Strategy Blog
Agents Need Guardrails. Guardrails Need Jurisdiction.
Agent security is now a top cyber priority as autonomous systems get access to corporate systems. SCX.ai CEO David Keane on why the guardrails conversation is missing its most important ingredient: where the agents actually run.
This month the security conversation in enterprise AI finally caught up with reality. Autonomous agents are no longer answering questions. They are writing to file systems, calling APIs, moving money, and touching production systems. And every major security guidance published in the last few weeks now says the same thing: securing agents against prompt injection, data exfiltration, and unauthorized actions is a top priority.
I agree with all of it. But there is a blind spot in the conversation, and it happens to be the thing we think about every day.
Everyone is asking how to constrain what agents do. Almost nobody is asking where agents do it.
The Agent Problem Is an Architecture Problem
A traditional AI workload sits behind a human. A person types, a model responds, a person acts. If something goes wrong, the blast radius is one bad answer that a human catches.
An agentic workload has no such pause button. An agent plans, reasons, invokes tools, and executes multi-step workflows with minimal oversight. That is the whole point. It is also the risk.
When an agent with broad system access runs on infrastructure you do not control, in a jurisdiction that does not answer to your regulator, every governance control you designed becomes advisory. Your logs live somewhere you cannot compel. Your data boundaries are enforced by a contract, not by law.
You cannot audit your way out of the wrong architecture.
Residency Is Not Control
The usual answer from the big clouds is a region. Your data sits in Sydney, so you are sovereign, right?
We have covered this before, and the CLOUD Act agreement that came into force this year made the point sharper. A hyperscaler region on Australian soil is still a foreign legal entity that can be compelled by foreign courts. Data residency tells you where data rests. It says nothing about who can be forced to hand it over, or who controls the compute your agents run on.
For chat, that is a compliance footnote. For agents, it is the difference between a governance framework and a hope.
What Sovereign Actually Means for Agents
When we say SCX.ai is sovereign AI infrastructure, here is what that means in an agentic world, concretely.
The compute is ours. Australian legal entity, Australian jurisdiction, no foreign cloud in the middle. When your agent executes, the execution happens under Australian law.
The model layer is governed here. Which models run, how they are updated, what data they can touch: those decisions are made under your regulatory envelope, not shipped to you as a Terms of Service update.
The data path never leaves. Your agent's context, its tool calls, the documents it reads and writes: all of it stays on infrastructure where you can enforce, audit, and, if it ever comes to it, litigate.
That last point matters more than people realise. Agents generate enormous amounts of sensitive context. Every tool call, every file read, every intermediate reasoning step is a record of how your organisation thinks. If that context is flowing through someone else's platform, you have outsourced not just your compute but your institutional memory.
The Regulation Angle Cuts Both Ways
Australian regulators are moving. National consultation on AI infrastructure standards, mandatory guardrails, an Office for AI. The direction is unmistakable: obligations are coming for anyone operating AI on sensitive workloads, and the obligations will be enforced here.
For companies running agents on foreign infrastructure, that is a growing compliance headache. For companies running agents on sovereign infrastructure, most of those obligations are already satisfied by the architecture. The governance story is not a bolt-on. It is where the thing runs.
I have said before that regulation is runway for us. The agentic turn makes that truer. An agent that touches a bank's core systems or a hospital's records is exactly the kind of workload the new rules care about, and exactly the kind that cannot run on a platform a foreign court can reach into.
Practical Advice
If you are deploying agents this year, ask three questions of any infrastructure provider, including us.
First, what legal entity controls the compute my agents run on, and whose courts can reach it?
Second, can I see, on demand, every place my agent's context and data physically exist?
Third, when your governance framework changes, do I get a vote or just a notification?
If the answers make you uncomfortable, the security policies you wrote for your agents are decorating a risk you have not actually controlled.
The industry is finally taking agent security seriously. Good. Now let's take agent jurisdiction seriously too. That is the part we built SCX.ai for.
David Keane is the Founder and CEO of SCX.ai, Australia's sovereign AI infrastructure company.