Know Your Agent (KYA)
The neutral Know Your Agent verifier: KYA checks an AI agent's authority, decision and receipt – across vendors, locally in your browser and in a way anyone can recompute.
A4KYA verification certificate (example)
Valid
KYA-A4 Time-Anchored Evidence
An agent can be correctly signed in, have access to the payment interface – and still perform an action nobody allowed.
Who is this?
Sign-in, workload identity, DID. Says who is acting.
What may it access?
Roles and scopes. Say which interfaces are open.
Was it allowed to do exactly this?
Mandate, decision, receipt. KYA verifies whether this one action was covered – and proves it.
Four verification areas, ten fixed checks. No check counts as passed just because it was not performed.
Is the evidence unchanged and from the stated issuer?
Who acts, for whom and through which chain?
Was the action covered and the mandate in force?
Is the execution recorded and fixed in time?
Every result receives a seal from A0 to A4. The levels build on each other; disproven evidence always sits at A0.
A0Format recognized, nothing proven
A1Signatures and hashes match
A2Mandate valid, action in scope
A3Not revoked, delegation unbroken
A4Point in time independently fixed
They are principal and verifying party at once and want to be able to prove every action of their agents – to customers, auditors and courts.
They need receipts they can recompute without access to the operator's systems. The certificate is reproducible.
Merchants and platforms decide whether to accept a third-party agent's action. KYA shows what is proven and what is not.
The engine is open source and runs identically in the browser, on the command line and in CI. Same input, same certificate.
Background on authority, receipts and verification of AI agents.
Know Your Customer checks people, Know Your Business checks companies. Why AI agents need a third check that takes place on every action.
Authentication and access rights say who acts and what they may access. Why, for AI agents, that does not answer whether a specific action was allowed.
A checklist for audit, compliance and counterparties: the twelve questions evidence of an agent action must answer to be independently verifiable.
KYA is built by Innopulse Consulting GmbH in Zug, Switzerland. Founder Leutrim Miftaraj has led IT projects for Swiss institutions for more than ten years and designed the method, specification and engine.
If you operate your own agents and want to prove their actions this way, Mandact is the commercial reference implementation. The verifier here works without it.
View profileAbout Innopulse Consulting GmbHHow the separation works
Know Your Agent (KYA) is verifying whether an AI agent was authorized for a specific action, with evidence that third parties can recompute independently.
Who the agent is, on whose behalf it acts, whether its mandate was valid and not revoked, whether the action stayed within the permitted scope and whether execution is proven.
No. Verification runs entirely in the browser, without an account and without tracking.
Among others SD-JWT VC, JWS, evidence packs, receipt chains, timestamps following RFC 3161, Mastercard Verifiable Intent and signed HTTP requests following RFC 9421.
Nothing. Verification is free; the engine is also available as a package under Apache 2.0.
