Ballast documentation

The capability-based trust layer for autonomous agents on Sui.

You would never hand a stranger your bank login and say “go trade for me.” But that is what running an AI agent on your money means today. You give it your keys and hope. Ballast lets you hand over a mandate instead of your keys: a revocable, capped, hardware-verified capability the chain itself enforces. It can act on its own. It just can’t exceed, fake, or outlive what you granted.

Ballast is Sui’s capability-native answer to Ethereum’s ERC‑8004, the open agent-safety standard, built on DeepBook (the venue) and Nautilus (the TEE). It is live on Sui testnet, end to end, with on-chain receipts for every claim in these docs.

Read in this order

# Page What it covers
01 Overview What Ballast is, the value prop, what’s real vs stubbed
02 Architecture System + Move-module diagrams; the three signing domains
03 Capability model & enforcement BallastCap, enforce, the lifecycle state machine, abort codes
04 Verifiable execution with Nautilus TEE Attested trades, on-chain verify_nautilus, the BCS contract, the engineering deep-dive
05 Deployments & on-chain artifacts Every package ID, object, PCR, and digest with explorer links
06 Quickstart: integrate in a day Copy-pasteable, typecheck-verified @ballast/sdk walkthrough
07 API reference Every public SDK export with real signatures
08 Security & threat model Trust boundaries, what it defends vs doesn’t, real-vs-mocked

The one-paragraph mental model

An agent gets an on-chain AgentIdentity (reputation accrues here) and a BallastCap, a shared Move object encoding a spend ceiling, a max leverage, an allow-list of markets, and an expiry. To trade, the agent calls trading::execute_trade[_attested], which runs capability::enforce before DeepBook is ever touched. Any violation aborts the entire transaction atomically. Nothing settles, and the chain, not a server, is what refused. The attested path additionally requires an AWS Nitro enclave to have signed the exact trade, with the enclave’s key proven on-chain through the AWS certificate chain and PCR measurements.

Conventions in these docs