The subsidiary passes every audit. That is the problem.¶

A plain-language companion to the working paper "Screening for Sovereignty: Optimal Procurement when Compliance is Cheap to Fake and Costly to Verify" (v0.14, July 2026). The paper carries the model, five theorems, and the proofs; this text carries the ideas.

The short version. Governments buy "sovereign" cloud under rules meant to guarantee that no foreign power can compel the supplier. The offerings that satisfy those rules are frequently controlled, in the end, from abroad: an EU-incorporated subsidiary, a local data region, a binder of certifications. We model the procurement as what it actually is, a game between a buyer who writes requirements and audits, and a supplier who can produce the appearance of compliance at a fraction of the cost of the real thing. The mathematics then says which requirements can work at all, in what order to verify them, and how good the audit has to be. The answers are exact, and several of them are uncomfortable.

Nominal and effective¶

Every requirement targets an attribute, and every attribute has two levels: the effective one (does the supplier actually have it?) and the nominal one (does it look like it?). The two can be decoupled at a cosmetic cost: for jurisdictional control, that is the price of standing up a local subsidiary that does not sever the parent's reach. The whole economics of sovereignty procurement lives in the gap between those two levels, and in what it costs whom to fake it.

Four results, in words¶

Some requirements cannot screen, at any price. A requirement separates the genuine from the pretender only if the two differ in what effective compliance costs them, and only if the buyer can verify the nominal-effective gap. Data residency and operational practice fail the first test: a global firm hosts data locally and runs clean operations as well as anyone, at the same cost. Auditing those attributes, however intensely, detects nothing, because the pretender complies genuinely there and fakes only where the types differ. No price, penalty, or audit intensity repairs this. It is the formal version of what happened to European cloud certification: the criteria that remained after 2024 are attributes with no cost gap, and they were duly satisfied by everyone.

Fakes are complements. A supplier caught faking loses its stake: the contract, the margin, the penalty. The key word is its: the stake is one bounded pot, forfeited once, no matter how many attributes were faked. So each additional fake is punished less at the margin, like a driver with one licence to lose: the second offence is free once the first is certain to cost it. This changes multidimensional compliance economics: piling audits across attributes buys much less than intuition suggests, because the detection events overlap on the same stake.

The best audit is a cascade. Order the attributes well and audit each against the residual stake, what remains after the temptations already deterred. Only the first attribute needs its full solo-deterrence accuracy; every later one can be audited more cheaply, because the pretender's pot has already been burned down. The cost-minimizing order and accuracies have closed forms, and brute-force search confirms nothing beats them.

The bar is set by the richest pretender, and it rises with the price. The audit accuracy a control screen needs is pinned by the largest would-be mimic's ecosystem rents, never by the average bidder, and it increases with the contract's value: a richer prize needs a better audit. Sweeteners have a cost the sweetener rarely prices in. A final twist: two audits that read the same underlying body of evidence (the corporate documents, the control facts) do not add up like independent coin flips; modeled properly, the second audit of the same evidence is largely redundant, which is one more reason behavioural audit stacking underperforms.

What this buys a policymaker¶

Three practical rules fall out. Verify the attribute the types actually differ on, which for sovereignty is control, and accept that this verification is genuinely expensive; everything cheap to verify is cheap precisely because it screens nothing. Order the verifications as a cascade instead of auditing everything equally. And treat every increase in contract value as an implicit increase in the audit accuracy required, because the prize is what the pretender is playing for.

One caveat carries the paper's honesty: this is a model, with a bounded one-strike sanction and a rational pretender, and its numbers are checked against brute force rather than against field data. What it offers is the logic of the game, and the logic alone already rules out most of what current frameworks audit.