SweeFi

SweeFi is the reference implementation of the mandate — the on-chain primitive behind everything else here. A human delegates bounded authority to an agent; Move enforces it at consensus; the human keeps a kill-switch the agent cannot reach.

The mandate, concretely

A Mandate<T> is a Sui owned object carrying a delegator (human), a delegate (agent), and the bounds: max_per_tx, max_total (with a monotonic total_spent ≤ max_total invariant), and an expiry. validate_and_spend runs atomically in the same transaction as the spend — exceed a cap and the whole PTB aborts; the money never moves.

• Deny-by-default. A fresh mandate authorizes nothing; a human adds explicit grants.
• Ratchet-up trust (L0–L3). Levels only increase, so an agent can't self-downgrade to dodge tracking.
• Publication mandates (P0–P2). Because agents cause harm with words, not just money.
• Consensus-enforced revocation. Revoke writes a flag to the human's registry; the agent's next validate_and_spend aborts ERevoked at consensus. It doesn't get a vote.
• AP2-compatible — aligned with the emerging Agent Payments Protocol, not invented in a vacuum.

A genuinely elegant detail

The agent holds its own mandate (an owned object — fast, no consensus overhead, no front-running), but revocation lives in a separate registry owned by the human. The mandate checks registry.owner == delegator on every spend — which rejects a different-owner registry forged to fake "not revoked." A subtler attack survives that check, though: a delegator owns many registries, so a rogue agent can present a same-owner one its mandate was never revoked in. The hardened cage (Swee AI) closes it — pinning the exact registry by object::id, a gap green tests missed and an adversarial bytecode audit caught. Complete mediation (Saltzer & Schroeder), earned the honest way: shipped, audited, hardened.

Proof

• Source + Move contracts: sweeinc/sweefi
• Deployed to Sui testnet.