# Sovereign

**Sovereign** answers "**Is this user from a country I allow?**". The user proves they hold a genuine government document from a nationality on your allowlist. The allowlist is the entire configuration: there are no age or OFAC rules alongside it.

Where [Pre-KYC](/docs/self-enterprise/workspaces/pre-kyc/)'s country rules are one option among many, Sovereign is purpose-built for the "citizens of these countries only" case.

## What the user proves

- They hold a **genuine, government-signed document** (at your chosen [security level](/docs/self-enterprise/flows/disclosures/#security-level)).
- Their **nationality is on your allowlist**.

## What you receive

- A `valid` / `invalid` result via the [`verification.completed` webhook](/docs/self-enterprise/webhooks/events/).
- The user's **nationality**. Because the allowlist is checked against the holder's disclosed nationality, every Sovereign flow reveals it. This is the one predicate that implies a reveal. See [Disclosures](/docs/self-enterprise/flows/disclosures/#country-predicate).
- A [nullifier](/docs/self-enterprise/get-started/how-it-works/#one-account-per-person-nullifiers) for duplicate detection.

## Rules you can configure

| Rule | Default | Notes |
| --- | --- | --- |
| Security level | Hi-security | Standard also accepts non-chip documents. |
| Included countries | — | Required, non-empty. ISO 3166-1 alpha-3 codes, with region presets (EU, APAC, LATAM, GCC) in the picker. |

That's the whole workspace: no OFAC, no age, no denylist, no reveals beyond the implied nationality. On-chain Sovereign flows cap the allowlist at **41 countries**. See [Configuration limits](/docs/self-enterprise/flows/onchain-verification/#configuration-limits).

:::note
The allowlist needs the document to carry a verifiable nationality, so users verify with a document type that supports country rules. See [Supported documents](/docs/self-enterprise/flows/supported-documents/#which-document-satisfies-which-rule).
:::

## Use cases

- **National or regional services**: products for citizens of one country or bloc, such as government-adjacent services, national loyalty programs, domestic-only platforms.
- **Regulatory market restrictions**: offerings only available to residents of licensed jurisdictions (trading platforms, regulated goods), enforced with proof instead of an IP check.
- **Diaspora and community access**: communities, discounts, or benefits reserved for holders of a specific nationality.
- **Geo-fenced launches**: restrict a rollout to specific markets with document-grade assurance a VPN can't bypass.

## Cost

**10 credits** per completed verification. See [Credits and usage](/docs/self-enterprise/billing/credits-and-usage/).

## Related

- [Disclosures](/docs/self-enterprise/flows/disclosures/): why the allowlist reveals nationality and a denylist doesn't.
- [Configure a workspace](/docs/self-enterprise/dashboard/configure-a-workspace/): building the flow in the dashboard.
- [Workspaces overview](/docs/self-enterprise/workspaces/): compare all four workspaces.