Control is more than hosting
Private infrastructure matters, but so do credential scope, data classification, auditability and the ability to revoke access without rebuilding everything.
Define boundaries first
Specify which sources are authoritative, which fields are sensitive and which actions require a stricter gate before connecting an agent.
Recovery is part of sovereignty
Ownership is incomplete if a vendor or model failure leaves the business unable to restore a working predecessor.