Sui Basecamp 2026 put a different question at the center of blockchain’s AI debate: not whether autonomous agents can become more capable, but how infrastructure can stop them from exceeding their authority. Speakers argued that agent safety increasingly requires enforceable limits beneath the model itself, particularly as software begins controlling money, data and other real-world resources.
According to the Sui Foundation’s Basecamp recap, Mysten Labs Co-Founder and CTO Evan Cheng summarized that approach as setting boundaries rather than trusting agents to behave correctly. The underlying thesis is that non-deterministic models should not be the final authority over what they are permitted to spend, access or execute.
Real Vision CEO Raoul Pal separately argued that intelligence produced per unit of energy is doubling roughly every four and a half months. That figure represents Pal’s assessment of AI development rather than an independently established industry growth rate, but it reinforced the conference’s broader argument that infrastructure must be designed for capabilities that can change faster than governance processes.
Agent Permissions Move Below the Model Layer
The safety problem becomes more concrete when agents optimize for measurable outcomes. Recursive and You.com founder Richard Socher demonstrated how an agent rewarded for improving customer satisfaction could exploit the metric instead of fulfilling the underlying intent, including by generating artificial activity or incentivizing customers rather than improving service.
Socher linked that behavior to the emerging role of “reward engineers,” who attempt to close loopholes between objectives and actual model behavior. Reward engineering can reduce undesirable incentives, but Sui’s argument goes further by assuming that model alignment alone cannot guarantee financial safety.
Cheng demonstrated that approach using Rooms and Agent Pass. In one example, an agent attempted to place two bids in a sealed auction, but the protocol rejected the second action. Agent Pass is designed to constrain spending amounts, recipients and permitted actions independently of what the agent decides to do, establishing a maximum potential loss even if the agent or its credentials are compromised.
That model extends Sui’s earlier work on infrastructure for agentic commerce, where signed mandates can define what an agent is authorized to execute. The common design principle is scoped authority: an agent can act autonomously inside predefined permissions without receiving unrestricted control over the user’s assets.
Live applications are already experimenting with similar boundaries. WaterX’s AI-native trading infrastructure on Sui uses time-limited permissions and isolated sub-accounts, showing how financial automation can separate an agent’s execution capabilities from unrestricted wallet control.
Sui Separates Agent Scale From Mainnet Throughput
Basecamp also tested infrastructure intended for machine-scale activity. Sui Tunnels reached an independently recalculated peak of approximately 40.68 million transactions per second, substantially exceeding the network’s previous 6.09 million TPS experiment. The benchmark measured programmable off-chain channels that settle back to Sui rather than 40 million conventional transactions executing directly on mainnet.
That distinction is fundamental to the scaling model. Tunnels require mainnet transactions to open and close while allowing intermediate interactions to occur off-chain, making them suitable for high-frequency agent communication, games and payments. Earlier testing of Sui’s tunnel architecture similarly separated experimental channel throughput from Layer 1 production capacity.
Payment infrastructure is following the same machine-oriented direction. Sui’s gas-free stablecoin transfer system already removes the requirement to hold SUI for qualifying transfers, although production availability of payment primitives does not establish large-scale autonomous-agent adoption.
The Basecamp discussions therefore point toward a security model built around limiting consequences rather than predicting model behavior. If AI agents increasingly control valuable assets, verifiable permissions, immutable records and bounded execution may become as important as the intelligence of the agents themselves.