Sovereign AI integration: when AI starts to act

What integration means in AI

The moment AI writes in your systems, a mistake becomes an incident. That happens at the integration layer: there you connect agents (AI programmes that carry out tasks on their own) to your business software and start them from your applications. This is also where your most valuable own logic is built. Acting demands approval, logic demands portability.

In brief

• An agent that only reads does little harm when it errs. When it writes, for example to a database or a mail system, the error takes effect in operations immediately. Before dangerous actions it therefore needs an approval, visible steps and an audit log that records every step.
• At this layer most of the money flows, and your IP (intellectual property) is built, namely your own logic. Put it into MCP?MCPModel Context Protocol: an open standard through which AI tools access systems and data in a controlled way, with clear permissions per tool. servers (an open interface that connects an agent to a system) that you own and can take to any provider.
• The code of agent SDKs (software libraries for building agents) is often portable. The runtime environment an agent runs on, and graphical no-code interfaces, usually stay bound to the provider. Check how much of your own effort actually belongs to you.
• An agent earns trust when you can see its steps and intervene. A black box, meaning a platform with invisible inner workings, does not offer that.

The preceding parts of this series on sovereign AI cover the model, data preparation and the platform, that is, data at rest and infrastructure. In integration, AI starts to act in your world. That acting runs as a loop, shown in the following graphic.

An agentic?AgenticAI applications that work in multiple steps, on their own: they plan, call tools and repeat steps until the task is done. In doing so they send the same context many times over. process consists of a loop: reason, act, observe, reason again. There is no single answer. Each round can call a tool and thereby cause something to happen in your systems. This is where it is decided whether the AI becomes a useful colleague or a risk, and this is where the largest share of your investment sits.

This is the last part of our series on sovereign AI. It covers the layer where AI achieves the most and can do the most damage.

Building it yourself: the stages, and the question of portability

Almost every platform lets you create simple agents without code: write a prompt?PromptThe input to a language model: question, instruction and any text sent along. What is in the prompt determines the answer and the cost., upload files as knowledge, attach a few tools. That is the basic kit, and it is enough for a great deal. Whoever wants more needs their own logic in code, meaning an SDK (Software Development Kit, a software library for building agents), and above all the ability to feed that logic into the platform so that it runs there with the platform’s own permissions and knowledge.

Portability deserves a precise distinction here, because marketing misleads on this point. The large providers have open-sourced their agent SDKs. The code you write is often portable. What stays bound is the runtime environment, meaning the provider’s service on which the agent runs, including login, knowledge connections and orchestration. Least portable of all are the graphical no-code interfaces. OpenAI discontinued its Agent Builder, launched only in 2025, a few months later, and by OpenAI’s own account the export does not fully carry over the flow. What you click together there does not durably belong to you.

At the other end stand the open platforms. In Open WebUI you write your own logic directly into the running platform using Pipelines and Functions, with almost no limits, self-hosted and in your own possession. In between sits Mistral. It is the only proprietary provider whose runtime can also run on your own infrastructure, and thus a sensible middle path for European requirements.

Start with the MCP servers

There is a sequence that saves a great deal of lock-in. Start with the MCP servers, before your own agents. An MCP server connects an agent to one of your systems through an open standard, and it is vendor- independent: build it once and you can attach it to any compatible platform and take it with you. Whoever can build their own agents can build MCP themselves anyway, and a simple server is finished in a few days. If you do the integration work at this layer, the connection to your systems becomes portable IP that belongs to you. The platform above it becomes interchangeable.

There are two things worth knowing here. First, “supports MCP” is not a clear statement. The standard has three building blocks (tools for actions, resources for data and prompts for templates), yet almost every platform supports only the tools. So ask which building blocks a platform actually handles, and whether it allows arbitrary servers of your own or only ones from its marketplace. Second, the reverse direction is needed. Your own software, your mail system and your CRM should be able to trigger agents. For that, a good platform exposes the agents as a secured interface that respects your access rules. For agents of different systems to work together, a dedicated open standard called A2A (Agent-to-Agent) is currently emerging.

Why lock-in hits hardest here

This layer is where most of the money and the most valuable IP are built. Lock-in means that switching provider is so expensive that it no longer pays off. Whoever invests hundreds of thousands in their own agent tied to a proprietary platform faces a choice at every price rise: pay the higher price or write off the entire investment. That makes switching uneconomical. Developing your own agents inside vendor-bound environments is considered the largest hidden driver of switching costs.

Architecture helps against this. Put the valuable logic where it belongs to you and stays portable: in your own MCP servers and, where possible, on an open platform that you operate yourself. If you use a proprietary platform, keep the platform’s own agent logic thin and shift as much as possible onto servers you can take with you.

When AI starts to act

So far this has been about building. Now it is about the acting itself, and that is where the real risk lies. As long as an agent only reads, a hallucination?HallucinationA false statement that a language model phrases convincingly, such as an invented source or figure. (an invented statement) is annoying. An agent that writes can cause something to happen in databases, in your mail and in your software, and a mistake becomes an incident. The examples are real. An AI agent from Replit deleted a production database in 2025 during an explicit code freeze (a halt on all changes to the code), fabricated data and claimed that recovery was impossible. Cursor’s support agent invented a company policy that did not exist, which led customers to cancel. And a manipulated public entry containing hidden instructions made an agent expose data from private projects through the GitHub MCP server. The researchers explicitly called that an architecture failure.

The pattern is always the same. An agent that is allowed to act and is trusted blindly causes more damage than one that only makes suggestions. An agent can report a task as done without having solved it.

Trust comes from transparency and control

Trust in an agent rests on two things a platform must provide. The first is control. The platform first puts dangerous write actions to a human for approval (the human-in-the-loop pattern), while harmless read actions pass through automatically. On top of that comes the principle of least privilege: an agent sees only the tools it needs for its task, and read tools are kept separate from write tools.

The second is transparency. You want to see every step the agent takes: every thought, every tool call, every result. Open-source?Open source (AI)More than open weights: the training code and details of the training data are disclosed too, under a free licence. The Open Source Initiative published a definition for this in 2024. The Swiss Apertus model meets it; many models marketed as "open" only partially do. tools exist for this that you can host yourself and that record the whole process. These include a complete audit log that records what the agent did. That lets you reconstruct afterwards why the agent acted as it did, and prove, in a serious incident, what it did.

No surprises: you decide when things change

Control also means that the foundation of your agents does not change unnoticed. On a proprietary platform, the provider can change the model or the environment without changing the interface, and with it the behaviour of your agents. One documented case shows that this does happen:

Key figure

up to 16% of requests

Source: Anthropic, postmortem of 17 September 2025

Even the most careful provider can quietly change how its service behaves, and from the outside it is barely visible. With open, fixed model weights (the parameters?ParametersThe learned numerical values of a language model. Their number describes its size: "8B" means eight billion parameters. Larger models can do more but need more GPU memory. of the model) that you operate yourself↗Local Inference · Part 1Self-hosting an LLM: GPT-5 performance for CHF 8’500A machine with two graphics cards (RTX 4090), around CHF 8’500, three weeks of measurements. Which tasks a machine of your own handles, which it does not, and where the limit sits.Read article, you decide when something changes. A switch is then a deliberate decision that you test beforehand against your own test cases.

No trust for a black box

All of this presupposes that you can understand how the platform works. A black box cannot be trusted in the long run, least of all when it acts in your name. The GitHub case shows this. The vulnerability could only be fixed because the interaction was open and inspectable. An open, self-operated platform is auditable from the ground up; a proprietary one stays opaque.

That brings control back to the platform layer. Whoever wants to keep control over what their agents do needs a platform underneath that shows its inner workings. The transparency that is a convenience at the platform layer becomes a precondition at the integration layer.

What this means for your company

Integration is the layer where your AI creates value and where it can cause damage. Treat both with the same care. Build your IP for portability, in MCP servers that belong to you. And only give an agent free rein once you can see every one of its steps, approve dangerous actions and prove everything. At this layer, sovereignty means that nobody can take away your platform, your agents or your control over what they do.

That completes the series: from the terms through strategy to the three layers of infrastructure, platform and integration.

Is your AI agent allowed to write in your systems, or only to read?

The difference is bigger than it sounds. The moment AI writes, a mistake becomes an incident. In 2025, an agent from the provider Replit deleted a production database during an explicit code freeze, and a manipulated public entry made an agent expose data from private projects through an MCP server (an open interface that connects agents to systems). The researchers explicitly called that an architecture failure.

Where agents are connected to your software, your most expensive own IP (intellectual property) is built too, and with it the hardest lock-in to a provider. How portable it stays depends on where you build it. Your own MCP servers travel with you anywhere, a graphical no-code interface travels nowhere. OpenAI's Agent Builder shows this: launched in 2025, discontinued a few months later.

Our conclusion: build the logic where it belongs to you, and only give an agent free rein once you can see every step, approve dangerous actions and prove what happened.

The article covers the agentic loop with its two control points, three real incidents as warning patterns, and eight control questions for your own agents. Link in the comments.

#AI #MCP #AIAgents #DataSovereignty