A cloud review in Türkiye cleared data residency before stalling on root access

Dinçer lists what can change without the primary dataset moving: access policies set by a remote administrator, encryption keys that depend on an external authority, and model versions, guardrails, routing or logging ^[6]. "Data residency is therefore a prerequisite for sovereignty, not proof of it," he wrote ^[5].

Of the five questions he recounts putting to the institution, one asked where the data sat and four asked who holds authority over the system ^[19].

The trade-off he names is compute cost against local authority. Shared infrastructure can make large-scale GPU compute more economical, he wrote, while sensitive data, real-time inference and continuity needs may make local execution preferable or necessary ^[10]. His proposal is to place workloads by policy. Sensitive data and latency-critical inference go local or at the edge, large-scale training on approved shared capacity. Wherever execution happens, the organization holds authority over identity, keys, policy and auditability ^[11].

Regulation reaches this at the second test, which Dinçer frames as a regulator asking why a particular AI-assisted decision changed ^[18]. He cites the NIST AI Risk Management Framework, which treats governance as a cross-cutting function throughout the AI life cycle, and the EU AI Act, which requires capabilities such as automatic logging and effective human oversight for high-risk systems ^[13][14].

A skeptic would say this is a cloud company founder's framing of a question his own product is positioned to answer, and that security reviews already ask who has root ^[1]. His instruction answers part of that objection. Do not stop at the organizational chart or contract; follow the technical chain of authority through root access, identity, key control, privileged vendor access and the right to deploy a model or change a guardrail ^[16]. He also sets a boundary on the exercise. The goal, he wrote, is not to eliminate every external dependency but to know where authority sits and which decisions remain under the organization's control ^[17]. It is one conversation with one institution. Dinçer does not name it and gives no figures ^[20].

In my view the durable part is the continuity question. It is the one with a pass or fail answer: if access to a global control plane disappears, can the organization keep operating and auditing locally ^[3]. The principle Dinçer says he favors is central standards, local execution, and the ability to observe, decide and continue operating when connectivity or an external dependency is lost ^[12]. He defines the goal in terms of options. "Sovereignty is not isolation. It is the ability to choose, operate through disruption and, when necessary, change providers," he wrote ^[8].