The Gulf conversation about sovereignty has quietly moved on, and a fair few architectures haven't caught up.
For a few years the question was location. Is the data in-country, and can we prove it stays here. That question matters, and the regulations are right to ask it, but it was always the easy half. Storage is the part you can point to on a diagram.
The harder question is who holds the controls. Who holds the encryption keys. Who can grant or revoke privileged access. Who patches the platform, ships the updates, and runs the incident response at three in the morning when something breaks. If those answers sit with a party outside the jurisdiction, you have data that lives locally and authority that does not. That is residency. It is not sovereignty, whatever the brochure says.
This is the bit mature markets learned the hard way, so it's worth borrowing the lesson rather than paying for it again. The control plane rarely appears on the architecture diagram. It lives in the runbook, the access model and the escalation path, which is how it survives procurement unexamined and surfaces at the worst possible hour.
None of this is an argument against global platforms. It's an argument for being honest about the line. Decide which workloads genuinely need local control over keys, identity, access and operations, and which can sit perfectly well on a global region with residency alone. Draw that line yourself, in the architecture, before a regulator or an incident draws it for you.
The storage was always the straightforward part. The control plane is where sovereignty is quietly kept or quietly lost.