Tools are where residency can leak

A residency review often checks the model endpoint, confirms that it runs in-region, and stops there. The request that produced the answer may have taken a longer path.

Server-side tools are the common leak. A hosted web search, code interpreter, document parser, or managed retrieval service may run on global infrastructure while the nearby inference endpoint is regional. Prompt data travels in plaintext on that path, outside the jurisdiction, without appearing in the review.

Agents compound the problem. A dozen-hop trajectory contains a dozen transfer decisions, while framework retry logic usually prefers success over location.

Enforcement therefore needs a home that lasts longer than one request. A session or key carries the boundary, and individual calls inherit it. A tool that cannot run inside that boundary is refused, with the refusal recorded against the trajectory.

The audit question then changes. Rather than asking where inference ran, a reviewer asks which regions the run touched and receives a list that includes overlooked hops.