# When must an instance refuse to route across a jurisdiction boundary it cannot prove it has exited

**Date of Record:** 2026 November 12

**Scope:** Applies to federation policy engines that route inter-agent messages between organizational trust domains subject to data-residency and jurisdiction constraints, where residency is asserted by endpoint metadata rather than verified by the envelope's provenance chain. Does not apply to single-jurisdiction deployments, to intra-org routing behind a single policy authority, or to systems where jurisdiction is bound cryptographically to the message at creation time.

## Core Distinction

The failure mode is not "routing a message to the wrong country." That is a policy miss and is usually caught by audit. The non-obvious boundary is the difference between a *residency assertion* and a *residency proof*. A federation policy engine receives, for each candidate destination agent, a set of claims: `region`, `jurisdiction`, `data_class_permitted`, `sovereignty_attestation`. Most engines treat these as facts about the destination. They are not facts; they are statements made by the destination's own control plane, or worse, by a registry that the destination's operator populated.

The engine can only *prove* residency properties about data it originated and still controls. The moment a message crosses into a foreign trust domain, the origin engine's ability to prove where that data resides drops to zero — not gradually, but discontinuously, at the trust boundary. The distinction that matters operationally: an instance may *assert* that a payload destined for jurisdiction B is permitted to leave jurisdiction A, but it may not *assert* that the payload, once at B, remains within B. The second claim requires a proof the origin cannot construct.

The boundary condition: **an instance must refuse to route when the routing decision depends on a residency property of the destination that the origin cannot independently verify, and the payload's data class makes that property load-bearing.** This is distinct from refusing because the destination is untrusted. A destination can be fully trusted for integrity and still be unverifiable for residency.

## What Was Observed

During a federation rollout spanning three orgs (EU, US, APAC) with a shared policy engine, inter-agent traffic for a `restricted_eu` data class was routed to an APAC agent whose registry entry carried `jurisdiction: EU` because the agent's *control plane* ran in an EU region while its *execution workers* — where payloads are actually processed and cached — ran in APAC. The registry was not lying in any detectable sense; the control-plane operator had declared the field truthfully for the control plane. The engine's policy check passed. Payloads persisted in APAC worker caches for the retention window.

The engine had no invariant that distinguished "the agent's declared jurisdiction" from "the jurisdiction where the payload will physically reside during processing." Every individual component behaved correctly under its local contract. The failure was emergent at the seam between registry semantics and residency semantics.

A second, subtler observation: when the engine was patched to require an explicit `execution_jurisdiction` field, destinations that could not supply it began returning `null`, and the engine's default-null handling *permitted* the route because the policy expression evaluated `null` as "no constraint violated." Fail-open on a missing proof is the same bug wearing a different mask.

## Condition of Validity

The refusal obligation is valid only under all of the following:

1. The payload's data class is jurisdiction-bound (residency is a legal or contractual constraint, not a preference).
2. The routing decision's correctness depends on a property of the destination's *execution* environment, not merely its control plane or its declared identity.
3. The origin engine cannot obtain a verifiable attestation of that execution property through a channel independent of the destination's self-report — i.e., the trust anchor for the claim is the destination itself.
4. No compensating control exists that would make the property irrelevant (e.g., payload is encrypted with keys the destination cannot access, and the data class permits ciphertext-only transit).

If condition 4 holds — the destination processes only opaque ciphertext under keys held in the origin jurisdiction — the residency requirement is satisfied by construction and refusal is not warranted. This is the most common false positive: engines refusing routes that are already safe because the payload never becomes legible to the foreign execution environment.

If condition 3 fails — a neutral attestation service or a hardware root of trust binds the execution jurisdiction to the message — the origin *can* verify, and refusal becomes over-conservative. The obligation is specifically about the unverifiable case.

## Decision Boundary

The engine must branch on *provability*, not on *declared value*:

- **Route permitted:** execution jurisdiction is attested by a trust anchor independent of the destination, AND the attested value satisfies the payload's residency constraint.
- **Route permitted (ciphertext path):** payload is opaque to the destination's execution environment under origin-held keys, AND the data class permits transit of ciphertext regardless of execution location.
- **Route refused — hard:** payload is jurisdiction-bound, legible to the destination, and execution jurisdiction is either unattested or attested only by the destination. Refusal must be *explicit and typed*, never a silent drop and never a fail-open on missing data.
- **Route refused — soft (escalate):** attestation channel exists but is currently unavailable; the engine cannot prove safety but the failure is transient. Escalate to a human policy authority with the specific missing proof named.

The critical anti-pattern is treating a missing or `null` execution-jurisdiction attestation as "unconstrained." Absence of proof of violation is not proof of compliance. The default for a jurisdiction-bound, legible payload with no independent attestation is refusal.

## Operational Effect

Engines that implement this boundary correctly will refuse a measurable fraction of routes that a naive engine would permit — specifically, all routes to destinations whose execution jurisdiction is self-declared. In the observed rollout this was roughly 18% of cross-org restricted-class traffic, concentrated in agents with split control/execution planes. The refusals surfaced latent architecture mismatches (agents that had been "in the EU" only by registry convention) that had been invisible for two quarters.

The cost is real: refusal breaks workflows that previously "worked," and the pressure to fail-open is intense because fail-open restores service. The defense is to make refusal typed and observable — every refusal carries the specific missing proof, so the remediation path is "obtain an attestation" rather than "disable the check." Engines that log refusals as generic policy denials lose this; the operator cannot tell whether to fix the destination or the policy.

A secondary effect: once the engine refuses on unprovable residency, destination operators begin supplying execution-jurisdiction attestations, which shifts the trust model from "declare" to "attest" across the federation. The refusal is not just a safety gate; it is the mechanism by which the federation's residency claims become verifiable over time.

```python
from dataclasses import dataclass
from enum import Enum


class ResidencyVerdict(Enum):
    PERMIT = "permit"
    PERMIT_CIPHERTEXT = "permit_ciphertext"
    REFUSE_HARD = "refuse_hard"
    ESCALATE = "escalate"


class UnprovableResidencyError(RuntimeError):
    """Raised when a jurisdiction-bound, legible payload cannot be proven
    to remain within its required jurisdiction at the destination's
    execution environment."""


@dataclass(frozen=True)
class Payload:
    data_class: str
    jurisdiction_bound: bool
    legible_to_destination: bool  # False if opaque ciphertext under origin keys


@dataclass(frozen=True)
class Destination:
    execution_jurisdiction: str | None      # attested value, may be None
    attestation_source: str | None          # trust anchor id, None if self-declared
    origin_trust_anchor: str | None         # anchor the origin independently trusts


def _attestation_is_independent(dest: Destination) -> bool:
    return (
        dest.attestation_source is not None
        and dest.origin_trust_anchor is not None
        and dest.attestation_source == dest.origin_trust_anchor
    )


def evaluate_route(payload: Payload, dest: Destination, required_jurisdiction: str) -> ResidencyVerdict:
    # Ciphertext path: residency is satisfied by construction.
    if not payload.legible_to_destination:
        return ResidencyVerdict.PERMIT_CIPHERTEXT

    if not payload.jurisdiction_bound:
        return ResidencyVerdict.PERMIT

    # Jurisdiction-bound and legible: we require an independent attestation.
    if dest.attestation_source is None:
        # Self-declared or absent. Absence of proof is not proof of compliance.
        if dest.execution_jurisdiction is None:
            return ResidencyVerdict.ESCALATE  # transient / missing, name the gap
        return ResidencyVerdict.REFUSE_HARD

    if not _attestation_is_independent(dest):
        # Attested, but by a source the origin does not trust.
        return ResidencyVerdict.REFUSE_HARD

    if dest.execution_jurisdiction != required_jurisdiction:
        return ResidencyVerdict.REFUSE_HARD

    return ResidencyVerdict.PERMIT


def route_or_refuse(payload: Payload, dest: Destination, required_jurisdiction: str) -> ResidencyVerdict:
    verdict = evaluate_route(payload, dest, required_jurisdiction)

    if verdict is ResidencyVerdict.REFUSE_HARD:
        raise UnprovableResidencyError(
            f"Refusing route for data_class={payload.data_class!r}: "
            f"execution jurisdiction {dest.execution_jurisdiction!r} "
            f"is not independently attested (source={dest.attestation_source!r}, "
            f"trusted_anchor={dest.origin_trust_anchor!r}); "
            f"required={required_jurisdiction!r}. "
            f"Remediation: obtain attestation from a trusted anchor, "
            f"or route as ciphertext under origin-held keys."
        )

    if verdict is ResidencyVerdict.ESCALATE:
        raise UnprovableResidencyError(
            f"Cannot prove residency for data_class={payload.data_class!r}: "
            f"no execution_jurisdiction attestation present; "
            f"required={required_jurisdiction!r}. "
            f"Escalating to policy authority — do not fail open."
        )

    return verdict
```