One sovereign cluster, many tenants — ministries, institutions, and programs — sharing hardware without sharing trust. Isolation is enforced in hardware and namespace; fairness is enforced by quota and policy.
A shared cluster is only sovereign-grade if a tenant cannot observe, reach, or influence another tenant's data or workloads.
Every workload, dataset, and key is bound to a named tenant, and no operation crosses that boundary without an explicit, logged grant. The tenant is the unit of authorization, quota, and audit throughout the stack.
Tenants are treated as mutually untrusting even when they belong to the same government, so isolation does not depend on organizational goodwill. A compromise or misbehavior in one tenant does not extend to another.
Each tenant holds its own keys and, where applicable, its own model weights; the platform operator schedules the hardware but cannot read tenant material. Custody is separated from operation by design.
Tenant data placement is constrained to the jurisdictions each tenant is permitted, so a shared cluster still honors distinct residency obligations. Physical location is a scheduling constraint, not an afterthought.
Compute, memory, storage, and network are each partitioned so a tenant's blast radius ends at its own boundary.
GPUs are assigned whole or as hardware-isolated partitions so tenants do not share accelerator memory or execution context. A tenant cannot read residual state from the workload that ran before it.
On the inference plane, tenants are separated by namespace with default-deny network policy, so pods reach only the services their tenant explicitly exposes. Lateral movement between tenants has no default path.
Each tenant's datasets and checkpoints live in access-controlled storage domains keyed to that tenant, with no shared mount surface. Data at rest is separated and independently encrypted.
Tenant and workload identities are asserted with ML-DSA-65 signatures, so authentication between tenant, scheduler, and services is resistant to future cryptographic attack. Identity holds up over the multi-decade horizon of sovereign infrastructure.
On sovereign infrastructure the audit trail is part of the product — who accessed what, on whose authority, is always answerable.
Access control is scoped inside each tenant, so an administrator in one tenant holds no rights in another. Privilege is granted narrowly and never inherited across the boundary.
When two tenants deliberately share a dataset or model, the grant is explicit, time-bounded, and revocable rather than implicit. Collaboration is possible but always intentional and logged.
Every authorization decision and cross-tenant access is written to a hash-chained log, giving each tenant a verifiable record of who touched its material. The record cannot be altered after the fact without detection.
Consumption, cost, and residency compliance are reported per tenant, so each owner sees exactly what it used and where. Shared infrastructure remains individually accountable.