Mysten Labs and Google Cloud on October 6, 2026, unveiled the Verifiable Agent Arbiter (VAA), an evidence layer that lets enterprises cryptographically confirm their AI agents operated within the authority they were granted. The product targets a gap that widens as agents take on booking, purchasing and negotiating tasks on behalf of companies: proving, after the fact, what an agent actually did and whether it exceeded its mandate.

The design splits agent activity into two tracks. Telemetry — prompts, outputs, tool calls and policy decisions — is stored in Google Cloud Storage buckets controlled by the customer. The cryptographic proofs tied to that activity are stored separately on Walrus, Mysten's decentralized data platform built for AI workloads, and coordinated on the Sui Layer-1 blockchain.

That separation is the core architectural choice. Sensitive business data stays inside the enterprise's own cloud environment, while the tamper-evident record of its integrity sits on infrastructure no single party can quietly edit.

What does the Arbiter actually do?

Mysten and Google Cloud position VAA for four operational jobs:

• Dispute resolution. When two agents disagree about what happened in a transaction, VAA can replay the exchange through Google's open Agent2Agent (A2A) protocol, which Google has contributed to the Linux Foundation as a shared standard rather than a proprietary product.
• Incident reconstruction. If an agent goes off its rails or a security event occurs, teams rebuild the sequence of actions from tamper-evident records rather than scattered logs.
• Long-term retention. Stored records are built to be resilient against quantum computing threats, according to the two companies.
• Agentic commerce. VAA integrates with Sui's Agent Payments facilitator and uses the x402 protocol for service discovery and near-immediate settlement.

Mysten Labs CEO Evan Cheng framed the product as a mechanism for making agent behavior both verifiable and accountable, saying VAA is meant to ensure that an agent's authority cannot be exceeded.

Why now? Regulators are setting deadlines

The timing tracks a hard compliance horizon. The EU AI Act comes into force in 2027, and noncompliance can draw fines of up to €15 million or 3% of global annual turnover. An auditable, cryptographically anchored record of agent decisions gives enterprises a defensible artifact when that enforcement window opens — and gives the VAA pitch a regulatory dimension that pure logging tools lack.

A deepening Mysten–Google relationship

The partnership extends an existing line of cooperation. In September 2025, the Sui blockchain added support for Google's Agentic Payments Protocol (AP2), focused on letting AI agents handle payments. VAA moves the relationship from payments into accountability: the first project helped agents spend money; this one helps companies prove the spending was authorized.

VAA also draws on the broader Sui Stack — Sui, Walrus, Seal and Nautilus — which Mysten positions as tooling for verifiable execution and data provenance in enterprise settings.

What it means for both sides

For enterprises, the model keeps raw data within the company's own Google Cloud environment while allowing integrity checks against public infrastructure. For the Sui ecosystem, the partnership is a distribution win: Google Cloud brings enterprise relationships that most Layer-1 networks would struggle to reach independently, and Walrus gets a high-profile workload matching its design brief.

Because VAA orchestrates proofs on Sui and stores them on Walrus, enterprise adoption could translate into more on-chain activity for both networks — though how many enterprises move beyond initial deployments remains unknown. The rollout is staged, with initial enterprise deployments first and broader access planned afterward.

The signals to watch are the pace of VAA's move from initial deployments to general availability, A2A adoption under the Linux Foundation, and whether agent payments through x402 and Sui's facilitator gain traction beyond pilots — all before the EU AI Act's 2027 compliance deadline reshapes demand for verifiable agent records.