AI agents are starting to pay for things. On Sui, an agent can now pay a data service per request over HTTP 402, send USDC to a person, or swap coins, all in a second. That is useful. It is also a little terrifying: would you hand an agent your card?
Not as it is. Three things are missing.
Bounds the agent can't argue its way past. A system prompt saying "don't spend more than $2" is a suggestion, not a limit.
A memory of what was worth buying. Without one, an agent pays for the same useless source every time it plans the same task.
Receipts anyone can check. "Trust me, I spent it well" is not an audit trail.
MANDATE is my answer: a prepaid card for AI agents.
How it works
You sign in with Google. No crypto wallet, no seed phrase: zkLogin turns the sign-in into a Sui address only you control, and your agent is created for you. You set its rules once (a weekly allowance, a maximum per payment, an end date, and an auto-freeze if you stop checking in) and sign them into a mandate, a Move object on Sui. Then you add a little USDC, and you chat with your agent in plain words.
The key design choice is where the money lives. Your USDC sits inside the mandate, not in the agent's wallet. The only ways out are:
pay and begin_swap, which the agent calls, and which check every limit in the same transaction that moves the money. Over a limit, the transaction aborts and nothing moves.
withdraw, which only the owner can call, at any time, even after stopping the mandate.
Swaps go through Aftermath's router, and the output is handed to the owner by finish_swap, enforced by a ticket with no abilities, so swap proceeds never land in the agent's wallet.
The agent's keys are held by our server (encrypted), so it can act without you signing every purchase. Because the money and the rules are on chain, the worst a leaked key could do is spend within your limits, and you can stop it and take everything back from your own sign-in. I wrote that down plainly in the threat model rather than calling it "trustless".
Tatum on the critical path
MANDATE runs on Tatum's paid plan, and Tatum's Sui gRPC gateway is how the agent touches the chain: every mandate read, every transaction built, submitted and confirmed, and, importantly, every payment re-read and verified before it counts. The Explorer shows 100% of payments checked this way.
Tatum also powers the data side: a free Tatum security check runs before any purchase (a sanctioned wallet gets answered without spending a cent), two of the paid data services are built on Tatum's Data API, and full task reports are archived on Walrus through Tatum's Storage API.
Learning what's worth paying for, with Walrus Memory
After a task, you rate each paid source: useful or useless. Each rating becomes a versioned memory in Walrus Memory, one namespace per service and task type. Before buying, the agent recalls those memories and computes a pessimistic usefulness score. A source that keeps disappointing gets skipped.
Memory also drives policy. From your ratings the agent can suggest blocking a service. It can only suggest: the change happens when you approve it, which signs a transaction on Sui, and the approval itself is remembered with its digest.
To measure this honestly, I replayed the same 50 tasks on mainnet twice, with real payments: once with memory off, once with memory on, starting empty. A deterministic rater scored both runs the same way.
Memory off Memory on Change
Wasted spend 1.25 USDC 0.18 USDC -86%
Cost per useful answer 0.05 USDC 0.03 USDC -43%
Useful answers 50 48
And because it's Walrus Memory, the memory isn't locked in my app. In the demo, Claude Code reads the same namespaces through the official Walrus Memory MCP server and explains what the agent bought and why it stopped paying for a service.
What it can do today
Buy information from data services that charge per request over HTTP 402 (MPP on Sui).
Send money once or on a schedule ("send 5 USDC to Ada every week").
Swap USDC into SUI, WAL or DEEP at the best route, once or every week.
Show a receipt for every task: what it bought, what it skipped and why, and each payment linked to Suiscan.
Everything is live on Sui mainnet with real USDC: over 220 payments so far, all public in the Explorer.
What I'd do next
All three data services today are mine; the next step is plugging in third-party MPP services. Swap output goes to your wallet rather than back into the mandate, because applying dollar limits to other coins needs a price feed. And the agent's keys could move off the server entirely with a wallet that supports scoped session keys.
Try it
Live app: https://mandate-gules-five.vercel.app
Demo video: https://youtu.be/jqGgQjtLf-E
Explorer: https://mandate-gules-five.vercel.app/explorer
Code and docs: https://github.com/da-b0s/mandate
Built for the Total Recall hackathon with @tatum_io, @WalrusProtocol, @WalrusFoundation and @SuiNetwork.
Top comments (0)