Mysten Labs and Google Cloud split AI agent audit trails between customer buckets and Sui

The storage split decides who earns what. Prompts, outputs, tool calls and policy decisions go into Google Cloud Storage buckets the customer controls, so the sensitive business record stays in the enterprise's own cloud account ^[2]. Only the proof that the record was not altered goes out. It is held on Walrus, Mysten's decentralized data platform, and coordinated on Sui, infrastructure Cryptobriefing describes as one no single party can quietly edit ^[3]. Google keeps the data ^[2]. Mysten's networks get the proof traffic ^[3]. Cryptobriefing writes that whether enterprise use turns into more activity on Sui and Walrus depends on how many customers move past initial deployments, a number it says is not yet known ^[14].

The build order puts payments first. Sui's work with Google began when it added support for the Agentic Payments Protocol in September 2025, a project about letting agents pay ^[9]. The audit layer came on October 6, 2026 ^[1], about 13 months later ^[13], and it plugs into Sui's own payments facilitator ^[6]. Agents got tools to spend before their employers got a tamper-evident way to show the spending was authorized ^[13].

The buyer case rests on regulation. Cryptobriefing ties the launch timing to the EU AI Act, which comes into force in 2027 with fines of up to EUR 15 million or 3% of global annual turnover ^[8]. The 3% figure is the larger one for any company with more than EUR 500 million of turnover ^[11]. At EUR 10 billion of turnover, 3% is EUR 300 million ^[12]. The announcement did not include a price, a customer name or a deployment count ^[10], so the cost of the product cannot yet be set against that exposure.

One path is that large EU-exposed firms adopt VAA for compliance and the rollout moves past its initial enterprise deployments ^[7]. Another is that agent payments over x402 grow on their own and the audit layer gets bought as an attachment to them ^[6]. The third is that VAA stays in early deployments and the extra Sui and Walrus activity never shows up ^[14]. I think compliance is the likelier source of paying customers, because the size of the fine is public and the volume of agent payments is not; Cryptobriefing lists x402 traction outside pilots as an open question ^[15]. The counter-case is that compliance teams decide the customer-controlled buckets are enough on their own and treat the on-chain proof as optional ^[2]. If broader access still has no date when the Act takes effect in 2027, the compliance case is wrong ^[7][8].