Sui Foundation mandates system-enforced AI agent permissions

The Sui Foundation published a design note on October 28 arguing that boundaries for artificial intelligence agents must be enforced by the systems they use, rather than relying solely on instructions the agent is expected to remember. The document outlines a framework for using onchain atomic transactions and verifiable records to constrain agent execution and ensure auditability in multi-organization workflows.

The note addresses the tension between giving an agent enough authority to complete tasks without constant approval and maintaining effective boundaries if the agent misunderstands an instruction or encounters misleading information. It is presented as an analytical design principle for building safer workflows, not a claim that all AI agents on the Sui blockchain have become reliable or that the blockchain automatically supplies every required control.

Enforced Permissions Versus Instructions

The design note distinguishes between telling software to spend less than a limit and giving it credentials that cannot authorize a payment above that limit. The first approach depends on the agent interpreting and following a rule, while the second can reject an action even if the agent has made a mistake in interpreting the rule.

According to the Foundation, effective deployment requires both a sensible objective and a mechanism that constrains execution. The note emphasizes the need for shared terms and verifiable records when multiple organizations participate in agent workflows. This ensures that boundaries remain effective regardless of the agent’s internal state or potential errors in logic.

Atomic Transactions and Delegation Limits

Sui’s programmable transaction documentation describes grouping multiple commands so their state changes apply together. If a command in a grouped transaction fails, the group does not leave intended asset changes half-completed. This atomic execution helps automated workflows where several onchain steps depend on each other, such as a purchase and the subsequent movement of the acquired asset.

However, the note states that transaction costs still need to be considered even when using atomic transactions. Atomic execution controls how a set of operations completes but does not establish if the price was sensible or the recipient was appropriate. It does not verify that an external service delivered what it promised.

The document also addresses delegation, where an agent calls another service or delegates part of a task. A robust design would make permissions visible, specifying a budget, approved purpose, expiry, and a limited set of counterparties. The system should check these delegation conditions at the point where an action is authorized to prevent the scope of authority from accidentally widening.

Verifiable Records and Operational Evidence

When several businesses interact through software agents, a shared record helps establish which action was authorized and which transaction occurred. This is useful for reconciliation and investigation, particularly when each participant keeps its own internal systems. However, the note clarifies that a successful onchain transaction does not prove that a customer received a physical good, that an invoice was genuine, or that offchain input was accurate.

Developers are responsible for implementing rules correctly and accounting for actions that occur outside the chain. The strongest implication of the design note is to start with narrowly defined authority, enforce it at the system boundary, and make completed actions inspectable. The scope of agent authority should only be expanded when controls and operational evidence justify doing so. The quality of an AI agent depends on the complete application, including its permissions, information sources, and response to unexpected workflows.