Mysten Labs, in collaboration with Google Cloud, has unveiled Verifiable Agent Arbiter (VAA), an evidence layer designed to prove that enterprise AI agents acted within the authority they were granted. The two companies are co-developing the system to give counterparties, auditors, and regulators a verifiable record of agent activity that is independent of the platform that produced it.
How Verifiable Agent Arbiter Works
VAA separates the record of an agent’s activity from the proof of its integrity. Detailed telemetry, including prompts, model outputs, tool calls, and policy decisions, remains private in customer-controlled Google Cloud Storage. Cryptographic proofs of that record are then stored on Walrus, the data platform built for AI workloads, and coordinated on Sui, the Layer 1 blockchain Mysten Labs originally contributed to.
The design targets several enterprise capabilities. Dispute replay across companies works through the Agent2Agent (A2A) protocol, which Google Cloud developed and donated to the Linux Foundation, letting two organizations replay a disputed workflow against the same verifiable receipts. Incident reconstruction helps security teams distinguish a prompt-injection attack from a policy bypass or a post-incident change to the logs. Durable record retention, meanwhile, can be re-proven under future cryptographic standards, including post-quantum, a direction Sui has already pursued through its own post-quantum signature schemes.
Why the EU AI Act Makes This Timely
Mysten Labs framed the launch around incoming regulatory pressure. The EU AI Act will introduce penalties of up to €15 million or 3% of global annual turnover from 2027 for logging failures. “AI agents are starting to make decisions with financial and legal consequences, and we need systems to ensure they cannot exceed their authority,” said Evan Cheng, co-founder and CEO of Mysten Labs. “This requires evidence any counterparty can verify.”
VAA also connects directly with the Sui Agent Payments facilitator, which lets agents discover services and settle payments for API calls instantly using the x402 protocol, while cryptographically logging the authorization, spending decisions, and service delivery behind each transaction.
What Happens Next
Mysten Labs said initial deployments with enterprise customers are planned ahead of broader availability, though it did not name the customers or give a general-availability timeline. The launch deepens Sui’s push into the agentic economy, a theme the network emphasized at its 2026 Basecamp conference in Singapore as AI agents move to transact across company boundaries. For now, the announcement leaves open which enterprises will first run agents under a credibly neutral proof-of-authority record.
