The Caged Agent

The companion proof for SweeFi: an AI agent whose every payment is gated in the same atomic transaction by an on-chain mandate. Misbehaviour isn't discouraged — it can't settle.

The three acts

The script self-checks and exits non-zero on failure:

1. In-budget payment → settles. ✅
2. Over-budget payment (the agent goes rogue) → aborts on-chain at validate_and_spend. 🛑
3. Operator revokes, agent retries → aborts on-chain (ERevoked). The kill switch fired. 🛑

The mandate carries a per-call cap (0.01 SUI) and a lifetime cap (0.05 SUI). Every line is a real Sui testnet transaction — including the aborts. The over-budget abort is the artifact: proof the cage is enforced by Move code, not by trust.

Why it holds

Complete mediation (Saltzer & Schroeder) meets object-capability security: on Sui a capability is an owned object, and the check and the spend compose atomically in one transaction. The theft can't form; the kill switch actually fires.

It proves authority — well-formed, capability held, revocable — never that a spend is wise. It lowers P(catastrophe), not to zero. That restraint is the brand.

Run it

pnpm install --ignore-workspace
export SUI_TESTNET_PRIVATE_KEY=…   # a funded testnet wallet (the operator)
pnpm caged

Demo

Terminal recording lands here — watch the over-budget payment die on-chain.

Proof

• npm: @sweefi/sui — the SDK + mandate builders.
• Verified: typecheck green against the published packages; the three-act verdict issues real testnet transactions.