Swee AI

AI agents are starting to spend real money — and run away with it. (A single Claude Code session once dispatched ~300 sub-agents and burned $333 before anyone caught it.) Swee AI is the layer that governs an agent fleet: a custody cage caps and revokes the spend, and a routing oracle answers the question every fleet-runner actually has — "is the marginal spend worth it?"

The cage — enforced at consensus, not by prompt

The agent's budget lives in an on-chain Balance<T> inside a shared SpendCage; the agent's own wallet holds only gas. The single exit is withdraw_and_pay, which is bounded (per-call + lifetime caps), recipient-allowlisted (it can only pay addresses you pre-approved), and revocable (a shared kill-switch registry). The withdraw and the payment are fused into one transaction — a compromised agent can't withdraw-then-redirect.

Evidence — live-verified on Sui testnet

I ran a compromised-agent script against the deployed cage and watched the kill-switch fire, with real Move abort codes:

• in-budget spend → settles, the seller is paid
• over the per-call cap → aborts MoveAbort 803  EPerTxLimitExceeded
• a non-allowlisted payee → aborts MoveAbort 811  ERecipientNotAllowed
• after revoke → the next spend aborts MoveAbort 805  ERevoked; reclaim returns the remainder

Package 0x01d90f…7274 on testnet — verifiable on SuiScan. 509/509 Move unit tests green.

The routing oracle — "is it worth the spend?"

The other half of fleet cost isn't theft, it's waste: running Opus on work a $0.10 model would nail. The comparator fires one prompt at N models in parallel and reports real cost · latency · quality side by side — on one Sui-consensus question it measured a ~30× cost spread for comparable answers. Every run appends a routing.comparison event (bitemporal, content separated from metadata) — the seed of a data flywheel: which model wins at which task, routed on verifiable outcomes, not vibes. That data is the moat a price-only router (OpenRouter) can't buy.

A genuinely elegant detail

The cage binds its kill-switch to one registry by object identity (object::id), not by the registry's owner. The owner-bound version is a one-to-many check — a delegator owns many registries, so a compromised agent can present a second same-owner registry that was never revoked in, and walk around the kill-switch. 22 passing tests missed this; an adversarial audit of the actual bytecode caught it. The fix pins the exact registry at creation and asserts it on every spend and reclaim. Saltzer & Schroeder's complete mediation, the honest way — and a working reminder that green tests are not verification.

The honest claim

A compromised agent can't exceed your caps and can only pay addresses you pre-approved; revoke recovers the remainder. It does not make theft impossible — the delegate key is the authority, capped. Custody bounds the blast radius; it is not a co-signer. (The line matters: it's defensible, and it's true.)

Proof

• Cage: deployed + live-verified, testnet 0x01d90f…7274 (SuiScan).
• Comparator + flywheel: runs locally against live model APIs; each run mints a routing-outcome event.
• Agent memory on Walrus (decentralized, owned by the user — not a provider's server).