Give Agents Authority While Keeping Control

Main takeaways

• Agents need enough authority to complete tasks, with limits enforced by the systems they use.
• Across businesses, participants need shared terms and records they can independently verify.
• Sui lets developers enforce permissions and combine onchain actions into transactions that complete in full or fail together.

Earlier this year, an alignment director at Meta Superintelligence Labs set an agent to work on her email with a clear instruction: suggest what to archive or delete, but don’t do anything until told. By her account, as the agent’s memory filled up, it summarized its earlier notes to make room, and the instruction didn’t make the cut. It deleted hundreds of emails before she could reach the machine to stop it. Summer Yue’s experience exposes a gap that could become more commonplace as we delegate work to agents: telling an agent what it can do is not the same as being able to prevent it from doing what you don’t want it to.

An assistant’s bad answer can waste your time. An agent with access to money, customer records, or production systems can do damage that is hard to undo. A hallucination or act of over-agency can spend funds, expose sensitive information, or erase critical data in seconds, before anyone can intervene. 

But requiring human approval for every action defeats the purpose of autonomous agents. To be useful, agents need the freedom to act, but within clearly defined boundaries that businesses can enforce and with verifiable records of every action they take. 

Limits make delegation possible

Consider an employee receiving a company credit card. The employer restricts spending amounts and purchase categories, but within those limits, the employee can book the flight, entertain clients, or replace a broken laptop without asking for approval on every purchase. The card system automatically enforces those limits, declining purchases that fall outside them. The guardrails don’t restrict independence. The limits make independence possible.

Agents need the same arrangement. People set the goals and the boundaries, and the agent decides how to work within them, including which tools to use, services to buy, and participants to work with. If an agent hands part of the task to another agent, it should only be able to pass along authority it already holds, within the original limits. 

Today, an agent’s boundaries often exist only as instructions it is asked to follow. To hold when the agent misunderstands a task or is fooled by something it reads, those boundaries need to be enforced by the systems it uses.

Microsoft CEO Satya Nadella made this case in a recent essay, arguing that businesses should treat AI models as insider risks. Even without malicious intent, a capable model with access to important systems can make mistakes or be compromised. The controls on what a model can reach and do, he argues, belong outside the model.

Better models and clearer instructions help, but they do not replace controls over the resources an agent can use. Agents already have the intelligence for consequential work; what they lack is authority people are willing to grant, and enforceable limits are what make granting it possible.

When work crosses company boundaries

The company card comes with an established system for enforcing limits. That gets harder when an agent works across services, each with its own permissions and records. A buyer may have spending rules using certain terms, while a seller uses other language for the same things. Across organizations, the system granting authority may no longer control where that authority is exercised.‍

The records are divided too. A seller can say an order was accepted while a buyer defines acceptance as after different thresholds are met. Participants need common terms, a way to enforce them, and evidence they can check independently.

A single platform can provide this when everyone accepts its authority. But businesses also need to transact without giving one participant control over the interaction or its record. As Najwa Aaraj, CEO of the Technology Innovation Institute, wrote in Fortune, “No single cloud provider or model developer can be the sole authority on trust.”

A shared foundation for agents to act

Sui’s design offers infrastructure to support business requirements for agents, the ability to set common terms, a way to enforce them, and immutable evidence each side can check. No single buyer, seller, or application operator controls the network. 

Developers can define assets and conditions for their use, so the terms travel with the asset rather than sitting in one company’s system. Those conditions are checked as a transaction executes, and developers can combine actions across applications into one transaction that completes together or fails together. Afterward, participants can independently verify the result.

Consider an agent buying research services. Its owner could grant a budget bound to an approved app, with a cap, a spending window, and an expiry. A payment outside those conditions does not settle. Sui Agent Payments, now on testnet, demonstrates this approach.

An agent exchanging onchain assets can require both transfers to complete in a single transaction. If either fails, neither takes effect. The agent does not have to send an asset first and hope the other party follows through.

These transactions can combine permission checks, transfers, and settlement across applications. The shared record lets participants verify which assets moved, between whom, and whether the transaction completed, without relying solely on another participant’s logs.

What happens when an agent breaks the rules?

At Sui Basecamp this year, Evan Cheng, Mysten Labs Co-Founder and CTO, demonstrated this with an auction in Rooms. A room is a space a business sets up on its own site where AI agents can interact. The business writes the rules of the room, and the room itself enforces them. A unique fingerprint of those rules is published on Sui, and every decision in the room is anchored there, so no one can quietly change a rule, and anyone can check what happened.

Participants had to commit to bids before revealing them, and bids stayed sealed until the room’s rule allowed them to be opened. When one agent submitted a number that did not match its commitment, the bid was rejected. “This is not the agent making a decision here,” Evan said. “This is the [room].” 

‍

‍

In an encore, the agent that had won the first auction came back for a second unit. The business’s rule, one per customer, checked its own order records and turned the agent away, with the receipt on screen. No participant could grant an exception, because a room’s rules can be narrowed after it opens and never widened.

The demonstration shows agents choosing their own strategies while shared rules determine which actions can take effect. The same principle can support purchases, payments, and agreements among independent participants.

Where those rules are enforced matters. Sui enforces rules directly on the assets and applications that live on it. For actions in other systems, like deleting an email or changing a customer record, Warrant checks each action against the owner’s policy before it proceeds. The policy’s code is published on Sui and every decision names the version it ran under, while the owner’s own limits stay private. A transaction record still proves only what it captures: a completed payment does not show that a package arrived or that the research was useful.

Rooms and Warrant were two of several products introduced at Sui Basecamp. Sui Agent Pass builds on Sui’s object model to give agents onchain accounts with owner-set limits, and the Verifiable Agent Arbiter, an evidence layer being co-developed with Google Cloud, lets enterprises prove their agents stayed within their authority, keeping detailed records private while storing cryptographic proofs on Walrus, coordinated on Sui, for anyone to verify. All of these products are currently in development.

Don’t trust the agent. Trust the rules.

Models will continue to improve and change. The desire to use agents for more substantial work will only grow. But so too will the potential risk and hesitation of businesses concerned about agents that go beyond what was prescribed. This will only increase the need for a trusted control plane where the rules of an interaction remain binding no matter who or what is acting, and where anyone involved can reliably check (and trust) what happened. Sui is where those rules and records live beyond any one participant’s control. No matter the model or agent, the rules you set stay in force, which means you can finally let agents do the work you hired them for.