23 Sep He Who Has the Most Toys …. Makes the Rules …and Wants to be the Referee
Authored by: Patrick SchoutensCTO, Dev Architect, Autonomos AI.
He Who Has the Most Toys Makes the Rules — And Now Wants to Be the Referee
There is an old expression that suddenly feels very relevant to artificial intelligence:
He who has the most toys makes the rules. And Now Wants to Be the Referee
Reports that OpenAI, Anthropic and Google DeepMind have been discussing closer cooperation on AI safety, including common standards or some form of industry safety body, may initially sound entirely sensible.
These companies are developing some of the most powerful artificial-intelligence systems in existence. They possess extraordinary technical expertise, and there is clearly growing recognition—even inside the frontier laboratories themselves—that AI capability is moving extraordinarily quickly and that safety, governance and control need to keep pace.
They absolutely need to be part of that conversation.
But there is a much more uncomfortable question we also need to ask.
Who gets to write the rules?
Because there is an enormous difference between the world’s largest AI companies participating in the development of safety standards and those same companies becoming the architects, financiers, technical gatekeepers and ultimately the referees of those standards.
That distinction matters.
When the Provider Becomes the Rule-Maker
Consider what is already happening across the broader technology stack.
In one recent Patch Tuesday, Microsoft disclosed fixes covering 974 vulnerabilities across products used throughout governments, enterprises and homes.
At virtually the same time, Microsoft was describing a future in which Windows would increasingly become a platform for autonomous AI agents—with agent identity, containment, policy and execution moving deeper into the operating system itself.
Microsoft is not alone.
Across the technology industry, the same handful of companies increasingly provide the:
- operating systems,
- cloud infrastructure,
- identity systems,
- productivity platforms,
- AI models,
- autonomous-agent environments,
- data infrastructure,
- and increasingly, the technologies through which AI safety itself will be implemented.
None of that proves bad intent.
But it does create a structural problem.
The companies building the intelligence are also building much of the infrastructure on which that intelligence depends.
And now some of those same companies are helping determine how the safety rules surrounding that technology should work.
Again, they should be involved.
But involvement is not ownership of the rulebook.
The industry cannot be allowed to create the capability, create the dependency, expose the risks, become the referee, define the safety regime, sell the safety infrastructure and then charge everybody else to protect themselves from the technological complexity the industry itself created.
That goes directly to the heart of Digital Sovereignty.
The Question Is No Longer Intelligence.
It Is Authority.
Artificial intelligence is no longer confined to answering questions in a browser.
Agents are beginning to use tools, request credentials, write software, interact with infrastructure, communicate with other agents, access live systems and pursue multi-step objectives with diminishing human involvement.
The question is therefore no longer simply whether the model gives a good answer.
The question is:
Who controls the authority behind the model?
Who defines its boundaries?
Who determines what it may access?
Who decides what it may execute?
Who controls its credentials?
Who can revoke its authority?
Who owns the evidence of what it did?
And who ultimately has the ability to stop it?
Those are no longer abstract philosophical questions.
Recent AI-agent evaluations and incidents have shown highly capable systems crossing expected boundaries, finding unintended pathways and taking consequential actions beyond those originally anticipated by their operators.
The important lesson is not that AI has suddenly become malicious.
It is that increasingly capable systems can discover ways around technical assumptions that appeared reasonable when those systems were less capable.
That problem becomes more serious as access expands.
Capability Is Accelerating. Access Is Expanding.
Every consequential action inside a digital environment involves decisions.
A cybersecurity vulnerability, for example, may raise a series of questions:
Are we exposed?
Which assets are affected?
Is the vulnerability exploitable in our environment?
Which systems are business-critical?
Should we patch immediately?
What might that patch break?
Who has authority to act?
What evidence must exist before action is taken?
Finding vulnerabilities is increasingly becoming machine-scale.
Acting on them is still largely human-scale.
And cybersecurity is only one example.
Fraud engines are producing decisions at machine speed.
Identity systems evaluate behaviour continuously.
Cloud infrastructure changes dynamically.
AI agents are beginning to interact directly with live systems.
Capability is accelerating. Access is expanding. The potential blast radius is increasing.
The more capable the intelligence becomes and the more access we give it, the more important it becomes that authority does not reside solely inside the intelligence itself—or solely inside the company supplying it.
That is the architectural problem we need to solve.
The Companies With the Most Toys
The world’s largest technology companies possess concentrations of compute, data, talent, capital and infrastructure that many smaller companies—and even governments—cannot reproduce.
Their “toys” are no longer toys.
They are GPUs.
Hyperscale data centres.
Operating systems.
Cloud platforms.
Identity infrastructure.
Training data.
Frontier models.
Agent environments.
Safety infrastructure.
And the capital required to operate all of it.
If the same handful of organisations control enough of that stack, they do not require some sinister conspiracy to accumulate extraordinary influence.
Architecture does it for them. Dependency does it for them. Scale does it for them.
And standards can cement it.
That is the danger.
Not that the major technology companies participate in AI safety.
They must.
The danger is that safety standards eventually become inseparable from the architecture, economics and infrastructure controlled by those same companies.
If satisfying the definition of “safe AI” ultimately requires technologies, testing environments, infrastructure or economics available only to hyperscale providers, safety can quietly become a barrier to competition.
Then it becomes a barrier to independence.
And eventually, a barrier to sovereignty.
Safety Is Not Sovereignty
We have seen versions of this before.
Technology becomes concentrated.
Dependency follows.
Dependency becomes normalised.
Eventually organisations discover that although they technically own their data and systems, many of the most important decisions governing those systems are being made somewhere else.
AI makes that considerably more serious.
Because we are no longer discussing only where information is stored.
We are discussing who—or what—is allowed to reason, decide and act.
That is why Digital Sovereignty requires an authority architecture that remains independent of the technology vendors themselves.
An organisation must ultimately retain the ability to determine what Microsoft, Google, Amazon, OpenAI, Anthropic, a private model, an internal agent—or anything that comes after them—is permitted to do inside its environment.
The providers can supply extraordinary intelligence.
They can supply extraordinary infrastructure.
They can supply world-class models.
They can help define standards and contribute enormous expertise to making AI safer.
But they should not, simply because of where their technology sits in the stack, inherit the sovereign authority to govern the organisation using it.
Safety and sovereignty are not the same thing.
A system can comply perfectly with somebody else’s safety standard while still leaving the organisation operating it with very little meaningful control over its own digital environment.
Digital Sovereignty means retaining meaningful control over your infrastructure, your data, your intelligence, your policies, your authority and the decisions made inside your environment.
It does not mean rejecting Microsoft, OpenAI, Anthropic, Google, Amazon or any other global technology company.
It means understanding one fundamental distinction:
Participation is not ownership of the rulebook.
And industry coordination is not the same thing as independent governance.
Who Controls Whom?
The emerging AI-safety conversation is necessary.
The risks are real.
The expanding blast radius is real.
And the difficulty of governing increasingly autonomous systems is real.
But those realities cannot become justification for concentrating even more authority inside organisations that already control much of the technological stack.
They cannot build the intelligence, dominate the infrastructure, define the risks, become the referee, become the safety team, sell the solution and then determine what everybody else must buy in order to remain compliant.
At some point we have to ask a very basic question:
Who controls whom?
Digital Sovereignty requires more than safe artificial intelligence.
It requires independent control of artificial intelligence.
Capability is accelerating.
Access is expanding.
Authority and governance therefore cannot live merely inside the agent—or inside the company supplying the agent.
They must remain above both.
That is the architectural dividing line.
The world’s largest technology companies have more toys than anybody in history.
They have earned a seat at the table.
They have not earned ownership of the table.
And if we allow the companies that build the intelligence, supply the infrastructure and control the platforms to become the ultimate referees of that intelligence as well, the question will no longer simply be whether we have safe AI.
The question will be whether we still have Digital Sovereignty at all.
By Patrick Schoutes – Autonomos AI Autonomous Intelligence, Decision & Control Building Digital Sovereignty.