In Move on Sui, access control is enforced primarily using object ownership and the has, public, friend, and entry modifiers. You can restrict function access by requiring the caller to pass in an owned object like an AdminCap or authority token, which only privileged users possess. Sui’s object model allows fine-grained control by tying capabilities to specific object IDs, avoiding global state like EVM’s msg.sender. Generics in Move let you define reusable modules and functions across multiple types, declared using with has constraints like store, copy, or drop. Use sui move test, sui client publish, and sui client call to build, deploy, and interact with your contracts, and always validate capabilities and ownership paths during unit testing to avoid privilege escalation bugs.

For example, if only an admin should mint NFTs, you create an AdminCap object during contract deployment and transfer it to the admin’s address. Any function that needs admin rights should take AdminCap as a parameter and fail if it's missing or invalid. That way, only someone holding the cap can execute the function.

Here’s a simple pattern:

module example::my_module {
    use sui::object::{Self, UID};
    use sui::tx_context::{Self, TxContext};
    use sui::transfer;

    struct AdminCap has key {
        id: UID,
    }

    public entry fun create_admin_cap(ctx: &mut TxContext) {
        let cap = AdminCap { id: object::new(ctx) };
        transfer::transfer(cap, tx_context::sender(ctx));
    }

    public entry fun restricted_action(cap: AdminCap) {
        // only callable by whoever owns AdminCap
    }
}

Unlike EVMs which use modifiers or OpenZeppelin-style roles, Sui’s object-centric model allows you to encode access control directly into the ownership of objects or via capability-based design.

✅ Common Access Control Patterns

a. Object Ownership Checks Use sui::object::has_owner(&object, &signer) or check UID directly.

annot infer generic type – Always specify --type-args when using generics via CLI or SDK.

Unsupported for dynamic dispatch – Move generics are static; you can’t use them like JS or Rust traits.

📚 Extra Tips

Dev Tools for You

🔍 sui move test for unit testing.

📏 Use assert with custom error codes to catch logic violations.

🔐 Define role-based access patterns with has key types as authority tokens.

🔄 Combine with transfer and delete for lifecycle control.

If you’d like, I can build you templates for:

Role-based access with capabilities

A DAO-style voting object system

A royalty contract with generic recipient splits

Just say the word.

If you’re using generics through the CLI or SDK and see:

❌ “cannot infer generic type” That’s your cue to always specify --type-args. Move doesn’t guess like TypeScript – you’ve got to be explicit.

On Sui, access control in Move smart contracts is enforced through object ownership, capabilities, and the tx_context::sender function. Unlike EVM chains that rely on msg.sender, Sui uses a resource-oriented model where permissions are tied to object ownership and custom capability tokens.

To restrict function access:

1. Use &signer or &TxContext to get the transaction sender with tx_context::sender(ctx).
2. Define a Capability struct (e.g., has key) that acts as a permission token. Store it in a governed object and check its ownership before allowing access.
3. Use dynamic fields or tables to map permissions to addresses.

Example:

struct AdminCap has key { id: UID }

public entry fun admin_only_action(cap: &AdminCap, ctx: &mut TxContext) {
    assert!(object::owner(&cap.id) == tx_context::sender(ctx), 0);
    // Proceed with privileged logic
}

For generics, Move supports parametric polymorphism. Define them with type parameters constrained by abilities like store, drop, key. Example:

struct Vault<T: store> has key { id: UID, asset: T }

Generics enable reusable collections or logic across different types. They are resolved at compile time and erased at runtime. Use them for wallets, vaults, or registries.

Best practices: Never expose raw object IDs without validation; use capability patterns for role-based access; and prefer owned objects over shared ones for secure, parallel execution.

1. Enforcing Access Control in Move on Sui

📌 Sui’s Unique Model

Unlike EVMs which use modifiers or OpenZeppelin-style roles, Sui’s object-centric model allows you to encode access control directly into the ownership of objects or via capability-based design.

✅ Common Access Control Patterns

a. Object Ownership Checks Use sui::object::has_owner(&object, &signer) or check UID directly.

public fun protected_function(obj: &mut MyObject, signer: &Signer) { assert!(obj.owner == address_of(signer), ENOT_OWNER); // Logic }

b. Object Type Permissions

public entry fun update_only_admin(admin_cap: &AdminCap, signer: &Signer) { assert!(admin_cap.owner == address_of(signer), ENOT_AUTHORIZED); // Proceed }

c. Capability Tokens You can define a struct AdminCap has key {} that only you mint, and restrict access to functions that require it.

struct AdminCap has key {}

public entry fun grant(admin: AdminCap, to: address): AdminCap { // only admin can call this }

🛠️ CLI Example

sui client call
--package <package_id>
--module my_module
--function update_only_admin
--args <admin_cap_object_id>

🧱 Best Practices

Use capabilities instead of relying solely on signer address.

Enforce strict object access patterns via Move module visibility and has key.

Use entry functions for anything callable by a user (with signer).

2. Generics in Move: How They Work

Generics in Move allow you to write reusable, type-safe code—especially powerful on Sui for custom containers, asset types, or NFTs.

✅ Basic Generic Declaration

public fun store(item: T) { // Works for any type T }

🧱 Real Example: A Wrapper

module myproject::wrapper { struct Wrapper has key { inner: T, }

public entry fun wrap<T>(item: T): Wrapper<T> {
    Wrapper { inner: item }
}

public fun unwrap<T>(wrapper: Wrapper<T>): T {
    wrapper.inner
}

}

Use in CLI:

sui client call
--package <package_id>
--module wrapper
--function wrap
--type-args 0x2::sui::SUI

🚧 Common Errors

Cannot infer generic type – Always specify --type-args when using generics via CLI or SDK.

Unsupported for dynamic dispatch – Move generics are static; you can’t use them like JS or Rust traits.

📚 Extra Tips

Dev Tools for You

🔍 sui move test for unit testing.

📏 Use assert with custom error codes to catch logic violations.

🔐 Define role-based access patterns with has key types as authority tokens.

🔄 Combine with transfer and delete for lifecycle control.

If you’d like, I can build you templates for:

Role-based access with capabilities

A DAO-style voting object system

A royalty contract with generic recipient splits

Just say the word.

Unlike EVMs which use modifiers or OpenZeppelin-style roles, Sui’s object-centric model allows you to encode access control directly into the ownership of objects or via capability-based design.

✅ Common Access Control Patterns

a. Object Ownership Checks Use sui::object::has_owner(&object, &signer) or check UID directly.