Sovereign Agents
Every agent call is a data transfer. What AI agents actually do, the six kinds already in your organisation, and how to apply the sovereignty ladder once AI starts acting.
For CDOs, CIOs and heads of data governance
- An AI agent does not only answer. It plans, calls tools, reads and writes data in other systems, and keeps traces and sometimes memory. Each of those steps can send data somewhere new.
- Agents are already in most organisations, often switched on inside software that was bought for something else. FINMA has observed that institutions sometimes struggle to tell whether purchased products even contain AI.
- The five sovereignty questions still apply, but they now concern behaviour as much as storage: where inference runs, which law governs every service the agent calls, who can read prompts and traces, who can stop the agent, and whether you could replace it.
For your next steering committee: list every agent in use, including those embedded in licensed software, and name an owner for each.
The previous briefing argued that data residency is only the first rung of sovereignty. That argument was about data at rest: where it sits, who can compel access, who holds the keys. AI agents change the question. An agent moves data as part of its job, across services and jurisdictions, often in seconds and without a human watching each step. This briefing explains what agents actually do, which kinds are already in use, and what a data leader can put in place this quarter.
What an Agent Actually Does
Take a simple request: "Summarise this week's client complaints and open a ticket for anything urgent." A chatbot drafts a summary from whatever text you paste into it. An agent searches the complaints system itself, reads the records, decides which ones are urgent, and creates tickets in the service desk. It does so with credentials, either its own or those of the person who set it up.
That difference is the whole point. Anthropic separates workflows, where models and tools are orchestrated "through predefined code paths", from agents, where models decide their own steps.1 Singapore's Model AI Governance Framework for Agentic AI describes the same building blocks: a reasoning and planning engine, instructions, memory, tools to act on external systems, and protocols to communicate with other agents.2
Components as described by IMDA (Singapore) and Anthropic. Questions are DataEdgePro's.
Not every agent carries the same risk. The FSB's final report on AI, published on 15 October 2026, puts it plainly: autonomy and capability are "a spectrum", and not every agent needs the same level of autonomy or access.3 A practical way to place an agent on that spectrum is by what it is allowed to do.
- Read.
The agent searches and summarises, but changes nothing. Test: can it only return information to the user?
Tier 1 - Draft.
It prepares outputs that a person sends or saves: an email, a report, a pull request. Test: does a human click before anything leaves?
Tier 2 - Act with approval.
It executes actions after explicit sign-off. Test: is approval enforced by the system, not just expected?
Tier 3 - Act alone.
It creates, changes or deletes records in other systems without sign-off. Test: can you list every system it can write to?
Tier 4 - Commit.
It moves money, sends data outside the organisation or makes decisions affecting clients or staff. Test: has the board's risk appetite explicitly allowed this?
Tier 5
The FSB's own agentic case study shows tier 3 in practice: a bank's fraud agent proposes new detection rules, and analysts review and approve every rule before it goes live. The bank also prohibits the agent from executing financial transactions until further testing.3
Six Kinds of Agents Already in the Building
Most organisations did not decide to deploy agents. Agents arrived inside software they already license, as new features in productivity suites, CRM and service platforms. FINMA noticed the consequence in its 2024 supervisory guidance on AI: for externally purchased applications, institutions "sometimes had difficulties determining whether AI is included, which data and methods are used and whether sufficient due diligence exists".4
Grouping agents by what they can touch, rather than by vendor, gives six families. Each raises different questions.
Assistants embedded in licensed software
Agents switched on inside suites you already use for office work, CRM or IT service management.
- Examples
- Microsoft 365 Copilot and its agents, Salesforce Agentforce, ServiceNow AI Agents
- Can touch
- Mail, documents, chats, client records, tickets: whatever the user or the service account can reach
- Typical path
- Inference and retrieval in the vendor's cloud, plus optional web search or third-party models
First question: which agent features are enabled by default in our tenant, and who decided?
Browser and computer-use agents
Agents that act through a screen: they read web pages, click, type and fill forms, on the web or on a desktop.
- Examples
- ChatGPT agent (OpenAI), Claude in Chrome (Anthropic), computer use in Microsoft Copilot Studio
- Can touch
- Anything visible on screen and any site where the user is signed in
- Typical path
- Screenshots or page content sent to the model provider; actions taken under the user's sessions
First question: which sessions and internal web applications could such an agent see while a user is logged in?
Coding agents
Agents that read repositories, run commands, write code and open pull requests.
- Examples
- GitHub Copilot coding agent, Claude Code, OpenAI Codex
- Can touch
- Source code, configuration, sometimes secrets, test data and build pipelines
- Typical path
- Code context sent to the model; commands run locally or in a cloud sandbox
First question: can a coding agent reach production data, credentials or client data held in test environments?
Research agents
Agents that run many searches, read sources and internal documents, and produce a report.
- Examples
- ChatGPT deep research, Gemini Deep Research, Microsoft 365 Copilot Researcher
- Can touch
- The public web and, when connected, internal documents and mailboxes
- Typical path
- Search queries sent to web search services, sometimes under different terms from the main product
First question: what leaves the organisation in the search queries, and under which contract?
Agents built in-house on a cloud platform
Agents your teams design on an agent platform or framework, choosing the model, the tools and the data.
- Examples
- Microsoft Foundry Agent Service, Amazon Bedrock AgentCore, Google Vertex AI Agent Builder, open-source frameworks
- Can touch
- Whatever your teams connect: databases, APIs, document stores
- Typical path
- You choose the region and model; traces and memory often stored in platform services
First question: in which region do inference, retrieval indexes, memory and traces actually run?
Connected and multi-agent systems
Agents that call tools through connectors, or delegate tasks to other agents, possibly run by other providers.
- Examples
- MCP servers and connectors, Agent2Agent integrations, orchestrators that call sub-agents
- Can touch
- The sum of everything every connected tool and agent can touch
- Typical path
- Data hops between services; each hop may sit with a different provider and jurisdiction
First question: who approved each connector, and do we have a list of them?
Product names are illustrations, not assessments. Capabilities and data paths depend on configuration and contract; check each product's current documentation.
The sixth family matters most for governance. The FSB warns that the risks of an agent's access to tools and systems "may compound multiplicatively", so each new access should be assessed together with the access the agent already has, not in isolation.3 An agent that can read the client database is one risk. The same agent with an email connector is a different one.
Every Agent Call Is a Data Transfer
Swiss data protection law does not wait for an AI act. The Federal Data Protection and Information Commissioner has stated that the Federal Act on Data Protection "is directly applicable to AI-supported data processing", including the duty to make the purpose, functionality and data sources of such processing transparent.5 When personal data leaves Switzerland during an agent run, the cross-border rules of article 16 apply to that step, as they would to any other disclosure.
The difficulty is that an agent run is not one transfer. It is a chain of them.
A generic run for illustration. Real paths depend on the product and its configuration.
Two parts of that chain are routinely missed. The first is optional services the agent calls on its own initiative. Microsoft documents a clear example for Microsoft 365 Copilot: when web search is used, Copilot sends a short generated search query, along with the user's IP address, to the Bing search service. Microsoft states that its Data Protection Addendum and the EU Data Boundary do not apply to these generated queries, which fall under separate terms. Web search is available by default unless an administrator turns it off through a dedicated policy.6 This is documented, controllable and often reasonable. It is also a decision someone in the organisation should have taken knowingly.
The second is what the agent leaves behind. Traces record prompts, retrieved content and tool results. Memory keeps facts between runs. Retrieval indexes hold copies of your documents in another form. All three are new data stores that need a location, a classification, a retention period and an owner, exactly like any other.
The Ladder, Applied to Agents
The five rungs from the previous briefing still hold. What changes is the question asked at each one.
| Rung | The question for an agent | Evidence to ask for |
|---|---|---|
| 1 · Location | Where do inference, retrieval indexes, memory and traces run, for this agent as configured? | Region settings and the provider's documented processing locations, per component |
| 2 · Jurisdiction | Which companies process data during a run, including the model provider behind the application and any search or tool services? | Sub-processor list and the terms that apply to each optional service |
| 3 · Key control | Can the provider read prompts and traces, how long are they kept, and are they used to improve the service? | Retention and training clauses, encryption and key options |
| 4 · Operational control | Does each agent have an identity, an owner, a trace of its actions, and a way to stop it or revoke its access quickly? | Agent inventory, logs you can query, a tested revocation procedure |
| 5 · Exit | Could you switch the model or the platform without rebuilding instructions, tools and evaluations? | Use of open protocols, portable prompts and tool definitions, a second model tested |
Location is moving fast. Microsoft announced in November 2025 that it would offer in-country processing of Microsoft 365 Copilot interactions in fifteen countries, Switzerland among them. Its April 2026 update narrowed the plan: local inferencing in a first group of countries, and for EU and EFTA countries, delivery "at a regional level".7 For a Swiss organisation, regional and in-country are not the same rung, and the difference should be documented rather than assumed.
Exit is where open standards help. The Model Context Protocol was placed under the Linux Foundation's Agentic AI Foundation in December 2025, and the Agent2Agent protocol became a Linux Foundation project in June 2025.8 Agents whose tools are exposed through open protocols are easier to move than agents wired into one vendor's proprietary connectors. Open models are a further option for workloads that must run on infrastructure you control: Apertus, released in September 2025 by EPFL, ETH Zurich and the Swiss National Supercomputing Centre, publishes its weights, training data and recipes under a permissive licence.9
What Supervisors Already Expect
There is no Swiss AI act yet. The federal administration plans a consultation draft in spring 2027, covering transparency, data protection, non-discrimination and supervision.10 In the meantime, three sources already set clear expectations.
The FADP applies now
Transparency on purpose, functionality and data sources; the right to have automated individual decisions reviewed by a person; a data protection impact assessment for high-risk processing.5
Inventory and accountability
FINMA looks for a centrally managed inventory of AI applications with a risk classification, defined responsibilities, testing and documentation, and for outsourced AI, additional tests, controls and contractual clauses. It notes that inventories are hard to complete because AI is now accessible to everyone.4
Bounded, traceable agents
Agree a risk tolerance for each agentic use case at inception; define an agent's goals, permissions and rules, including when to seek human approval, separately from the data it can access; give agents unique identifiers so their actions can be traced; prepare exit strategies for critical AI services.3
The federal administration offers a useful signal too. The worked example in directive W012, the federal sovereignty directive discussed in the previous briefing, is an AI application that extracts information and files it automatically in the records system. Its first questions are the ones above: could the administration run the application itself or change provider, and how are personal and business data protected?11
The Agent Card
The most workable control is also the simplest: one page per agent, kept current and owned by a named person. It turns a vague worry about "AI" into answers that can be checked.
One agent card per agent
- Owner: the business person accountable for what the agent does.
- Family and purpose: which of the six families, and the task it is allowed to perform.
- Action tier: read, draft, act with approval, act alone or commit.
- Data reach: the systems and data classes it can read and write, and under whose credentials.
- Inference and model: which model, run by which company, in which region.
- Tools and connectors: each external service it can call, including web search, and the terms that apply.
- Traces and memory: where they are stored, for how long, and who can read them.
- Stop and revoke: who can stop the agent, and how fast its access can be withdrawn.
- Exit: what it would take to replace the model or the platform.
An agent without an owner should not run. An agent at tier 4 or 5 without a tested stop procedure should not either.
For the next ninety days, three moves deliver most of the value. First, build the inventory, starting with agent features already enabled in licensed software, since those are the ones nobody chose. Second, write an agent card for every agent at tier 3 or above, and check the defaults that move data outside the main contract, such as web search, third-party models and connectors. Third, decide where traces and memory live and how long they are kept, before they accumulate.
From Where Data Sits to What Agents Do
Data sovereignty used to be a question about storage. With agents, it becomes a question about behaviour: what a piece of software is allowed to read, where it sends what it reads, what it remembers, and who can stop it. None of this requires a new discipline. It requires applying the one data leaders already practise, ownership, classification, lineage and retention, to a new kind of actor.
Sources & references
- Anthropic, Building effective agents, 19 December 2024. anthropic.com
- Infocomm Media Development Authority (Singapore), Model AI Governance Framework for Agentic AI, January 2026, updated May 2026; summary by Covington & Burling, April 2026. globalpolicywatch.com
- Financial Stability Board, Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report, 15 October 2026, sections 3.2 to 3.5 and agentic case study. fsb.org
- FINMA, Guidance 08/2024: Governance and risk management when using artificial intelligence, 18 December 2024, sections 2.1 and 2.2. finma.ch
- Federal Data Protection and Information Commissioner, Current data protection legislation is directly applicable to AI, update of 8 May 2025. edoeb.admin.ch
- Microsoft Learn, Data, privacy, and security for web search in Microsoft Copilot and Microsoft Copilot Chat, consulted 2 November 2026. learn.microsoft.com
- Microsoft, Microsoft offers in-country data processing to 15 countries to strengthen sovereign controls for Microsoft 365 Copilot, 4 November 2025, with editor's note of 3 April 2026. microsoft.com
- Model Context Protocol, MCP joins the Agentic AI Foundation, 9 December 2025; Linux Foundation, Linux Foundation launches the Agent2Agent Protocol Project, 23 June 2025. modelcontextprotocol.io · linuxfoundation.org
- EPFL AI Center, Apertus: a fully open, transparent, multilingual language model, 2 September 2025. ai.epfl.ch
- State Secretariat for Economic Affairs, KMU portal, Bis Anfang 2027 soll ein Vorentwurf zur KI-Regulierung ausgearbeitet werden, 23 September 2026. kmu.admin.ch
- Federal Chancellery, Souveraineté numérique de l'administration fédérale, W012 version 1.0, in force 1 January 2026, section 2.4. bk.admin.ch
