over-broad permission into a chain of actions.
OWASP highlights agent goal hijacking, tool misuse, identity and privilege abuse, unexpected code execution, and cascading failures among leading agentic risks. Netskope likewise warns that AI systems can return information that a user or agent is not authorized to access.
Kamiwaza solution
Kamiwaza first establishes the governed context for the work. A Workroom brings people, agents, data, resources, and shared context into a bounded environment for a project or team. Membership and role determine who can participate in that collaboration.
Within that context, Kamiwaza ReBAC is the authorization model for configured protected paths, evaluating the relationship among a subject, a resource, and the Workroom in which an action occurs instead of relying only on a broad platform role.
Kamiwaza layers controls so one platform credential or broad user role does not have to define the entire decision:
Control layer and what it contributes
Identity and endpoint policy
Authenticate the requester and enforce entry-point rules before a sensitive path begins.
Workroom boundary
Define who can collaborate, which resources are in scope, and which project context governs the request.
Workload identity
Use a distinct service identity on eligible application paths so agent activity is not treated as anonymous platform access.
Kamiwaza ReBAC protected path
Evaluate tenant, object, relation, and subject tuples for enrolled protected resources.
Resource and task limits
Intersect requester rights, resource-holder policy, named operations, named resources, consent, and the workload ceiling.
Together, these layers let policy follow the work. Workroom membership establishes the collaboration context, while Kamiwaza ReBAC applies additional relationship-aware decisions to enrolled protected resources when enabled. Effective authority can then be narrowed by workload ceilings, task consent, requester rights, and resource-holder policy.
Least agency
On configured delegated paths, effective authority is designed as the intersection of the workload ceiling, exact task consent, named resources and operations, requester rights at the point of check, and resource-holder policy. Availability and enforcement coverage depend on release, configuration, and product path.
04 Workrooms
Workrooms create a governed collaboration and action boundary inside customer-controlled infrastructure.
Enterprise AI is rarely a one-person activity. Teams share context, applications invoke agents, and agents work with data and tools across a project. A Workroom brings people, agents, data, resources, context, and their relationships into one governed setting. The result is a boundary that follows the work rather than stopping at broad platform permissions.
Sovereignty boundary
Security boundary
Membership and role changes also produce an auditable history as access evolves. That history gives security and compliance teams evidence of who could collaborate in a Workroom and how privileges changed over time. It also supports operational review when a person changes teams, a project closes, or an agent is added to a workflow.
The distinction is important. Customer-controlled infrastructure supplies the deployment and data boundary. Workrooms supply the collaboration and action boundary inside it. Kamiwaza ReBAC supplies the relationship-aware authorization model for configured protected paths. Together, those controls let policy follow people, agents, resources, and their changing relationships.
Policy that follows the work
Workrooms keep collaboration fast without collapsing every project, agent, and resource into one permission domain. As membership and relationships change, governance and evidence remain attached to the context in which the work occurs.
05 Evidence and action
Auditability turns policy from an intention into operational evidence.
Security controls are incomplete when an organization cannot reconstruct what happened. A useful evidence trail connects the requester, identity, Workroom, sources, authorization decisions, execution location, model, result, and any tool or downstream action. That linkage helps security teams investigate incidents, architects validate design assumptions, and governance leaders demonstrate that controls operated as intended.
Kamiwaza exposes logs and OpenTelemetry signals at instrumented boundaries and maintains durable records for selected controls, including Workroom membership and role history. Customers can configure retention, correlation, and export into their existing observability and SIEM environment. Coverage is path-specific, so architecture review should identify which decisions and actions require durable evidence.
Questions to bring to an architecture review
Agentic workflows can compress identity, retrieval, authorization, model execution, and tool use into one chain of activity. Auditability is therefore more than log collection. Reviewers need to reconstruct how a request moved through that chain, which controls applied, and what action followed.
Sovereignty matters because enterprise AI becomes part of the organization's operating environment, not a separate experiment. The enterprise must retain meaningful control over where its data is processed, how people and agents use it, and how decisions can be reviewed. Kamiwaza brings those needs together: the Inference Mesh sends execution toward governed data, Workrooms establish collaboration and action boundaries, Kamiwaza ReBAC can apply relationship-aware authorization to configured protected paths, and audit evidence helps teams understand how access and activity evolve.
Learn more
Bring your data topology, priority use case, and control requirements to a Kamiwaza architecture session. We will map where inference should run, how Workrooms and authorization can bound the workflow, and what evidence your teams need to operate with confidence.
Data sovereignty describes the laws, policies, contractual commitments, and internal rules that apply to data based on location, ownership, sensitivity, and access. For AI, those obligations extend beyond source systems, because derived context can appear in prompts, retrieval pipelines, embeddings, caches, logs, outputs, and tool activity. Sovereignty for AI therefore requires operational control over where processing occurs, which identities can act, what crosses a boundary, and what evidence remains after each interaction.
Why does agentic AI make data sovereignty and security harder?Agentic AI goes further than connecting models to data by choosing tools, retrieving context, and taking action. Each added capability expands what leaders must govern, including where processing happens, whose authority an agent carries, what data and actions are in scope, and whether the resulting evidence can withstand review. Agents can also call tools at machine speed, so one over-broad permission can turn into a chain of actions.
Is hosting a model in a specific cloud region enough for data sovereignty?Cloud regions and contractual assurances remain useful, but they cannot answer every sovereignty question on their own. Enterprises also need architectural controls that can be mapped to data classes, jurisdictions, teams, applications, and agent workflows. Those controls should establish where data and execution reside, which identities can act, what may cross a boundary, and what evidence is retained.
What does it mean to send inference to governed data?Many AI platforms start by sending data to a single remote model endpoint. Sending inference to governed data reverses that default by placing model execution on customer-selected compute near the data. Kamiwaza coordinates three capabilities for this approach: the Distributed Data Engine connects to governed sources where they reside, Context Manager maintains the relationships needed to interpret those sources, and Inference Mesh routes and schedules model execution across available cloud, data-center, and edge compute. Reducing unnecessary movement can reduce the copies, transit paths, credentials, and jurisdictions that teams must govern.
How does Kamiwaza ReBAC differ from role-based access control?Role-based access control asks whether a user holds a broad role. Kamiwaza ReBAC evaluates the relationship among a subject, a resource, and the Workroom in which an action occurs, so authorization reflects the specific work rather than a broad platform role alone. The difference matters for agentic AI because an authenticated user may be entitled to view a record but not export it, combine it with another source, or delegate access to an autonomous process. Kamiwaza ReBAC serves as the authorization model for configured protected paths.