Google Cloud and Mysten Labs are building a blockchain-backed audit trail for AI agents

Google Cloud and Mysten Labs are developing a system to help companies check what their AI agents did and whether those actions stayed within authorized limits. Called Verifiable Agent Arbiter (VAA), it would give business partners, auditors and regulators a shared way to verify activity records.

Mysten Labs, the original contributor to the Sui blockchain, announced the collaboration on Oct. 6. Google Cloud is part of Alphabet (GOOGL). Initial enterprise deployments are planned before broader availability, but Mysten named no customers and gave no launch date.

Private records, verifiable proofs

According to Mysten, detailed records, including prompts, model outputs, tool calls and policy decisions, would remain private in customer-controlled Google Cloud Storage. Cryptographic proofs of those records would be stored on the Walrus data platform and coordinated on the Sui blockchain.

The company described how VAA could help resolve disputes between businesses whose agents interact through the Agent2Agent protocol, which Google developed and donated to the Linux Foundation. Both sides could review and replay a disputed workflow using the same records.

Security teams could also use those records to investigate suspected rogue actions and distinguish between a prompt-injection attack, a policy bypass and a model failure, Mysten said.

Mysten points to EU logging rules

Mysten says VAA could help companies meet the EU AI Act's record-keeping requirements for high-risk AI systems. Those requirements include automatic logging to support traceability, with deadlines varying by system type.

"AI agents are starting to make decisions with financial and legal consequences, and we need systems to ensure they cannot exceed their authority. This requires evidence any counterparty can verify," said Evan Cheng, Mysten Labs' co-founder and chief executive.