Guides
Enforce a sovereignty floor
A step-by-step setup for a regulated workload — workspace Reach policy, a dedicated router, tests that prove refusal, and the request log as evidence.
The requirement usually reads: inference for this workload must not be subject to third-country disclosure, and you must show it per request. That is two jobs: stop the traffic, then prove it stopped.
The layers
| Layer | Where | Applies to |
|---|---|---|
| Workspace floor, region, ZDR, no training | Your workspace → Govern → Key policies → Reach | Every request, routed or pinned |
| Blocked provider countries | Your workspace → Connect → Routers (default router settings) | The workspace |
| Blocked Inference Providers | Your workspace → Govern → Key policies → Reach | Every request on every surface; a pinned or named request is refused with provider_blocked |
| Router floor, region, ZDR, no training, allowed models | Your workspace → Connect → Routers → a named router | Requests to that router |
X-Stav-Sovereignty-Level + request log | Response, Your workspace → Monitor → Request log | Every request |
Settings only tighten. A router can never loosen the workspace.
Step 1 — Pick the level
| Requirement | Floor |
|---|---|
| Inference on EU/EEA soil | L1 |
| Plus certified EU/EEA operation | L2 |
| No third-country control of the operator | L3 |
| Full sovereignty | L4 |
Most regulated work lands on L3. See Sovereignty. Check for what is available at that level before you commit to it in a contract.