AI sovereignty: when assistance becomes dependence

I use other people's AI every day. That alone doesn't make me dependent. Dependence begins when the system becomes necessary to do my work and I can no longer meaningfully check its answers, refuse its recommendations or replace it without losing what I've built around it.

I don't think there is one universal percentage of AI use after which I lose autonomy. The cutoff is practical: if a provider vanished tomorrow, could I keep working within a tolerable time? If an answer sounded wrong, could I examine the evidence or reach a different source? If the product changed its rules, could I take my work somewhere else? Research on AI sovereignty calls the realistic alternative to total independence managed interdependence: reducing risk through choices about who supplies the parts of the stack.¹

Dependence has more than one shape

Operational dependence is the obvious one. I can't work if the service is down, prices change or an account is suspended. A backup model that exists only as a name on a list isn't a fallback; I need the data, tools and time to switch to it.

Swipe diagram to explore →

Information dependence is quieter. If an assistant becomes my only path to articles, documentation and people with contrary views, it can narrow what I even consider. Work on algorithmic information gatekeeping examines the consequences of letting systems mediate access to knowledge.² I still ask assistants questions. Sometimes the answer should start an investigation instead of ending one.

Swipe diagram to explore →

Decision dependence is subtler still. I may retain the final "approve" button while losing the ability to judge the options I'm shown. A survey of knowledge workers found that higher confidence in generative AI was associated with less reported critical thinking in AI-assisted work; it did not establish that AI inevitably makes people worse thinkers.³ The uncomfortable test for me is whether I can explain why I accepted an answer after the tool is closed.

Swipe diagram to explore →

There is also adaptation dependence. My prompts, corrections, working memory and integrations accumulate inside a product, but I may have little say in how that product changes. Exporting a chat history is not the same as moving an operating system for my work.

Where the model runs matters, but it isn't the whole answer

Running a model on my own machine gives me more control over access, updates and where inference happens. Hosting it on a server I administer gives me some of the same choices, although a rented server still has an operator. Using a proprietary hosted model trades some of that control for a service that may be easier to use or more capable at a particular job.

These arrangements aren't clean opposites. A local app can quietly send requests to remote services. An open-weight model can run on rented hardware. Access to model weights makes independent testing and adaptation possible, but does not by itself make the training data or embedded biases auditable.¹

I care about being able to keep using a version that works and, where the terms and weights permit it, change the model's behavior. Research on refusal behavior shows that some learned model behavior can be modified; that doesn't mean any model can be made accurate, unbiased or safe with one edit.⁴ I would still need evaluations, limits on actions and a way to notice when I'd made things worse.

The harness is where much of my control lives

The harness is everything around the model: which information it sees, which tools it can call, where memory sits, whose credentials it uses and who authorizes an action. A provider can host a powerful model without owning my mailbox tokens or deciding what gets sent from my machine. Conversely, a vendor-controlled agent with my accounts connected may make many useful decisions I can't easily inspect or change.

The distinction is concrete. I can keep credentials and action permissions in software I control, use a remote model for a selected question, and require a separate approval before sending an email. The content sent for remote inference still leaves my machine; holding the password locally doesn't make the inference private. If I need the whole process to stay local, I must check the model, embeddings, logs and any other networked components too.

Swipe diagram to explore →

I want memory I can inspect and correct; defaults I can edit; narrow, revocable account permissions; and a record of what the assistant actually did. I want "read," "draft," "send" and "delete" to be different powers, enforced outside the model. Prompt-injection research shows why: malicious content returned from external tools can try to redirect an agent toward actions the user never requested.⁵

Owning the harness also lets me improve it. I can change a retrieval step, test a new approval rule or swap a model without surrendering every other part of the workflow. Studies of agent interfaces and memory-backed feedback support the idea that the surrounding system changes what an agent can accomplish; neither proves that any particular harness edit will help.⁶⁷

Swipe diagram to explore →

Keep an exit that works

My test for sovereignty is deliberately ordinary. Can I take my notes, source material and workflows elsewhere? Can I still reach primary evidence? Can I run or replace the essential parts before an outage becomes a crisis? Can I tell an agent "no" and know that the action gate will hold?

At the end of that list is my usage data. If I own the records of my corrections and successful work, I may be able to curate them for future personalization or fine-tuning. A LoRA adapter is one possible technique, not the definition of sovereignty, and raw conversations are not automatically a good training set.⁸ I'd keep that option available without letting it distract me from the more urgent controls: continuity, independent judgment, memory, credentials and actions.

I don't need to own every transistor in the stack. I need enough control to keep working, challenge what I'm told and walk away when I have to.

Sources

1. Is AI sovereignty possible? Balancing autonomy and interdependence (Tanner et al., Brookings, 2026)
2. Negative consequences of information gatekeeping through algorithmic technologies (Potnis, Tahamtan and McDonald, JASIST, 2025)
3. The Impact of Generative AI on Critical Thinking (Lee et al., CHI 2025)
4. Refusal in Language Models Is Mediated by a Single Direction (Arditi et al., NeurIPS 2024)
5. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (Debenedetti et al., NeurIPS 2024)
6. SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering (Yang et al., 2024)
7. Reflexion: Language Agents with Verbal Reinforcement Learning (Shinn et al., NeurIPS 2023)
8. LoRA: Low-Rank Adaptation of Large Language Models (Hu et al., 2021)