Pin the Run to the Region Its Data May Live In

An agent that calls services in several regions can move data across a boundary without any single step looking wrong, so the constraint has to be enforced on purpose.

Enforce in the routing layer

Decide where a run's data may live and route every tool call to that region. A pin stated in the prompt is a request; a pin in the routing layer is a rule.

def allowed(run, region):
    return region in run.permitted_regions

Refuse the leaky failover

If the permitted region is degraded and only a forbidden one is healthy, refuse the cross-region fallback and surface the constraint. Availability does not outrank the boundary.