Where the spending rules live: agent authorization on AWS vs Sui

Description and use

Comparison of AWS AgentCore Payments and a Sui Move module for delegated spending. AWS uses off‑chain budget checks; Sui enforces limits in transaction bytecode, preventing unauthorized spending.

Problem

Autonomous agents that can pay can also drain funds if spending rules are not enforced correctly.

Outcome

AWS enforces limits at the API layer; Sui enforces limits in transaction bytecode, preventing prompt injection or mis‑signing. Both approaches prevent overspending, but Sui removes the need for a trusted service.

Workflow

• Deploy AWS AgentCore Payments and run a testnet payment
• Deploy Sui Move module agent_auth and run unit tests on testnet
• Execute spend transactions on Sui testnet to observe aborts and successful spends

Evidence

The budget enforcement isn't in the prompt. It's not a guardrail the model might ignore. When a payment would exceed maxSpendAmount or the session has expired, AgentCore rejects the ProcessPayment call before anything gets signed.

Source

The module compiles and the full suite passes. This is the real sui move test output on sui 1.81.0-bf0c491c17b8, pasted verbatim, not a paraphrase: ... Test result: OK. Total tests: 9; passed: 9; failed: 0

Source