You signed the contract for the enterprise identity suite after the vendor demo showed clean compliance dashboards. Those dashboards never exposed that every token refresh pulls attributes from the nearest regional replica regardless of the residency contract you negotiated.
The platform treats replication as a reliability feature, not a boundary violation. Session attributes, group memberships and recent access decisions travel to whichever edge node answers first.
Your legal team accepted the clause that data at rest stays in-region. The vendor quietly redefined at rest to exclude anything required for live authentication.
When the next incident review arrives, the logs show only the final grant decision. The replica hop that supplied the attributes stays invisible to both your SIEM and the regulator.
Procurement scored the vendor highest on uptime and support response. Residency controls scored as a separate checkbox that no delivery milestone ever tested.
Teams now route every new workload through the same provider because the login flow already works. Each additional integration hardens the assumption that global replication is non-negotiable.
Fix the gap at contract renewal by demanding an auditable token path that stays inside the declared jurisdiction, or accept that the residency promise was never operational.