Agentic AI has quietly broken a lot of assumptions that data governance teams spent the last decade building. When an application was a monolith talking to a regional database, "data residency" meant picking the right Cloud SQL instance and locking down an Organization Policy. When that application becomes an agent with a tool-calling loop — pulling a document from Google Drive, hitting a CRM connector, invoking a code execution sandbox, calling out to a partner API every one of those tool calls is a new data egress path, and potentially a new jurisdiction.

The Model Context Protocol (MCP) has become the de facto way agents discover and invoke tools. That's good news for interoperability. It's a harder problem for sovereignty, because MCP servers are, by design, pluggable and location-agnostic — a tool can live anywhere, and the agent doesn't inherently know or care where "anywhere" is. If you're running a multi-region stack on Google Cloud and you have regulatory obligations (GDPR, India's DPDP Act, sector rules like HIPAA or financial services residency mandates), you can't treat MCP tool invocation as a black box. It has to be a policy-enforced boundary, the same way network egress or IAM already is.