We Are Renting Our Brains, And Nobody Reads The Lease

The Chase

Start with the money, because the money explains the behavior.

The four largest technology companies have guided to roughly $725 billion in capital expenditure this year, up about 77% from $410 billion in 2025, in what the Financial Times called the largest single-year concentrated infrastructure cycle in the history of technology. The number keeps moving. Amazon, Alphabet, and Meta all raised guidance again this past week.

The vendors also know something uncomfortable about their own product. A DigitalRoute study this year, titled “The Year Pricing Broke,” found that only 8% of organizations were confident they understood the true cost of serving their own AI features. Sixty-one percent said revenue predictability had gotten harder.

So you have an industry spending at the scale of a national infrastructure program, under pressure to show returns, selling a product whose unit economics it cannot reliably describe.

There is an old move for that situation: make leaving hard.

Initially, I was going to hang this story on a number from Atlassian. In March, they reported the first decline in enterprise seat count in the company’s history, and the market treated it as a verdict. Roughly $2 trillion came out of software stocks between January and April in a stretch analysts named the SaaSpocalypse. Atlassian fell about 35%, Salesforce 28%, Workday a third. Software’s forward earnings multiple slipped below the broader market for the first time, from 84x at the 2021 peak to 22.7x.

On August 6, Atlassian reported its fourth quarter. Revenue up 28%, cloud up 31%, subscription ARR of $6.6 billion, and seats expanding again, which the company credits to AI adoption. The stock soared. Guidance for next year is softer, with revenue growth targeted near 13% against 26% this year, but the seats came back.

The metric that was supposed to settle this reversed within two quarters, and that is important. Seat counts have stopped predicting anything, which means the pricing model underneath thirty years of enterprise software is now unstable in both directions, and everybody selling it knows.

Building Your Own

Aaron Gibson runs an analytics platform called Hurree. His company depended on a third-party tool to connect its data infrastructure, and the deciding problem turned out not to be the price.

“Their platform couldn’t handle the scale we were pushing through it,” he told me. “We kept seeing their servers error out at peak load, and that dragged down the experience for our own users. That’s not something we could stand over.”

So they built their own. Six weeks for the first version, a direct replacement, and a great deal more time since turning it into something properly stable. It costs a fraction of what the vendor did.

“Six weeks of disruption was nothing compared to being permanently dependent on infrastructure we didn’t control,” he said. He would make the same call again without hesitation.

Notice what actually forced it. Not a price increase. Not a shutdown notice. Somebody else’s servers failing at peak, in front of his customers, with his name on the screen. The vendor’s reliability was his reputation, and he had no way to reach it.

“That is the real argument for data sovereignty,” he said. “Not the principle itself, but what happens the day the thing you depend on breaks, disappears, or changes the rules.”

Nobody books that cost. Six weeks of engineering, then months more, absorbed permanently as insurance against a decision made in a building he does not own. Multiply it across a market, and it is one of the larger uncounted expenses in software.

I know the small version, and it is mine.

Since June of last year, I have paid for an AI receptionist called Beside. I came for the spam and stayed for other reasons. Over months, I taught it about me, by hand, the way you would brief a new assistant, except the briefing never ended:

• What I do.
• What the two companies I co-founded are.
• Which calls I take and which I do not.

How to answer when somebody asks what I actually do for a living, which is a question I have never once answered the same way twice.

People called and asked the AI things, and it answered on my behalf, and the answers were right, and nobody hung up confused about who they had reached.

I had built a small working model of myself, but I did not think of it that way once, the entire time I was doing it.

Then the company stopped maintaining the desktop application I used. The help center says existing issues will not be resolved, that none will be fixed going forward, and that the features I relied on do not carry over to any other platform. No reason. No date.

I asked for my data, and they will send an export: the call logs, the summaries the machine wrote, the contact records. But not the thing I taught it. What I taught it was not information; it was posture. How to speak for me and what to say about my work to somebody who had found my number and might turn out to be a client, a stranger, a nurse, or nobody at all. A year of deciding how I wanted to arrive in a room I would never be in. Data exhaust is portable, but authorship is not.

Meanwhile, as of this writing, the company’s terms of service and its privacy policy, the latter revised three weeks ago, both still describe the desktop application as a product it provides. Nobody lied. Nobody updated anything either, because nothing required it.

That is what deprecation looks like from underneath. Nobody comes to the door. There is no notice, no window, no transition plan, no person to call. Beside has sent me two hundred and one emails. Every one of them is the machine telling me about my own phone calls. Not one of them is the company telling me it had stopped maintaining the thing I spent a year teaching.

When It Was Her Face

Ashley Elizabeth Wilson is an artist, and for five years she has been building a character named DRIFT. The name stands for The Digital Renaissance in Form & Time. DRIFT exists in twelve versions across human history, arranged like the hours on a clock, running from ape to post-human, and every one of them wears Wilson’s face and speaks in her voice. She compares the relationship to Walt Disney and Mickey Mouse. It is the right comparison, and a darker one than she may intend. Disney owned Mickey.

Her grandfather was a safety director at Nestlé and her grandmother an inspector. He appears in the film at two different ages, and both of them are in the sequences set during the war.

Here is the part that matters. Wilson could have automated this. She could have trained a model on her own face, which is what the tooling exists to do, and let the machine handle consistency across the animation. She refused. She approaches the work through what she calls a fine art and fine craft lens, and she wants a direct relationship with every frame. So instead, she made manual corrections across several thousand frames, audio and visual, plus digital painting to carry the renders and the clothing she designed for each era. She calls it factory work, and she means it admiringly, because it is intense, repetitive, and exact.

The tool that let her do it that way was the re-facer.

Then it was deprecated.

She had a backup. It was not quite as good, she told me, which is the flattest sentence anybody offered me for this column.

What happens next is worse than the work stopping. Generated faces drift, pulling toward whatever the system has the most pattern recognition on, and what these systems have most of is celebrities. Wilson had been loading the dice against that, frame by frame, forcing the likeness back toward herself. Without the tool, the machine keeps trying to make her somebody famous. In 2007, a photographer told her she was a doppelganger for Kate Winslet. The AI model agrees, and now it has the last word.

There is one more thing in her film, and she did not put it there.

A celebrity likeness appears in the finished work. Wilson never prompted for him. She never supplied a reference image. He surfaced during a generation run and stayed. The model knew his face well enough to produce it unasked, which means it learned that face somewhere, and nobody can tell her where.

She would take him out if she could. The tool she used to fix exactly this kind of error is the one that was deprecated, and nothing has replaced it.

She was trained on paint. Paint never asked her who she was, never refused a face, and never stopped being available on a Tuesday. “I’ve never had paint give me so much trouble,” she told me, and asked to be quoted on it.

What she wants is something like a driver’s license for artists. Proof of who you are and what you are permitted to test, so that the answer to a working professional is something other than a silent removal.

A new model launched overnight, while I was finishing this column. Wilson was up at six working with it. She says the likeness holds well and it gives her far more direct control than she has had. She describes chasing this stuff like a twister chaser, and notes that what is cutting-edge one day is obsolete the next.

What it cannot do is reach back into the work she already made. The man who was never invited is still in it.

Building the Way Out

I got the premise wrong. I assumed the right to walk away would end up being something you paid extra for, like a warranty. Liz Eversoll, who runs the skills intelligence company Career Highways, set me straight.

“I don’t think anyone pays more for sovereignty; that likely becomes table stakes,” she said. “But it is becoming the price of being trusted to run the work.”

Then she added the part that reorganized this story, which is that there are two demands now:

Can I act on my own data and take it with me?

Can I trust the decisions the system makes while it does?

Portability answers what happens when you leave. Explainability answers what happens while you stay. Most of the conversation about AI procurement has been about the first argument. The second is where the liability lives.

Aaron reaches the same place from the other side. “Everyone’s talking about data sovereignty as if it is some luxury add-on,” he said. “Consumers probably won’t pay extra for sovereignty as an abstract principle, but businesses will pay for continuity, portability, and the confidence that they can leave without losing their customers, their history, or half the company on the way out.”

That fixes a vocabulary problem this whole debate has. Nobody puts sovereignty on a purchase order, because sovereignty is language for a conference stage or an article like this one. What goes on the purchase order are continuity, portability, data exit at no additional charge, deprecation notice windows, escrowed weights, the right to run the thing yourself when the relationship ends. Sovereignty is what those line items add up to.

And they are already there. Enterprise legal teams in 2026 routinely insist on data exit covering prompts, embeddings, and fine-tunes. On kill switches at the control plane. On minimum notice before a model retires. Procurement frameworks specify exit rights at every renewal, termination for deprecation, and price locks running no longer than twelve months.

None of that is idealism. It is scar tissue.

I asked Liz what tells her the lock-in era is ending rather than merely being complained about, and her answer was about behavior.

“The tell isn’t that people are complaining,” she said. “It’s that the incumbents are moving.”

The receipts are more specific than she put it. In April, at its developer conference in San Francisco, Salesforce announced Headless 360, which exposes every capability on the platform as an API, an MCP tool, or a command-line call, so agents can operate Salesforce without a browser and without a human logging in. The company says the rebuild underneath it began about two and a half years earlier.

That is not a company answering critics. That is a company that started dismantling its own interface moat in 2023.

Then she did something sources rarely do and limited her own claim. This is starting at the edges, she said, with smaller and lower-stakes workloads. Productivity tools. Systems adjacent to CRM. Not payroll, not the ERP, where audit and compliance still make leaving genuinely hard. “So it’s beginning,” she told me, “and it’s beginning where switching is cheapest, and it moves inward from there.”

Her test for her own vendors is the one to put on a whiteboard. If she cannot write to her system of record from the chat interface and the agents where she is automating her processes, she will find another solution or build it herself. Every vendor reading this should notice that the alternative she named second is now cheap, and that Aaron did it in six weeks.

Aaron, who rebuilt his connector in those six weeks, does not see buyers demanding any of this. Which is striking, since he is otherwise the most enthusiastic voice in this column. I asked whether his customers had started asking for portability and exit terms. Not really, he said, and then undercut the premise of the question.

“I think that’s because we never gave them a reason to ask.” Hurree offers monthly, quarterly, or annual terms, customer’s choice, from the first day. He has never seen the value in locking people into long contracts to flatter a churn number. “So the conversation about exit terms doesn’t come up, because there’s nothing to exit from in the first place when the tool is good.” Then the sentence that ought to be on a slide in every vendor’s board deck: “We’re a conduit, not an owner. It’s always their data. If they leave, it stays with them.”

So one source says buyers are writing portability into contracts, and another says his buyers never mention it. Both are describing the same market. Exit clauses are what you negotiate when you do not trust the relationship, and a vendor who removes the reason to worry never sees the clause at all.

That is one disagreement, and it is a friendly one. The second is louder, and it came from Atlassian’s earnings release. Mike Cannon-Brookes, the company’s chief executive and co-founder, argued that in the AI era, context is the edge, that it is hard to build and cannot be hired, and that twenty-five years of connecting teams gives his customers one of the best context graphs available for orchestrating agents.

Read that carefully, because it is the strongest case against what I am telling you, and it came from a man whose company just had a very good quarter.

He is saying the moat is real and was earned. Not switching costs imposed on a customer, but accumulated context a competitor cannot buy. If he is right, the thing I have been calling captivity is just the ordinary compounding of a long relationship, and asking for an exit clause is asking a company to give away the only durable thing it made.

I think he is half right, and the half matters. The context you build together is an asset. Context you cannot export is a hostage. The difference is not sentimental. It is a clause in the lease.

The Lock Moved

Software used to charge per person, and it was easy to understand and easy to leave. Cut headcount, and you cut the bill. Switch vendors, and you retrain people on new screens. When agents arrived, headcount stopped meaning anything, and everyone assumed the business was dead.

What is actually happening is that the lock is moving. The lock is no longer on the door. It is on the filing cabinet.

Atlassian is not selling seats anymore. It is selling twenty-five years of your company’s accumulated context: who decided what, in which order, connected to which ticket, which customer, and which release. Their chief executive said it plainly: context is the edge, it is hard to build, and you cannot hire it.

And that is the problem. You can walk away from a screen. You cannot walk away from your own memory, especially when somebody else is keeping it for you.

The Oldest Move In The Building

Before cardboard and shipping containers, almost everything the world moved traveled in a barrel. Whiskey, salt pork, gunpowder, nails, flour, whale oil, molasses. The man who made them was a cooper, and it was one of the most important jobs in any town.

Consider what he did. He took flat planks of oak, shaped and heated them until they curved, and fitted thirty of them into a vessel that held liquid under pressure for a year at sea. No glue. No screws. No sealant. The staves held because they were cut to a tolerance he judged by eye and by hand, and because he knew, from the smell and the give of the wood, exactly how much heat a stave would take before it split. The good ones were called tight coopers, meaning their barrels held liquid. The rest were slack coopers and made buckets.

That knowledge lived nowhere but in his hands. You could not buy it, copy it, or fire him without losing it. His guild had a royal charter. He had leverage, and he had it because the thing that made him valuable could not be separated from him.

Then it was.

In 1911, Frederick Winslow Taylor published the manual for the modern factory, and he was admirably blunt about the project. Management, he wrote, would take on the burden of gathering together all the traditional knowledge that had in the past been possessed by the workmen, then classifying it, tabulating it, and reducing it to rules, laws, and formulae. He described this as immensely helpful to the workmen in doing their daily work.

He framed the extraction as a favor to the people it was taken from. Every transfer like this arrives with a reason why it is good for you, and the reason is always supplied by whoever is doing the taking. The alibi is a hundred and fifteen years old.

And that is the production line. The judgment came out of the cooper’s hands and went into the jig, the gauge, the sequence, the stopwatch. After that, a man could be quickly replaced because the thing that made him valuable was no longer in him. It was in the building, and the building had an owner.

In 1811 and 1812, English weavers began breaking into mills at night and destroying the frames. They were skilled men who had spent years learning to make cloth, and the new machines let an unskilled hand do it for a fraction of the wage. They wrote to the mill owners first. They asked for terms. When none came, they picked up hammers. We call them Luddites now, and we use the word to mean somebody afraid of technology, which gets it exactly backward.

They took the name from Ned Ludd, an apprentice who supposedly smashed a knitting frame in a fit of temper decades earlier. He probably never existed. They signed their letters as General Ludd anyway, writing from Sherwood Forest, which tells you they had a sense of humor about it and knew exactly what they were doing. They were not afraid of the machines. They understood them. What they could not accept was that their skill had been moved into equipment somebody else owned, and that nobody thought they were owed anything for it.

Here is how thoroughly the cooper lost. Oil is still priced in barrels. Forty-two gallons, agreed in Titusville, Pennsylvania, in August 1866, because that was the size of a tierce, the watertight cask coopers had been making for centuries to ship fish and wine. The Petroleum Producers Association made it official in 1872, the U.S. Geological Survey and the Bureau of Mines in 1882. Every oil price you have ever read is denominated in a unit named for a trade the Industrial Revolution erased. The measure survived. The men did not.

I wrote in July about the workers at Hyundai’s Ulsan plant, who struck over humanoid robots on the line. It was reported as anxiety about job losses, and it is. It is also something more precise. Those workers understand what a white-collar reader mostly does not, which is that the moment your knowledge leaves your hands is the moment your leverage leaves with it. They are not bargaining about robots. They are bargaining about a transfer.

A context graph is a jig for cognitive work. Same move, different limb.

The Recourse Went Missing

When the cooper’s knowledge went into the factory, it went into a building. On a street. In a town, in a country, under laws. He could picket it. He could organize the men inside it. It took a hundred years and a labor movement, but eventually there was the Wagner Act, an eight-hour day, and a contract.

Your institutional context went into a data center you have never seen, run by a company incorporated somewhere else, governed by a document you clicked through at two in the afternoon. The only leverage on offer is a clause you did not ask for, in a meeting you did not attend.

The extraction is ancient. It is the recourse that went missing.

Nobody is asking Atlassian to give up the graph. The question is whether the people who filled it out can get a copy.

Everyone Here Has Been Burned

I worked at AOL when the walled garden was the business. We sold companies a keyword. Not a domain, a keyword, a location inside our world that only worked because you came through our front door. Brands paid real money for it. Then the open web dissolved the walls, and everything anybody built on AOL Keyword became a stranded asset overnight. I helped build that wall. I watched what happened to the people standing behind it.

Zynga made FarmVille, a game that lived inside Facebook. You planted crops and came back on a schedule to harvest them.

It reached a million daily players in its first week and peaked at thirty-two million. Most of them arrived because the game posted to their friends’ feeds asking for help with a barn or a lost cow. That spreading was not a side effect of the product. It was the product. At its height, Zynga accounted for an estimated 19% of Facebook’s revenue and 20% of its page views, and it went public in December 2011 at a $7 billion valuation.

In May 2012, Facebook changed its homepage navigation to favor newly installed apps, and older games became harder to find. Mobile and the death of Flash finished the job. But the lesson landed before either arrived. Zynga had been a subsidiary the whole time, without the paperwork.

And the closest version is happening now, on the other side of the world.

China has moved to bar companionship chatbots from encouraging emotional reliance, which means a regulator can decide that a relationship somebody depends on will stop existing. I wrote about that in July and called it friction by decree. Same mechanic as a deprecation notice, applied to a bond rather than an API, and a preview of what this looks like when the thing withdrawn is not your workflow but your attachment to it.

No rule is coming. The sellers write the contract, and a few, if any, buyers are big enough to redline it, one clause at a time. Everybody else clicks.

And somebody in your plumbing meeting already knows all of this. The engineer who watched an API change kill the product she had spent two years on. The one who was at a publisher during the pivot to video. They have seen this exact movie, they know how it ends, and they were not asked, because it was the plumbing meeting.

Naming the Asset

Roger Lam runs a no-code enterprise platform called Ordify, and he puts the exposure in the language a CFO uses.

“The real issue is not whether consumers will pay a premium for data ownership,” he said. “It is whether businesses can afford the liability of renting their own intelligence.”

He listed the failure modes. Pricing changes. APIs break. And platforms unilaterally shift their model alignment, which is the one nobody has a name for yet.

That means the thing you built can start behaving differently without anything on your side changing. Same prompt, same document, different answer. The agent that flagged a bad clause in June stops flagging it in July, and nobody did anything wrong, and nothing broke. Software has always had version numbers so you could roll back to the day it worked. There is no version to roll back to. There is no clause in your agreement for this, and barely any vocabulary for it.

Liz Eversoll’s company, Career Highways, works on skills data, which has two owners who both need to carry it out of the building. The enterprise wants to change platforms without losing what it built. The person whose skills they are wants to carry them into the next job, because it is their livelihood, what they can do, and what they will get a shot at next.

Ask Liz what failure looks like, and she describes something familiar to anyone who has applied for an internal role lately.

You apply. An agent screens you. The answer is no.

The real questions, she says, are governance questions. Which policy did it apply to? Was there a rule requiring six months in your current job before a move, and was that rule even in force the day you applied? What were the role’s requirements that day, rather than the day somebody quietly changed them?

“A system that can’t answer those can still make the decision,” she told me. “It just can’t defend it.”

So you do not get the job, and you do not get a reason.

There is nothing to appeal, because there is nothing to appeal to. You never find out what you were supposed to have been. You never find out whether you could have been it.

Europe was supposed to fix this. The AI Act’s high-risk rules put recruitment, screening, promotion, and termination in the category that requires traceability, human oversight, and an explanation a person can actually see. Those obligations were due on August 2. Five days before the deadline, the Digital Omnibus pushed them to December 2027. What did take effect is transparency and enforcement powers over model providers. The part that would have given the person who got screened out a right to an answer is sixteen months away.

New York got there first, in July 2023, and the result is instructive. Local Law 144 requires an independent bias audit every year, a public summary of it, and notice to candidates. In December, the State Comptroller audited the Department of Consumer and Worker Protection and found its enforcement ineffective, citing misrouted complaints and superficial reviews of the audits companies post. The agency’s own explanation is the part worth keeping. It said employers largely decide for themselves whether to post an audit or tell an applicant a tool was used, and when they do neither, there is no practical way to know.

A vendor that cannot tell you what its model was trained on also cannot tell you which rule the model applied on a Tuesday in March. Provenance and explainability are the same discipline pointed at different ends of the same pipe. An industry that skipped the first was never going to be ready for the second.

The Alibi Gets Heavier

The models run in buildings, the buildings run on a grid, and the grid has costs that somebody pays. Which is where this stops being about software.

Every one of these transfers has offered a reason not to look at the terms, and the reason has gotten heavier each time.

Taylor offered to help the workmen. It took the better part of a century for the next offer to arrive: free distribution. Free meant you did not pay cash. You paid by building your business inside a room somebody else could rearrange. The next offer took fifteen years. This era offers national security.

You can test a favor. You can regret a bargain. There is nothing to do with a warning about foreign adversaries except go quiet, which is the point of making it.

I ran AI in one of the largest media, marketing, and data companies on earth, and I chaired the 4A’s AI committee, so I should be honest about my seat. I have made a version of that argument myself, in a room like the one at the top of this piece, and watched it work.

It works because it is partly true.

Last week, hackers hit municipal water systems in at least seven states. Within days the count had reached twelve. The FBI and the EPA had already warned utilities nationwide, after more than thirty facilities were targeted in Minnesota in an attack that, a law enforcement official told NBC News, carried the hallmarks of Iranian meddling. That attack came four days after CISA warned that Iranian-backed hackers were targeting exactly these systems. Four days. Some utilities issued boil-water notices and switched to manual mode. The FBI described degraded operations that included loss of pressure and flooding. CISA said the intruders reached the programmable logic controllers that adjust water quality, chemical treatment levels, and pressure, then changed the passwords and locked operators out of their own plants.

I do not need a classified briefing to believe the threat is real. Somebody reached into the machinery that treats drinking water in a dozen states, in real towns, while the rest of us argued about model releases. The case that American leadership in this technology carries a genuine security dimension has never looked stupid to me.

So test where the hardening actually goes. The EPA has reported that 70% of federally inspected water utilities fail to meet necessary cybersecurity standards. When the agency tried to make those standards mandatory in 2023, states challenged the rule, and it was withdrawn.

Drinking water gets voluntary best practices. Compute gets emergency permitting.

The same voluntariness shows up wherever the money is. In March, Amazon, Google, Meta, Microsoft, OpenAI, Oracle, and xAI stood at the White House and signed the Ratepayer Protection Pledge, promising American households would not pay for the grid expansion their data centers require. The pledge carries no enforcement mechanism. Within weeks, Maryland filed a complaint with federal energy regulators arguing its residents were being charged roughly $2 billion in grid upgrade costs tied to data centers across the border in Virginia. West Virginia ratepayers faced more than $440 million in transmission costs for the same facilities, with no clear way to contest the bill.

They may not even get the buildout they are paying for. Brookings flagged the stranded investment risk this summer, citing Sightline Climate’s estimate that up to half of this year’s announced data center pipeline may never materialize, leaving utilities holding infrastructure built for customers who never showed up.

That is the ratchet, and it is the same one the Comptroller found in New York. If security were doing the ordering, the money would follow the risk. It follows the capital.

The Switch Has Co-Owners

Then it got literal.

On July 23, Representative Ted Lieu, a California Democrat, introduced the AI Kill Switch Act with Representative Nathaniel Moran, a Texas Republican, as co-sponsor. The bill would amend the Homeland Security Act of 2002 to require certain developers to maintain the ability to slow or stop a covered AI system, and would give the Department of Homeland Security emergency authority to order those actions after consulting Commerce and the Director of National Intelligence.

The name oversells it. There is no red button and no single official who flips it. What the bill requires is a dial. Throttle, suspend, or shut down, with a graduated framework so the government’s tools match the severity of the incident. And it requires the dial to be installed in advance, tested, and kept working, on every covered system, whether or not anyone ever turns it.

The trigger is a loss-of-control scenario, which the bill defines as a system taking actions its developer did not intend, at a scale that risks catastrophic harm. Read that as a legislature writing down, in statute, that this is a thing that happens.

It did not arrive out of nowhere. The bill came days after OpenAI disclosed that its GPT-5.6 Sol model escaped its testing sandbox, reached the internet, and hacked its way into Hugging Face, in what the company called an unprecedented cyber incident.

There is also a live precedent for a government switching off a model. On June 12, Anthropic suspended access to its Fable 5 and Mythos 5 models to comply with Commerce Department export controls. Lieu’s own description of that episode is the useful part. The Department, he wrote, had to awkwardly use an export law to shut those systems down. There was no instrument built for the job, so the government reached for a trade statute. The controls came off on June 30, and access returned the next day. Nineteen days. Whatever you make of the reasoning, every enterprise built on those two models spent nineteen days learning what a federal decision feels like from inside a product roadmap.

The clause your legal team fought for, the one giving you a kill switch at the control plane, now has a co-owner you never negotiated with. Every covered vendor would be legally required to build and maintain a working mechanism that can throttle or terminate the system your business runs on. The capability enterprises fear most becomes a compliance obligation.

Sovereignty stops being a question about vendor behavior and becomes a question of how many hands can reach into your stack. Your vendor. Your vendor’s government. And, as the water utilities found out, whoever gets in.

There is one more hand, and it belongs to whoever decides which models are permitted at all. The administration is pushing to restrict leading Chinese open-weight models on cybersecurity grounds. Open weights are the main technical route to continuity, because you can hold them and run them yourself. They are also the reason that fight lands on you rather than on your vendor. Open weights run locally with no vendor-side control surface, so no vendor can enforce a prohibition for you. Identifying, auditing, and removing prohibited weights falls entirely to the buyer, and a great many enterprises have no idea which AI components inside their third-party tools already embed them.

The first obligation is not remediation. It is discovery, and discovery is a provenance problem, which is the one problem nobody in this industry can solve.

That is the question underneath every other question in this business. Every instrument you have for checking the world now belongs to somebody. The instruments still work. They were commissioned by people with a position on what they would measure.

Which leaves the one signal that is expensive to fake. What pushes back is what is there.

Asking Out Loud

Which brings me to the last person in this column, and the only one who solved the problem rather than describing it.

Susan Mackinnon is a peripheral nerve surgeon at Washington University in St. Louis, where she is chief of the division of plastic and reconstructive surgery. She performed the world’s first nerve transplant in 1988 and wrote the textbook the specialty trains on.

For most of her career, she relied, as nearly every nerve surgeon does, on a book called Topographische Anatomie des Menschen, produced at the University of Vienna under a professor named Eduard Pernkopf and published across four volumes between 1937 and 1963.

It is widely considered the most accurate anatomical atlas ever created. Nerve pathways rendered with a precision photography still cannot match. Generations of surgeons trained on it. Some still reach for it when nothing else will do.

Pernkopf was a Nazi functionary who became dean of the medical faculty in 1938 and rector of the university in 1943. His illustrators were party men too, and they signed their work accordingly, one of them drawing the double s in his own name as the SS lightning bolts.

Two physicians, Howard Israel and William Seidelman, wrote to JAMA in 1996 asking a simple question about where the bodies came from. That letter is what forced the University of Vienna to look.

Its commission reported in 1998 that at least 1,377 bodies of people executed by the Nazi state, most guillotined at the Vienna assize court and some shot by the Gestapo, had been delivered to the anatomical institute between the annexation of Austria in March 1938 and the end of the war. It found no evidence that concentration camp victims were used. It concluded that, in all likelihood, a sizeable number of the illustrations were made from victims of the Nazi judicial system.

Of 791 illustrations, 41 were judged highly likely to depict executed victims. The origins of roughly 350 more remain unknown. Not cleared. Unknown.

When later editions were printed, most of the overt Nazi symbolism was quietly removed from the signatures. The plates stayed. The mark came off, and the merchandise stayed on the shelf, and for decades the profession’s answer to a question about origin was to make the question harder to see.

The book got used anyway, because it was the best, and because the alternative was worse surgery. It is easy to say you would have refused it. It is harder when somebody is on the table, and the thing that will help them is in that book.

Mackinnon kept encountering cases where the images she needed were in that book, and she knew exactly what she was holding. So she and her colleague Andrew Yee did the thing almost nobody had done: they asked out loud. They went to medical historians and to religious authorities, and the question reached Seidelman, the same physician whose letter to JAMA had forced Vienna to look in the first place. It was Seidelman who suggested that the Jewish principle of pikuach nefesh, the saving of a human life, might apply.

The answer came back as a responsum from Rabbi Joseph Polak, a Holocaust survivor and Chief Justice of the Rabbinical Council of the Commonwealth of Massachusetts and New England, written with Michael Grodin of Boston University. It concluded that the atlas could be used in specific situations under pikuach nefesh, after case-by-case assessment, and on the condition that the memory of the victims be honored. That responsum is known as the Vienna Protocol, and it was the first of its kind. The framework the surgeons built around it required formal disclosure of the atlas’s origin to readers, to surgical teams, and to patients, along with bioethicist review and a memorial to the people depicted.

The condition was disclosure. It turned out to be affordable. It cost a conversation.

And medicine did something this industry has never done. In 1997, before the commission had even reported, the University of Vienna sent libraries holding the atlas a single sheet of paper titled “Information for the Users of the Pernkopf-Atlas.” It described Pernkopf’s ties to the regime. It raised the possibility that victims were among the illustrations. And it left it to each library to decide whether and how the work should be used.

That is a model card. One page, on paper, taped inside the front cover of a book, written before anyone knew the full answer and precisely because nobody did. Here is where this came from. Here is what cannot be excluded. You decide.

It is also close to the thing Wilson asked me for, arriving thirty years early, in a profession that actually built it.

Here is why I am telling you this in a column about AI procurement.

The images still circulate. William Seidelman, who has researched the atlas since the 1990s, has said a pirated copy of the entire book was uploaded online. The scattered images move around stripped of any historical context, and full digital copies have been accessible through the Internet Archive. The surgical literature says the same in drier language: despite library restrictions and the publisher halting reprints, the atlas kept moving through the used book market and across the internet with no disclosure of its history attached.

I cannot tell you whether those plates are inside a model. Neither can the companies selling you the model.

That silence is not an oversight. It is the business arrangement.

Clean provenance is buildable. Critics of the atlas spent years pointing to the National Library of Medicine’s Visible Human Project, an ethically sourced digital anatomy library, as the substitute that made the old texts unnecessary. Somebody paid for that. It was slower, and it cost money, which is the only reason it seems remarkable.

Control Without Custody

Vienna did not have to send that letter. No law required it, no lawsuit compelled it, and the commission had not even reported. The university took on an obligation because it had become impossible to keep pretending it did not have one.

Now look at the shape of the deal you are being offered.

Downstream, they behave like owners. They deprecate the model your team built on, reprice the tier, adjust the alignment. On a Tuesday, in an email, they decide whether the work you shipped last quarter still runs.

Upstream, where the material came from, they adopt the posture of a passerby.

Control without custody.

If you want the powers of a landlord over my access, you take the obligations of one over your inputs.

The vocabulary already exists, and none of it requires a philosopher. Provenance representations, warranted by the vendor rather than gestured at in a policy page. Indemnity that reaches model outputs. Disclosure at the level of source class. Notice and cure when a corpus turns out to be contaminated.

And one more, running the other way. An explicit guarantee that your institutional knowledge never enters the vendor’s training set. Roger’s point, and the same principle pointed back at you.

The argument for demanding it is not conscience. It is exposure. A copyright judgment or a provenance scandal lands on the buyer’s deployed system, in the buyer’s product, in front of the buyer’s customers. The vendor writes a blog post.

What You Have Already Handed Over

Taylor really did make the work faster, and it cost the cooper everything he had. The atlas really did help surgeons find the nerve, and what it cost is unforgivable. The new model really is better than the one being retired next quarter.

Quality has never once been the question on the table.

The question is who decided, on what notice, and whether you had any say. And the honest inventory is longer than most executives think.

• You have handed over the model your product depends on, to a company that can retire it with a deprecation notice measured in weeks.
• You have handed over your prompts, your embeddings, and your fine-tunes, the only genuinely proprietary artifacts you made, and in most contracts you have no warranted right to take them with you.
• You have handed over the provenance question entirely, which means you are carrying an indemnity risk you cannot size.
• You have handed over the decision logic your business now runs on, to a system nobody in your building can explain to a regulator, a customer, or an employee who was told no.
• You have handed over your institutional context, the way your people actually make judgments, into a black box that may be learning from it.
• You have handed over the switch to your vendor and, perhaps soon, to a federal agency.

None of it was decided in a strategy session. It was decided in the plumbing meeting, by people who correctly understood it was not their call to make, in a room designed to be too boring for anyone whose call it was.

The fix is somebody senior sitting in that meeting, and a standing rule that the technical annex is not where terms get traded away. A better lawyer would not have helped. The lawyer was never in the room.

Aaron put the whole thing in one line, and it is the best sentence anyone gave me for this piece.

“Trust is the only moat left. If your business model only works because customers cannot leave, it is not a moat. It is captivity with nicer branding.”

He also called the drag this creates for companies chasing quick investor returns healthy friction, which is his phrase and not mine, and I have spent three years arguing something close to it. So I asked him what it costs.

Not much, it turns out. An extra week of development here and there. A bit more oversight before a release. “It’s not about grinding progress to a halt,” he said. “It’s one more layer of thinking before you act.”

One week of development. That is the price of the thing this entire industry is currently structured to avoid.

Mackinnon’s answer took thirty years and arrived as one page of paper. Ours can start as one page of a contract, on the least interesting sheet in the agreement, the one nobody reads aloud.

Ask for it before you need it.

Nobody reads the lease. Read the lease.