Sovereign AI agents, by architecture.

Most "sovereign cloud" offerings are a contract on top of someone else's control plane. MAQPNA takes the opposite approach: every component runs on infrastructure you choose, makes no outbound calls you didn't configure, and can be installed and operated without internet access.

Three kinds of sovereignty

SovereigntyPolicy

A single cluster-scoped SovereigntyPolicy named default sets the rules every AgentSession is admitted against. In enforce mode non-compliant sessions are rejected; in audit mode they run but each violation is recorded.

apiVersion: maqpna.com/v1alpha1
kind: SovereigntyPolicy
metadata:
  name: default
spec:
  jurisdiction: "EU"
  allowedJurisdictions: ["EU", "EU-DE"]
  allowedRegistries: ["registry.eu.internal:5000/"]
  allowedEgressHosts: ["*.tools.eu.internal"]
  allowedEgressCIDRs: ["10.20.0.0/16"]
  requireAttestationFor: ["confidential"]
  keyCustody: pkcs11          # file | pkcs11 | kms
  telemetry: "off"
  auditRetentionDays: 3650
  enforcement: enforce        # enforce | audit

The Helm chart renders this object from the sovereignty: block of values.yaml; the values-sovereign-eu.yaml profile is a complete starting point.

Attestation-gated secrets

For the confidential tier, a session's identity is a secret that must only reach genuine, unmodified guests. The flow:

1. The operator injects the maqpna-attest-agent init container into tier-2 sandboxes.
2. Inside the confidential VM, it collects hardware evidence (an SEV-SNP or TDX report bound to a fresh nonce).
3. The maqpna-attest service has the evidence appraised by a Confidential Containers Trustee attestation service and checks the result against your reference values (allowed launch measurements, minimum security version, debug disallowed). It is fail-closed: without verifier keys it does not start.
4. Only on success does the identity broker mint the session identity. No evidence, no identity, no tool access.

Because the gateway accepts tool calls only with a valid session identity, attestation becomes a hard precondition for touching any tool or data source.

Customer-held keys

The identity broker signs session identities (Ed25519). Key custody is explicit:

• file — a key you provision into a Kubernetes Secret (development and small installs).
• pkcs11 — keys in a hardware security module you operate.
• kms — keys in a key-management service in your jurisdiction.

The gateway verifies identities using the broker's public JWKS. Rotating or revoking the key is your decision alone.

Zero phone-home

MAQPNA makes no outbound calls by default: no telemetry, no usage analytics, no update checks, no licence validation. The only outbound connections are the ones you configure — upstream tool servers, a Trustee endpoint, a WORM audit bucket — and the gateway enforces allowedEgressHosts / allowedEgressCIDRs on those too. Agent sandboxes start with default-deny egress and can reach only cluster DNS and the gateway.

Air-gapped installation

On a connected build host, hack/airgap-bundle.sh produces a single tarball with every MAQPNA image, the upstream agent-sandbox manifest and images, the Helm chart, SPDX SBOMs and a SHA256SUMS file signed with cosign. Inside the disconnected environment, hack/airgap-install.sh verifies it, mirrors the images into your private registry and installs the chart with the sovereign profile:

# connected side
REGISTRY=ghcr.io/maqpna TAG=v0.1.0 COSIGN_KEY=pkcs11:... hack/airgap-bundle.sh

# disconnected side
tar xzf maqpna-airgap-v0.1.0.tar.gz && cd maqpna-airgap-v0.1.0
REGISTRY=registry.eu.internal:5000/maqpna COSIGN_PUB=cosign.pub \
  EXTRA_VALUES=site-overrides.yaml hack/airgap-install.sh

Audit evidence

Every gateway decision — allowed, denied, rate-limited or held for approval — is written as a hash-chained record containing the session, its identity and trust tier, the tool, a digest of the arguments, the matching policy rule and the outcome. Records can be shipped to S3-compatible storage with Object Lock (for example an in-country MinIO cluster) for write-once retention aligned with auditRetentionDays.

Release artifacts are signed with Sigstore cosign and ship with SPDX SBOMs and build provenance, so you can verify exactly what you run.

EU AI Act & Cyber Resilience Act

MAQPNA is infrastructure, not a compliance programme — but it produces the kind of evidence those programmes need:

• Record-keeping and traceability — tamper-evident logs of what each agent did, with which identity, under which policy.
• Human oversight — require_approval rules put a person in the loop for high-impact tools.
• Supply-chain transparency — SBOMs, signatures and provenance for every image.
• Security by default — default-deny networking, hardened non-root containers, isolation tiers matched to risk.

What we don't claim

We don't claim certifications we don't hold, and installing MAQPNA does not by itself make a system compliant with any regulation. Confidential computing protects data in use from the host, within the limits of the hardware vendor's trust model. Sovereignty ultimately depends on where you run the cluster, who operates it and who controls the keys — MAQPNA is designed so that all three can be you.

Planning a sovereign deployment? Write to [email protected] — we're happy to walk through your requirements.