Health is only one eligibility test for a route. Before dispatch, build the list of destinations allowed for this particular customer, data class, model capability, and contract. Failover chooses within that list. If it is empty, the assistant can return a bounded unavailable response or offer a workflow that genuinely stays inside the approved boundary. A “global” route does not become authorized because it is the last one alive. Whether a named provider's regional endpoint satisfies a particular agreement needs checking against that provider's current terms and the exact feature used. For example, OpenAI's data controls distinguish regional storage from regional processing, enumerate supported configurations, and state limits and exceptions. A regional hostname alone is not an end-to-end residency proof.

Map the data path, not only the model URL. The prompt assembler may read from a replicated index, send image bytes through a processor, reuse a provider cache, and emit traces into another region. Tool calls, safety systems, retries, human review, and error capture can make additional copies. A policy object should therefore describe permitted processing and storage destinations for each data class, with versioned evidence from the providers and infrastructure owners. Attach the policy decision and route identity to each request and check all outbound sinks. If one subsystem cannot keep the boundary, disable that path for this customer rather than claiming the whole request complies.

When the region fails, I would stop new effectful agent steps and preserve their state in an approved store. Reads from already authorized local data might still work, but a partial answer must say what was unavailable. One could prearrange a second compliant region, if the customer's contract and architecture permit it. That requires a rehearsed route with retrieval, keys, telemetry, and caches there, not an on-call edit to a router flag. If the contract allows explicit emergency export, that is a separate approval and auditable policy version. It is not implied by “restore service.”

How would I test it? Inject failure of the preferred endpoint and then every eligible endpoint. Capture actual network destinations, trace sinks, and provider project settings for a synthetic classified request. A canary that merely checks for HTTP 200 will reward the wrong behavior. The success case is a useful answer on an eligible route. The correct failure case is a clear stop when there is no eligible route.