> Source: https://souverana.ch/insights/souveraene-ki-integration-en/
> Language: en

# Sovereign AI integration: when AI starts to act

The moment an AI agent writes in your systems, a mistake becomes an incident. Where agents are connected to your software, your IP (intellectual property) is built too. How to keep both under control.

Integration · Published 12 Jul 2026 · Updated 21 Oct 2026 · Joel Barmettler

## What integration means in AI

**The moment AI writes in your systems, a mistake becomes an incident. That happens at the integration layer: there you connect agents (AI programs that carry out tasks on their own) to your business software and start them from your applications. This is also where your most valuable own logic is built. Acting demands approval, logic demands portability.**

**In brief**

-   An agent that only reads does little harm when it errs. When it writes, for example to a database or a mail system, the error takes effect in operations immediately. Before dangerous actions it therefore needs approval, visible steps and an audit log that records every step.
-   At this layer most of the money flows, and your IP (intellectual property) is built, namely your own logic. Put it into MCP servers that you own and can take to any provider.
-   What you build in graphical no-code interfaces or on a provider’s runtime environment usually stays bound to that provider. The agent code you write yourself is often portable. Check how much of your own effort actually belongs to you.
-   An agent earns trust when you can see its steps and intervene. A black box, meaning a platform with invisible inner workings, does not offer that.

The preceding parts of this series on sovereign AI cover the model, data preparation and the platform, that is, data at rest and infrastructure. In integration, AI starts to act in your world. That acting runs as a loop, shown in the following graphic.

An agentic loop: the language model reasons, calls a tool via MCP, observes the result and reasons again until it answers. Two control points are marked: the approval gate before write actions, and the audit log that records every step.

An agentic process consists of a loop: reason, act, observe, reason again. There is no single answer. Each round can call a tool and thereby cause something to happen in your systems. This is where it is decided whether the AI becomes a useful colleague or a risk, and this is where the largest share of your investment sits.

This is the last part of our series on sovereign AI. It covers the layer where AI achieves the most and can do the most damage.

**Series · Sovereign AI**

1.  [What sovereign AI actually means for Swiss companies](https://souverana.ch/en/insights/was-ist-souveraene-ki/)
2.  [AI strategy for SMEs: the questions to answer first](https://souverana.ch/en/insights/ki-strategie-kmu/)
3.  [Sovereign AI infrastructure: why the model is the easy part](https://souverana.ch/en/insights/souveraene-ki-infrastruktur/)
4.  [Sovereign AI platform: why it binds more than the model](https://souverana.ch/en/insights/souveraene-ki-plattform/)
5.  Sovereign AI integration: when AI starts to act (this part)

## Building it yourself: the stages, and the question of portability

Almost every platform lets you create simple agents without code: write a prompt, upload files as knowledge, attach a few tools. That is the basic kit, and it is enough for a great deal. Whoever wants more needs their own logic in code, meaning an SDK (Software Development Kit, a software library for building agents), and above all the ability to feed that logic into the platform so that it runs there with the platform’s own permissions and knowledge.

Portability deserves a precise distinction, because marketing misleads on this point. The large providers have open-sourced their agent SDKs. The code you write is often portable. What stays bound is the runtime environment, meaning the provider’s service on which the agent runs, including login, knowledge connections and orchestration. Least portable of all are the graphical no-code interfaces. OpenAI discontinued its Agent Builder, launched only in 2025, a few months later, and by OpenAI’s own account the export does not fully carry over the flow. What you click together there does not durably belong to you.

At the other end stand the open platforms. In Open WebUI you write your own logic directly into the running platform using Pipelines and Functions, with almost no limits, self-hosted and in your own possession. In between sits Mistral. It is the only proprietary provider whose runtime can also run on your own infrastructure, and thus a sensible middle path for European requirements.

## Start with the MCP servers

There is a sequence that saves a great deal of lock-in. Start with the MCP servers, before your own agents. An MCP server connects an agent to one of your systems through an open standard, and it is vendor- independent: build it once and you can attach it to any compatible platform and take it with you. Whoever can build their own agents can build MCP themselves anyway, and a simple server is finished in a few days. If you do the integration work at this layer, the connection to your systems becomes portable IP that belongs to you. The platform above it becomes interchangeable.

There are two things worth knowing. First, “supports MCP” is not a clear statement. The standard has three building blocks (tools for actions, resources for data and prompts for templates), yet almost every platform supports only the tools. So ask which building blocks a platform actually handles, and whether it allows arbitrary servers of your own or only ones from its marketplace. Second, the reverse direction matters too. Your own software, your mail system and your CRM should be able to trigger agents. For that, a good platform exposes the agents as a secured interface that respects your access rules. For agents of different systems to work together, a dedicated open standard called A2A (Agent-to-Agent) is currently emerging.

## Why lock-in hits hardest here

This layer is where most of the money and the most valuable IP are built. Lock-in means that switching provider is so expensive that it no longer pays off. Whoever invests hundreds of thousands in their own agent tied to a proprietary platform faces a choice at every price rise: pay the higher price or write off the entire investment. Developing your own agents inside vendor-bound environments is considered the largest hidden driver of switching costs.

Architecture helps against this. Put the valuable logic where it belongs to you and stays portable: in your own MCP servers and, where possible, on an open platform that you operate yourself. If you use a proprietary platform, keep the platform’s own agent logic thin and shift as much as possible onto servers you can take with you.

## When AI starts to act

So far we have covered building. Now we turn to the acting itself, and that is where the real risk lies. As long as an agent only reads, a hallucination (an invented statement) is annoying. An agent that writes can cause something to happen in databases, in your mail and in your software, and a mistake becomes an incident. The examples are real. An AI agent from Replit deleted a production database in 2025 during an explicit code freeze (a halt on all changes to the code), fabricated data and claimed that recovery was impossible. Cursor’s support agent invented a company policy that did not exist, which led customers to cancel. And a manipulated public entry containing hidden instructions made an agent expose data from private projects through the GitHub MCP server. The researchers explicitly called that an architecture failure.

The pattern is always the same. An agent that is allowed to act and is trusted blindly causes more damage than one that only makes suggestions. An agent can report a task as done without having solved it.

## Trust comes from transparency and control

Trust in an agent rests on two things a platform must provide. The first is control. The platform submits dangerous write actions to a human for approval first (the human-in-the-loop pattern), while harmless read actions pass through automatically. On top of that comes the principle of least privilege: an agent sees only the tools it needs for its task, and read tools are kept separate from write tools.

Human in the loop: write actions stop at the approval gate until a human confirms them. That keeps risky actions under human oversight without slowing down every harmless query.

The second is transparency. You want to see every step the agent takes: every thought, every tool call, every result. Open-source tools exist for this that you can host yourself and that record the whole process. These include a complete audit log that records what the agent did. That lets you reconstruct afterwards why the agent acted as it did, and prove, in a serious incident, what it did.

The audit log records every pass through the loop. What matters for accountability is an unbroken trail of every step that led to the result.

## No surprises: you decide when things change

Control also means that the foundation of your agents does not change unnoticed. On a proprietary platform, the provider can change the model or the environment without changing the interface, and with it the behaviour of your agents. One documented case shows that this does happen:[1]

> **up to 16% of requests** In September 2025, Anthropic disclosed that three infrastructure bugs degraded Claude's quality over weeks with no change to the interface at all. Detection took as long as it did partly because the company's own privacy rules restricted access to the affected requests.
> 
> Source: Anthropic, postmortem of 17 September 2025

Even the most careful provider can quietly change how its service behaves, and from the outside it is barely visible. With open, fixed model weights (the parameters of the model) [that you operate yourself](https://souverana.ch/en/insights/llm-selbst-hosten/), you decide when something changes. A switch is then a deliberate decision that you test beforehand against your own test cases.

## No trust for a black box

All of this presupposes that you can understand how the platform works. A black box cannot be trusted in the long run, least of all when it acts in your name. The GitHub case shows this. The vulnerability could only be fixed because the interaction was open and inspectable. An open, self-operated platform is auditable from the ground up; a proprietary one stays opaque.

That brings control back to the platform layer. Whoever wants to keep control over what their agents do needs a platform underneath that shows its inner workings. The transparency that is a convenience at the platform layer becomes a precondition at the integration layer.

## What this means for your company

Integration is the layer where your AI creates value and where it can cause damage. Treat both with the same care. Build your IP for portability, in MCP servers that belong to you. Give an agent free rein only once you can see every one of its steps, approve dangerous actions and prove everything. At this layer, sovereignty means that nobody can take away your platform, your agents or your control over what they do.

Want to build your own agents and integrations that belong to you and stay under your control?

[AI Architecture & Solution Selection](https://souverana.ch/en/leistungen/ki-architektur/)

That completes the series: from the terms through strategy to the three layers of infrastructure, platform and integration.

## Sources

[1] Anthropic. «Postmortem vom 17. September 2025». Anthropic. 17 September 2025. Herstellerangabe, Primärquelle.

The author

Joel Barmettler

AI Architect · Souverana, Zurich

Joel Barmettler guides Swiss companies from AI strategy to integration: sovereign, confidential and production-ready. He built the Swiss AI Hub as its architect and today co-owns its architecture; he personally leads every Souverana mandate. Mandates from one-person firms to Fortune 500 corporations.

[Book an intro call](https://meet.brevo.com/joel-barmettler/30-minute-meeting) [More about Souverana](https://souverana.ch/en/) [LinkedIn](https://www.linkedin.com/in/joel-barmettler-b9ab361b7)

## Frequently asked questions

What is the integration layer in AI?

The layer where AI is connected to your systems and acts within them. It comprises your own agents, the connection to your business software (usually via MCP servers, an open interface for agents) and triggering the agents from your applications. At this layer AI writes in your systems for the first time, and your most valuable IP (intellectual property) is built.

What is an MCP server, and why does it matter for sovereignty?

An MCP server (Model Context Protocol) connects an AI agent to one of your systems through an open standard. It is vendor-independent. Build it once and you can attach it to any compatible platform and take it with you. Whoever does the integration work at the MCP layer builds portable IP (intellectual property) that they own and can take to another provider at any time.

How do you keep control over AI agents?

With four measures: you make every step the agent takes visible, you approve dangerous write actions manually first (human in the loop), you limit tools by the principle of least privilege (each agent receives only what it needs), and you keep a complete audit log that records all steps. All four measures require a platform whose inner workings you can inspect.

Why is the integration layer the biggest lock-in risk?

Lock-in means that switching provider becomes so expensive that it no longer pays off. At the integration layer most of the money and the most valuable IP (intellectual property) are built, namely in your own agents. Whoever invests hundreds of thousands in logic tied to a proprietary platform can no longer switch when prices rise. That is why the logic belongs in MCP servers that you own.

Should you build AI agents on a proprietary platform?

Only with caution. The code of modern agent SDKs (software libraries for building agents) is often portable; the runtime environment and the graphical no-code interfaces usually are not. On a proprietary platform, shift as much work as possible onto your own MCP servers, which you can migrate, and keep the logic inside the platform itself thin.

## Glossary

-   **MCP**: Model Context Protocol: an open standard through which AI tools access systems and data in a controlled way, with clear permissions per tool.
-   **Agentic**: AI applications that work in multiple steps, on their own: they plan, call tools and repeat steps until the task is done. In doing so they send the same context many times over.
-   **Prompt**: The input to a language model: question, instruction and any text sent along. What is in the prompt determines the answer and the cost.
-   **Hallucination**: A false statement that a language model phrases convincingly, such as an invented source or figure.
-   **Open source (AI)**: More than open weights: the training code and details of the training data are disclosed too, under a free licence. The Open Source Initiative published a definition for this in 2024. The Swiss Apertus model meets it; many models marketed as "open" only partially do.
-   **Parameters**: The learned numerical values of a language model. Their number describes its size: "8B" means eight billion parameters. Larger models can do more but need more GPU memory.