Sovereignty comes not from all local or all cloud, but from deliberate routing.

A hybrid architecture does not assign a whole organisation to one place. It breaks work into steps and gives each the environment warranted by its data, capabilities and consequences.

Three zones make the architecture readable

Data custody, processing, generation, verification and approval need not happen in the same place — but their transitions must be visible and justified. A task may cross zones, never as an invisible bulk transfer.

01Controlled zoneSensitive raw data, identities, secrets. Reduces, anonymises and checks before any transfer.local / tightly controlled

02Protected work zoneApproved internal information. Drafts, analyses, structured intermediates.access + logging defined

03Open capability zonePublic, synthetic or sanitised material. Specialised capabilities flexibly.sanitised material only

01 · RoutingFive criteria, not intuition: sensitivity, capability, cost, latency and verifiability.

02 · FallbackThe replacement path keeps the same data and effect boundaries — less function, not a new data zone.

03 · PortabilityKeep the core outside single systems; adapters translate. Migration is a tested capability.

Core method

The routing card

Work step & effectWhat should be produced, what consequence may it have?

Data classPublic, internal, sensitive or controlled?

Capability needQuality, modality, tools, speed, context?

Zone & model roleWhere to preprocess, generate, verify, approve?

Hand-off & verificationWhich fields leave the zone, how is it checked?

Fallback & portabilitySafe substitute, which adapters enable migration?

Design a model path

Choose a process with three steps. Separate preprocessing, generation and approval, classify data, design zones and hand-offs, plan two safe fallbacks.