Sui is developing a set of infrastructure tools designed to let AI agents control assets and execute transactions without receiving unrestricted authority over a user’s account. In the official Sui analysis on agent authority, the network frames the security problem around enforceable limits rather than expecting an AI model to reliably obey instructions. Owners could define budgets, approved applications, spending windows and expiration conditions that remain binding even when an autonomous agent makes an incorrect decision or encounters malicious input.
The approach centers partly on Sui Agent Pass, which builds on the network’s object-oriented architecture to create agent accounts with owner-defined restrictions. Agent Pass is intended to constrain spending amounts, recipients and permitted actions independently of the agent’s reasoning process or credentials. The framework remains under development, however, alongside Rooms, Warrant and the Verifiable Agent Arbiter; it should not yet be described as generally available production tooling.
Sui Moves Agent Permissions Outside the AI Model
The design extends the broader concept of bounded authority for agentic commerce, where cryptographic permissions establish what software is allowed to execute on behalf of a user. The objective is to separate intelligence from authority: an AI can decide how to accomplish a task while infrastructure independently determines whether the resulting action is permitted. This avoids relying exclusively on prompts such as “never spend more than $100,” which can be forgotten, misinterpreted or bypassed by a compromised model.
Sui’s Programmable Transaction Blocks add another component by allowing multiple commands to execute atomically. A PTB can combine permission checks, transfers and application calls into one transaction, with all operations succeeding together or none taking effect. Atomicity prevents a multi-step on-chain workflow from being left partially executed, but it does not itself prevent prompt injection or guarantee that an agent made the correct decision. Those protections depend on the permission rules imposed around the transaction.
The same distinction appeared during Sui Basecamp’s demonstrations of protocol-enforced AI boundaries. In one auction example, an agent attempted an action that violated the room’s predefined rules and the system rejected it. The relevant security property was not that the AI recognized its mistake, but that the surrounding infrastructure refused to execute an action outside its allowed conditions.
On-Chain Rules Can Limit the Cost of Agent Failure
Production applications are already experimenting with narrower versions of this model. WaterX uses time-limited permissions and isolated sub-accounts for AI-assisted trading on Sui, separating automated execution from unrestricted wallet control. Those mechanisms demonstrate bounded financial authority in a live application, although they are distinct from the still-developing Agent Pass framework.
Other networks are pursuing similar permission architectures through different implementations. Hedera’s Agent Accounts use programmable spending allowances, transaction limits and recipient controls intended to let agents request payments without possessing an owner’s private keys. The common design problem is increasingly not whether an AI can initiate a blockchain transaction, but how much authority it should receive and how that authority can be revoked or constrained independently of the model.
Sui is extending that concept beyond payments through Warrant for policy-controlled external actions and the Verifiable Agent Arbiter, being co-developed with Google Cloud, for cryptographic evidence about whether agents remained within authorized boundaries. These systems remain under development, while Sui Agent Payments is currently the component demonstrating scoped payment authority on testnet. The framework therefore establishes a technical direction for verifiable, bounded autonomy rather than a finished production security stack for autonomous agents.