Google Cloud and Mysten Labs Build Verifiable AI Agent Compliance on Sui

Google Cloud and Mysten Labs announced Verifiable Agent Arbiter (VAA) on 6 October 2026, a system designed to help enterprises verify whether AI agents acted within their authorised permissions. 

The solution uses Sui to coordinate verification and Walrus to store cryptographic proofs, while detailed activity logs remain in customer-controlled Google Cloud Storage.

The announcement addresses a growing challenge as AI agents take on tasks involving transactions, payments and business decisions. 

Companies need evidence that automated systems followed their instructions, particularly when actions have financial or legal consequences. VAA aims to make that evidence independently verifiable without placing sensitive operational records directly on a blockchain.

Initial enterprise deployments are planned before broader availability. The next important developments will be implementation details, customer adoption and how the system supports real-world compliance requirements.

Google Cloud and Mysten Labs are building an evidence layer on Sui that proves AI agents stayed within their authority, with proofs stored on Walrus. Detailed agent logs stay in customer-controlled Google Cloud Storage. @SuiNetwork https://t.co/HzPHIbWM5a

— MSB Intel (@MSBIntel) October 14, 2026

Key Takeaways

• Verifiable Agent Arbiter (VAA) is being co-developed by Google Cloud and Mysten Labs to help enterprises verify whether AI agents stayed within their authorised permissions.
• Sui and Walrus have distinct roles: Sui coordinates verification, while Walrus stores cryptographic proofs. Detailed prompts, model outputs and tool calls remain in customer-controlled Google Cloud Storage.
• Enterprise adoption remains an important milestone. Initial deployments are planned, but the announcement does not establish general availability or prove that VAA alone guarantees regulatory compliance.

What Is Verifiable Agent Arbiter (VAA)?

Verifiable Agent Arbiter is an evidence layer being developed by Mysten Labs in collaboration with Google Cloud. Its purpose is to help businesses demonstrate that their AI agents acted within the permissions and limits assigned to them.

An AI agent can do more than generate text. Depending on its configuration, it may call external tools, execute workflows, communicate with other agents or initiate transactions. 

These capabilities create a governance challenge: organisations need to establish not only what an agent produced, but also whether its actions were authorised.

VAA is designed to address that gap by connecting activity records with cryptographic evidence that can be checked independently of the system that generated them.

The project has three main infrastructure components:

• Google Cloud Storage: Keeps detailed AI agent activity records under customer control.
• Walrus: Stores cryptographic proofs associated with those records.
• Sui: Coordinates the verification process through its Layer 1 blockchain infrastructure.

The distinction between records and proofs is central to the design. Rather than publishing every prompt, model response and tool call on a blockchain, VAA separates sensitive operational data from the evidence used to verify its integrity.

However, VAA should not be confused with a system that guarantees every AI decision is correct. Its stated purpose is to help establish what an agent did and whether its actions stayed within the authority it was given.

How Google Cloud, Sui and Walrus Work Together

The collaboration combines cloud-based data management with blockchain coordination and cryptographic verification. Each component serves a different function within the proposed system.

Google Cloud Storage Keeps Detailed Logs Private

AI agent logs can contain sensitive business information, including user instructions, internal policies, model outputs and records of interactions with external tools.

VAA is designed to keep this detailed telemetry in Google Cloud Storage controlled by the customer. This allows businesses to retain their operational records without placing the complete contents of every AI workflow on a public blockchain.

Customer control over the logs is important for enterprises that must manage confidential information and restrict access to authorised personnel.

It also separates data storage from verification. An organisation can retain its detailed records while using cryptographic evidence to support an audit or investigate a disputed action.

Walrus Stores Cryptographic Proofs

Walrus is a decentralised data platform developed by Mysten Labs. Within the VAA architecture, it is intended to store cryptographic proofs associated with AI agent activity.

These proofs provide a way to check the integrity of recorded evidence without requiring all underlying information to be publicly accessible.

For example, if a company needs to investigate whether an AI agent's activity record was altered after an incident, cryptographic evidence could help establish whether the record remains consistent with the proof created for it.

The distinction matters because storing a proof is not the same as publishing the original data. Sensitive prompts and business records can remain in customer-controlled storage.

The practical effectiveness of this approach will depend on the implementation, the records captured and the procedures used to verify them.

Sui Coordinates Verification

Sui provides the blockchain layer for coordinating VAA's verification process.

Blockchain-based coordination can help establish a shared reference for evidence across organisational boundaries. This is particularly relevant when two companies use separate AI systems but need to establish what happened during a joint workflow.

Sui's role does not mean that every AI operation must execute directly on the blockchain. Instead, the architecture separates the detailed operational workload from the cryptographic evidence used to support verification.

For the Sui ecosystem, this represents a potential enterprise use case beyond conventional blockchain transactions. It connects blockchain infrastructure with AI governance, automated business processes and verifiable records.

Why AI Agent Compliance Matters for Enterprises

AI agents are increasingly designed to perform tasks with limited human intervention. In enterprise environments, those tasks may involve financial commitments, access to business systems or decisions that affect customers and commercial partners.

Greater autonomy creates a need for stronger oversight.

A company might give an agent permission to purchase a service up to a specified budget. If the agent exceeds that limit, the organisation needs to determine whether the cause was a faulty instruction, a policy enforcement failure, a security attack or a problem with the model itself.

Ordinary activity logs can help answer these questions, but disputes become harder when different organisations hold separate records that do not agree.

VAA is intended to provide verifiable evidence that can support investigations and establish a clearer account of an agent's actions.

Its announced enterprise capabilities include the following.

Cross-Company Dispute Resolution

When AI agents from different organisations interact, each party may maintain its own records of the same workflow.

VAA is designed to let both parties replay a disputed process against shared, verifiable receipts. The goal is to clarify what was authorised, what was delivered and where a workflow failed.

This could be useful in automated procurement, service delivery and business-to-business transactions. However, the system's actual ability to resolve disputes will depend on the completeness of the evidence and whether the relevant parties can access and interpret it.

Security Incident Investigation

A compromised or poorly configured AI agent can produce actions that fall outside its intended boundaries.

VAA is designed to help security teams reconstruct the instructions, policies, decisions, outputs and tool calls associated with a suspected incident.

That evidence could help investigators distinguish between prompt-injection attacks, policy bypasses, model failures and subsequent changes to activity logs.

The objective is to make investigations more evidence-based rather than relying solely on an AI system's own explanation of its behaviour.

Long-Term Evidence Retention

Enterprise records may need to remain verifiable long after the original AI model or software environment has changed.

Mysten Labs says the VAA design supports re-proving archived evidence under future cryptographic standards, including post-quantum standards, while preserving its connection to the original record.

This is a proposed capability rather than a guarantee that every future cryptographic transition will be seamless. Its value will depend on the implementation and continued support for the verification process.

VAA and the EU AI Act: What Businesses Should Understand

Regulatory compliance is one of the stated reasons for developing VAA.

The EU AI Act introduces obligations for certain AI systems, including requirements relating to documentation, record-keeping and oversight, depending on the system and the applicable provisions. Some requirements are particularly relevant to high-risk AI systems.

Mysten Labs has positioned VAA as a potential tool for helping enterprises maintain evidence of AI agent activity as regulatory expectations increase.

However, using VAA would not automatically make an organisation compliant with the EU AI Act or any other regulation. 

Compliance depends on the applicable legal requirements, the system's classification, the quality of its records and the organisation's wider governance arrangements.

A verifiable activity record can support an audit, but it does not independently establish that an AI system's decisions were lawful, fair or appropriate.

Businesses considering this type of infrastructure should therefore evaluate VAA alongside their existing access controls, monitoring procedures, incident-response plans and compliance processes.

How VAA Could Support AI Payments and Agentic Commerce

The announcement also describes a connection between VAA and the Sui Agent Payments facilitator, which uses the x402 protocol to support payments for API calls.

This is relevant to the development of agentic commerce, in which AI agents discover services, interact with providers and settle payments as part of an automated workflow.

In such a system, verifying that a payment occurred is only one part of the challenge. Businesses may also need evidence of why the payment was authorised, which spending limits applied and whether the promised service was delivered.

VAA is designed to record evidence relating to authorisation, spending decisions and service delivery.

Consider an AI agent authorised to purchase an API service within a predefined budget. If a dispute arises, verifiable records could help establish the permissions given to the agent, the spending decision it made and the result of the transaction.

This could make automated commercial workflows easier to audit across organisations.

The announcement does not, however, establish that all agentic commerce transactions will use VAA or that the system is already available for general commercial deployment.

What the Google Cloud and Mysten Labs Collaboration Means for Sui and Walrus

The collaboration gives Sui and Walrus a proposed role in enterprise AI infrastructure.

For Sui, the use case centres on coordinating evidence that can be independently checked. 

For Walrus, it involves storing cryptographic proofs associated with AI activity records. Google Cloud provides the environment in which detailed customer-controlled logs are retained.

This division of responsibilities could be relevant as enterprises seek to use AI agents without losing visibility over their actions.

The announcement also reflects a broader technical challenge: AI systems can operate across different applications and organisations, but their activity must remain accountable even when no single party controls the entire workflow.

Nevertheless, the announcement alone does not establish how much demand VAA will generate for SUI or Walrus-related infrastructure. 

That will depend on implementation, enterprise adoption, usage patterns and the economic design of the system.

For those following Sui's development, the most meaningful indicators will be the transition from announced capabilities to operational deployments, the number and type of enterprise customers involved, and evidence that the architecture works in real business environments.

What Happens Next for Verifiable Agent Arbiter?

Mysten Labs has said that initial enterprise deployments are planned ahead of broader availability. A general release date was not established in the announcement.

Several developments will help determine whether VAA becomes a practical enterprise tool:

• Enterprise deployments: Whether initial customers put the system into production and use it for real workflows.
• Verification and access controls: How counterparties, auditors and regulators can check evidence without unnecessary exposure of confidential records.
• Regulatory integration: How organisations incorporate VAA-generated evidence into their existing compliance and auditing procedures.
• Commercial adoption: Whether enterprises find the architecture sufficiently useful, reliable and cost-effective to deploy at scale.

These milestones matter more than the announcement alone. A proposed evidence layer must demonstrate that it can produce reliable records, support meaningful investigations and integrate with the systems businesses already use.

For now, VAA is a developing collaboration with a defined technical objective rather than a universally available compliance solution.

Explore AI Trading Tools on Bitrue

While Verifiable Agent Arbiter focuses on the verification and governance of enterprise AI agents, AI is also being applied to cryptocurrency trading through automated strategies.

Bitrue's AI Bot provides users with access to data-driven trading strategies and automated market monitoring. These tools serve a different purpose from VAA: they help users execute trading strategies rather than establish cryptographic evidence of enterprise AI activity.

Eligible users can also explore the Bitrue AI Bot campaign, which offers campaign benefits subject to eligibility and terms.

New users may qualify for a 500 USDT Position Trial Voucher after completing an eligible first trade. Existing eligible users may qualify for a 100 USDT voucher. Additional benefits include up to 200 USDT in loss compensation and up to 50 USDT in rewards for a qualifying profitable trade, subject to the campaign conditions.

The advertised benefits are not guaranteed cash earnings. Trial vouchers and funds are subject to eligibility, availability and campaign rules, and standard trading fees still apply.

Looking to explore how AI can support your crypto trading journey? While comparing Gemini and ChatGPT helps you understand the capabilities of different AI models, Bitrue offers dedicated AI-related features and strategies for crypto users. 

Explore the Bitrue AI platform, discover Bitrue AI Strategy, or check out the Bitrue AI campaign to learn more. Visit the available pages to review their features and terms before getting started.

Conclusion

Verifiable Agent Arbiter brings together Google Cloud, Mysten Labs, Sui and Walrus to address a specific challenge in enterprise AI: proving that automated agents acted within their authorised limits.

Its architecture separates sensitive activity logs from cryptographic proofs, with Google Cloud Storage retaining detailed records, Walrus storing proofs and Sui coordinating verification. 

The proposed capabilities include cross-company dispute resolution, incident reconstruction and evidence retention.

The next test is practical adoption. Initial enterprise deployments, transparent implementation details and demonstrated verification workflows will help determine whether VAA can become a useful part of enterprise AI governance.

FAQ

What is Verifiable Agent Arbiter?

Verifiable Agent Arbiter (VAA) is an evidence layer being developed by Mysten Labs and Google Cloud to help enterprises verify whether AI agents acted within their authorised permissions.

How does VAA use Sui and Walrus?

VAA uses Sui to coordinate verification and Walrus to store cryptographic proofs of AI agent activity. Detailed operational logs remain in customer-controlled Google Cloud Storage.

Does Verifiable Agent Arbiter store AI prompts on the blockchain?

The announced design keeps detailed telemetry, including prompts, model outputs and tool calls, in customer-controlled Google Cloud Storage. Cryptographic proofs are stored on Walrus and coordinated through Sui.

Does VAA guarantee compliance with the EU AI Act?

No. VAA is designed to support evidence collection and auditing, but regulatory compliance depends on the applicable requirements and an organisation's broader governance practices.

Is Verifiable Agent Arbiter available to the public?

Mysten Labs has announced plans for initial enterprise deployments before broader availability. The announcement does not establish a general public release date.