5:21 pm Eastern, June 12. Anthropic receives a directive from the US government. Within hours, two of its frontier models, Fable 5 and Mythos 5, go dark for every customer on the planet.
Not a rate limit. Not a regional outage. Off.
I read the status page from my kitchen table and had the same thought a lot of you probably had: I use one of those models every day. And then a quieter thought, the one that actually kept me up: what if I’d been building something that depended on it at 5:20 pm?
Here is the part that unsettled me more than the news itself. I’d been hearing a version of this conversation for months, long before the kill switch made it a headline. Nine distinct accounts this quarter, four of them in a single week, all circling the same constraint.
Across those conversations, regulated teams kept reaching the same conclusion: cloud deployment did not meet their compliance requirements, so the decision had already shifted to what self-hosted operation would require at enterprise scale. These teams had already decided the punditry was late. The news cycle just caught up to what my calls were telling me.
This issue is about that gap. What enterprises are quietly doing, why June proved them right, and the one move you can make this quarter that costs a weekend instead of a data center.
Let me start where I actually saw this, because it did not start on a status page.
The strongest field pattern I’m tracking right now is boring on the surface and load-bearing underneath: regulated enterprises are defaulting to self-hosted LLM observability, and they decided this before any feature comparison. It came up in nine separate account conversations this quarter (four in one week in early July), which in my ledger moves it from “interesting” to validated.
Compliance regime first, capability second. Government-grade certifications, data residency rules, air-gap requirements. Those constraints rule out cloud regardless of how good the cloud product is. The feature parity conversation never even happens.
Here is a related tension worth naming, even setting my calls aside. When teams evaluate LLM-as-judge (using one model to score another model’s output), the sovereignty question shows up immediately: can the eval scoring run without any data leaving the environment? Plenty of teams will not send their prompts and outputs to a third-party scorer even for evaluation, precisely because evaluation is where the sensitive stuff concentrates.
And there is a tax nobody prices in up front. The question that follows any self-hosting decision is whether it holds at 10x. Sovereignty creates its own scaling homework. You do not get to own the stack and skip the operational math.
Notice what none of these teams are talking about. They are not debating open-weight models versus frontier APIs. They are not spinning up GPU clusters.
They are two layers below the sovereign-AI keynotes, working on the part they can actually control this quarter. That is the whole insight of this issue, and I’ll name the framework in a minute.
Here is the enterprise translation: procurement and architecture teams had already moved from “which model is best?” to “which parts of the system can we keep under our control?” before the market narrative caught up. Then June happened, and the narrative caught up hard.
Back to that kill switch, because the details matter and the framing matters more.
On June 12, 2026, the US government issued an export-control directive under national security authorities requiring Anthropic to suspend access to Fable 5 and Mythos 5. Anthropic disabled both models for all customers globally to comply. In their words: “we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.”
The controls lifted at the end of the month. Access was restored on July 1, 2026. The suspension was temporary. Say that part out loud, because the internet did not.
But temporary is not the same as harmless. The stated basis was thin: a claimed jailbreak communicated only verbally, which Anthropic characterized as narrow and non-universal (asking the model to read a specific codebase and fix software flaws). Anthropic publicly called the action a disproportionate “recall of a commercial model deployed to hundreds of millions of people,” and argued that suspensions like this need “a statutory process that is transparent, fair, clear, and grounded in technical facts.”
I’ll note the contested account for fairness: Trump adviser David Sacks claims Anthropic was warned and declined to fix the jailbreak first. Even if you take Sacks at his word, the mechanism is identical: a binding government directive, no enterprise recourse, and a vendor that could not protect its own customers’ access even if it wanted to.
That is the enterprise translation. If you build on a hosted frontier API, you carry suspension risk that even the model vendor does not control.
The vendors selling the fix noticed immediately.
On CNBC on July 1, Palantir’s Alex Karp framed enterprise demand as wanting “control over their compute, their models, their data stack and their alpha,” and named the custody surface with four questions I think are genuinely the right questions: “Who owns the data? Where is it cached? Are the prompts secure? Is this being transferred to you?”
Read those again. Every one is about telemetry, not model weights.
Cohere has built its entire go-to-market on the same nerve: “Own your AI. Your data. Your infrastructure. Cohere keeps it that way,” with CEO Aidan Gomez telling the G7 that the world can no longer afford to rent its future from centralized providers.
Take those quotes as what they are: vendor positioning from parties selling the control layer. Karp’s claim that an open model can be tuned to frontier parity is unverified marketing, not fact. The questions are right. The salesmanship around them is still salesmanship.
The macro numbers point the same direction, if you read them honestly. Gartner projects $80B in sovereign-cloud IaaS spending in 2026, up 35.6% year over year (that figure includes China, which is $47B of the total, so discount accordingly). Broadcom’s Private Cloud Outlook 2026, a Broadcom report based on a blind survey of 1,800 respondents, found that public cloud as the primary environment for production AI inference fell from 56% to 41% year over year.
A vendor-commissioned survey from Cloudian (n=203, so weight it lightly) put 93% of enterprises as repatriating or evaluating repatriation of AI workloads, though “evaluating” is doing heavy lifting in that number and stated intent has historically outrun actual migration. I am not going to sell you a stampede out of the cloud. I am telling you the center of gravity is moving, and my calls moved first.
One more field beat, because it corroborates the whole thing. Five accounts this quarter ran formal vendor bake-offs, structured, documented evaluations of self-hosted versus managed observability, not hallway opinions. That is also newly validated in my ledger. When procurement writes the comparison down, the conversation has left the hype stage.
Here is the mental model I keep coming back to, because it cuts through the noise. Sovereignty is not a yes or no. It is a gradient, and the layers cost wildly different amounts.
Almost every public argument is happening on the top two layers. Almost every practical win is on the bottom two.
I call it The Sovereignty Gradient.
The June kill switch exposed how much of the industry sits exposed on layers 3 and 4. But the leak that happens every single day, on every single request, is layers 1 and 2.
A prompt is a confession. It carries your PII, your proprietary context, your strategy, the exact “alpha” Karp says enterprises are livid about handing to third parties. Your traces are the flight recorder of everything your agents did and why. If you own nothing else, own that.
So here is the practitioner treatment, layer by layer, with what you can actually do this quarter.
Layer 1: Telemetry. This is the weekend win. Stand up a self-hosted observability layer and point every agent’s tracing at infrastructure you control. Prompts, responses, tool calls, eval scores: all of it lands in your instance instead of someone else’s SaaS.
This is days of work, not months, and it is the single highest-leverage sovereignty move most teams have never made. If you do exactly one thing after reading this, do this one.
Layer 2: Data store. This is the quarter project. Move the analytical store your agents read from and write to onto infrastructure you run. This is the store behind your retrieval, your logs, your metrics.
Weeks, not days, because there is real migration and schema work, but it is well-trodden and fully open source. Owning layer 1 without layer 2 is half a sovereignty story: the black box is yours, but the library it reads from still belongs to someone else.
Layer 3: Models. This quarter, pilot, don’t platform. You probably cannot fully own model serving this quarter, and you should not pretend otherwise. What you can do is run one honest bake-off (five of my accounts already are) and pilot an open-weight model on a single non-critical workload.
Build the muscle and the benchmark data now, so that if you ever need to move up here, the decision is evidence-based instead of panic-based. Do not let a vendor’s frontier-parity marketing make the call for you.
Layer 4: Compute. This quarter, mostly don’t, but architect for it. Owning data centers and full air-gap is a multi-year, multi-billion commitment that makes sense for nation states and the most heavily regulated institutions, and almost no one else. The practical move is not to build layer 4.
Build layers 1 and 2 so they are air-gap-capable from day one. If your compliance regime ever forces you up here, you are reconfiguring, not re-platforming from scratch. Sovereignty you can escalate beats sovereignty you have to rebuild.
Read the gradient top to bottom and it looks impossible. Read it bottom to top and most of it is a Q3 project.
I run this myself. Two self-hosted Langfuse-on-ClickHouse estates, one for my personal agent fleet and one for work. My agents’ prompts, traces, and evals live on machines I control. This section is practice, not a brochure.
For layers 1 and 2, the concrete open-source fit is Langfuse (Agent and LLM observability) writing to ClickHouse (the analytical store). The mechanism is the whole point, and ClickHouse’s own Agentic Data Stack writeup says it plainly: “Your traces are yours: Langfuse writes to your ClickHouse instance, not an external SaaS.”
Self-hosted Langfuse is the same codebase as the cloud product, not a degraded community edition. You can start with Docker and grow into Kubernetes (Helm) and Terraform. And per the docs, “Internet access is optional,” which is the polite way of saying it runs fully air-gapped.
In Issue #24, I showed the certification loop I run for production agents. That loop depends on prompts, traces, eval scores, and review history staying available long enough to become an audit trail. Owning the telemetry layer is how you keep that internal case intact when a model or vendor changes.
Now the honesty beats, because sovereignty-washing is real and I am not going to sell you a clean story that has dirt in it. Some Langfuse add-ons need an enterprise license key: the MIT core (tracing, evals, prompt management, datasets) is free and unlimited, but “fully open-source sovereignty” needs that asterisk.
Self-hosting is genuine operational work, which is exactly that 10x-scaling homework. And “sovereign” is a word vendors abuse: several loudly sovereign national stacks still lean on foreign GPU and cloud infrastructure underneath, so audit the whole dependency chain, not the label on the box.
There is a regulatory tailwind worth knowing. The EU AI Act, Article 12, requires high-risk systems to automatically log events across their lifecycle, and Article 19 requires retaining those logs for at least six months. Self-hosted observability is a clean way to meet that.
One timing caveat so you plan correctly: the Digital Omnibus provisional agreement would postpone standalone high-risk (Annex III) applicability to December 2, 2027, though the general-purpose model obligations have been in force since August 2, 2025. So the logging duty is coming, with more runway than the headlines imply.
To be straight about the logic: the mapping from “the risk is telemetry custody” to “self-host Langfuse on ClickHouse” is my argument, backed by field signal, not a market study someone handed me. The premises are verified. The bridge is mine. I am telling you where I put my own agents’ data, and why.
Three questions. Ask them in your next standup and watch how long the room goes quiet.
Where do your agent traces physically live, and who else can read them? If the honest answer is “a vendor’s cloud, and I’m not totally sure who has access,” you are on layer zero.
If your model vendor lost access tomorrow, the way Anthropic’s customers did on June 12, what do you actually lose? You lose inference, sure. But do you keep the record of what your agents did, decided, and cost? Or does that evaporate with the API key?
Which layer of the Sovereignty Gradient are you on, and which layer does your compliance regime actually require? Those two answers are often different by a full layer, and the gap between them is your roadmap.
You do not need to own the whole gradient. You need to know which layer you are standing on, and stop pretending sovereignty starts at the top.
If you are building the internal case, do not ask the organization to buy all four layers at once. Ask for custody of telemetry and the analytical data store now, then show how that decision preserves an escalation path if regulation or access risk forces the stack upward later.
You can rent the smartest model on earth and still own nothing it learned about you. Sovereignty starts with the memory, not the mind.
Next Tuesday: What Do You Call Agentic? I finally mapped why three teams using the same word were quietly building three completely different systems, and why the definition gap is costing them.
I write these Field Briefs because the pattern is usually easier to see from outside an org than from inside it.
If a CTO or VP of Engineering you know is building the internal case for self-hosted observability, forward this issue to them. The Sovereignty Gradient gives them a four-layer frame to take into the next architecture review.
If that person is you, hit reply and tell me where self-hosting went sideways. I work with a handful of teams navigating exactly this, and I want to compare notes.
Quick hits from this week in enterprise AI:
↓ Anthropic restored Fable 5 and Mythos 5 on July 1 after the June 12 government suspension. The models came back; the precedent that a state can switch off a deployed frontier model did not.
👀 Karp’s four custody questions on CNBC (July 1). He is selling the control layer, but “who owns the data, where is it cached, are the prompts secure” are the right questions to carry into any vendor meeting.
↑ Gartner: $80B sovereign-cloud IaaS spend in 2026, up 35.6%. Real money is moving, though $47B of it is China, so read the ex-China number before you quote it.
↓ Broadcom Private Cloud Outlook 2026 (blind survey, n=1,800): public cloud as primary for production AI inference fell 56% to 41%. This is vendor-published evidence from Broadcom, so treat the direction as useful and the provenance as part of the finding.
↑ ClickHouse’s open-source Agentic Data Stack names data sovereignty as a design principle. “Your traces are yours” is a product line now, not a philosophy, and self-hosting makes it literal.
👀 Langfuse self-hosting docs: “Internet access is optional”. Air-gap-capable agent observability is the layer-1 move almost nobody is talking about and almost anybody can ship this quarter.
More Signal. Less Noise.
Signal over Noise is written by Doneyli De Jesus, Principal AI Architect
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.