Europe and Asia want AI they control. Governments and enterprises are pushing for models and infrastructure that run locally, under local rules. But putting GPUs in-country doesn't answer the harder question: who controls what happens to the data, the models, and the agents running on them?
F5 is working on that problem with NVIDIA and two telecom operators, Telenor in Norway and Indosat Ooredoo Hutchison in Indonesia. I asked Ahmed Guetari, senior vice president of product management for service providers at F5, how the pieces fit together and what developers and architects should do now.
Residency is location. Sovereignty is control.
Guetari draws a clear line between the two.
"Data residency is about where data sits. Sovereignty is about who controls what happens to it," he said.
For a platform team, that means controlling where AI traffic goes, which models can process it, who can access it, how tenants are isolated, and how those policies are audited and enforced. In short: "Residency is where AI runs and where data sits. Sovereignty is who controls it."
That framing matters for anyone building on sovereign AI infrastructure. A local data center is a starting point, not a finish line.
Agents need enforcement they can't bypass
NVIDIA introduced OpenShell at GTC 2026 as part of its Agent Toolkit. It's an open-source runtime that sandboxes agents and controls what they can see, what they can do, and where inference goes.
F5's role in the new OpenShell reference architecture sits around that runtime. F5 AI Guardrails inspect supported prompts, responses, and tool calls. F5 BIG-IP Next for Kubernetes (BNK) handles traffic management from Layer 3/4 through Layer 7.
Guetari explained the split this way: "While OpenShell governs what an agent may intend, BNK governs what it may actually do on the network, at the only chokepoint neither the agent, nor an attacker who compromises it, can avoid: the wire."
The risk customers worry about most isn't a rogue agent. It's "a legitimate agent doing something the enterprise never intended," especially when it can reach tools, APIs, files, and external endpoints. That's why Guetari argues security has to combine permissions, inspection, and network enforcement rather than trusting the agent to police itself.
BNK 2.4 adds identity-aware security for agent traffic. For Model Context Protocol (MCP) and Agent2Agent (A2A) interactions, BNK can validate OIDC/JWT identity claims at ingress, before a request reaches an agent, tool, or enterprise service. Then it applies policy to what that identity is allowed to reach. For example, a specific agent identity can reach an approved MCP server, while other identities are blocked. BNK also adds egress and cross-namespace policy controls around those workloads.
The pattern looks something like this. This is illustrative pseudocode, not BNK configuration syntax:
identity: agent "invoice-reconciler" (verified JWT, issuer = corp IdP)
allow: mcp://erp-tools.internal (read-only tools)
deny: all other MCP servers
egress: no external endpoints
"If an agent is compromised or behaves unexpectedly, it shouldn't get unrestricted access simply because it can generate a valid network request," Guetari said.
Why enforce on the DPU
F5 runs this enforcement on NVIDIA BlueField DPUs instead of in software on the host. Guetari gave two reasons: stronger Zero Trust isolation and better infrastructure efficiency.
"The DPU creates an enforcement point the workload doesn't control," he said. BlueField provides a hardware-isolated domain for identity, policy, and multi-tenant isolation that doesn't depend on the host. It also moves networking and some security processing off host CPUs, leaving that compute for AI applications.
There are performance numbers, too. Keep the context in mind: both come from F5-sponsored testing or F5's own lab.
- Tolly Group (March 2026, commissioned by F5): On a Llama 3.1 70B cluster with half the GPUs artificially pre-loaded, BNK on DPU cut time to first token (TTFT) by about 61% compared with HAProxy, roughly 14.0 seconds versus 35.8 seconds. Throughput was about 40% higher. BNK used about 2 host CPU cores, compared with roughly 12 for HAProxy.
- ServeTheHome (October 2026, F5 lab tour): Running Qwen3-32B on H100 servers, BNK and an Envoy-based AI gateway performed similarly at lighter loads. Under heavy, oversubscribed load, BNK delivered up to 3.24x the performance. The reviewer noted that figure is near the top of what they saw.
The takeaway for architects: GPU-aware load balancing matters most when clusters are busy. That's also when GPUs are most expensive to waste.
Telenor: a sovereign service plane
Telenor's AI Factory serves Norwegian and European organizations that need tight control over where AI data is processed, stored, and accessed. Guetari described the division of labor simply.
"Telenor provides the sovereign AI service. NVIDIA provides accelerated AI infrastructure. F5 provides the service plane controlling how that infrastructure is consumed."
BNK runs on BlueField and provides traffic control, tenant isolation, policy, and telemetry per request, per tenant, and per model. Guetari was careful to separate what's live from what's next. Token-aware governance and more advanced inference optimization are planned extensions, not deployed capabilities.
Indosat: governed access to 300+ models
The Indosat Intelligence Suite puts more than 300 open and closed models behind one interface, including Indosat's Sahabat-AI family, Indosat-hosted models, and connected global models.
Guetari said every AI request raises three questions: Which model should handle it? Which infrastructure should serve it? Is the interaction safe?
Routing can weigh cost, quality, residency, and latency. BNK handles GPU-aware load balancing. F5 AI Security protects against OWASP Top 10 LLM threats and data leakage. Sovereignty policies can decide which workloads stay on Sahabat-AI or other local models and which can reach global ones.
Cost governance is built in. Tokens convert into credits that can be allocated across models, applications, and teams. A CIO can set a company budget and split it across business units, and each team can see and control its own spending in real time.
"Observability tells you what AI cost," Guetari said. "Governance lets you control the cost before it happens."
Europe and Asia start in different places
In Europe, Guetari said, sovereignty usually starts as a control requirement, and the definition varies by operator. Orange, for example, prefers the word "trust." In Asia, control matters too, but sovereignty is also a way to make AI locally relevant and affordable. The Telenor and Indosat projects reflect that difference.
Three mistakes in moving agents to production
Guetari sees teams make the same three mistakes:
- They secure the model, but not the agent. The agent's scope and the network it runs on go unprotected.
- They trust controls inside the workload's own boundary. Zero Trust requires enforcement outside it, ideally isolated in hardware.
- They measure AI consumption but don't govern it.
"Pilots prove functionality," he said. "Production requires security, isolation, auditability and predictable economics."
What to do now
His advice for developers and architects: build around control points, not around today's model. Make policy portable, not model-specific.
Models, agents, and clouds will change. Your policies for identity, data, egress, model access, tenant isolation, AI security, and consumption should stay consistent. Egress is a good place to start. If prompts and responses must stay inside the AI factory, outbound traffic needs explicit control.
The bottom line
Guetari sees AI infrastructure entering a second phase. The first was about building capacity: GPUs, models, and AI factories. The next is about running that capacity as a governed, trustworthy service.
"GPUs provide capacity. Models provide intelligence. Agents provide action," he said. What's missing is the control layer that makes all three safe to use at scale.
You don't need to buy F5 to take the core lesson. Don't ask an agent to enforce its own limits. Put identity, policy, and egress controls somewhere the agent can't reach. And remember that whoever builds and deploys the agent owns what it does.
