KYA for enterprises

What enterprises use KYA for

• Acceptance before go-live: an agent only goes live once its evidence passes verification.
• Audit and internal control: samples and full checks without access to the operator's systems.
• Disputes: a reproducible certificate shows what is proven and what is not.
• Vendor management: agent vendors commit to delivering evidence in a verifiable format.
• Regression tests: every change to agents or mandates runs against the same rules.

By industry

• Financial servicesVerify payments, orders and claims by agents traceably.
• Commerce and paymentsAccept agent purchases when they are provably allowed.
• Public sectorMake agent submissions archivable and recomputable.

Three ways to run it

Procurement at a glance

Data processing

No evidence is sent to us during verification; no processing on our behalf takes place.

Licenses

Engine and test vectors Apache 2.0, specification CC BY 4.0. No license fees, no lock-in.

Dependencies

No runtime dependencies; the engine uses Web Crypto only.

Distribution

npm package @knowyouragent/verify-core@1.2.0 directly from knowyouragent.ch, with SHA-256 and npm integrity

Releases

Every delivered file with SHA-256 in the public release manifest.

Test basis

62 public test vectors with real signatures, including reference data from Mastercard and Cloudflare.

Contact

Innopulse Consulting GmbH, Zug, info@innopulse.io

Security, supply chain and accessibility in detail

Integration into the CI pipeline

The engine is an npm package without dependencies and runs in Node 20 or later. The kya-verify command line returns exit code 0 for valid, 1 for invalid and 2 for indeterminate. Developer documentation

# .github/workflows/agenten.yml (Ausschnitt)
- name: Install the engine
  run: npm install --no-save https://knowyouragent.ch/downloads/knowyouragent-verify-core-1.2.0.tgz
- name: Verify agent evidence
  run: |
    for f in evidence/*.json; do
      npx kya-verify "$f" --keys trust/jwks.json --anchors trust/tsa.pem || exit 1
    done

With || exit 1 an indeterminate result also fails – deliberately strict: what is not proven does not go live.

Self-hosting

1. Request the website package with checksums (info@innopulse.io); for checks without a user interface, the npm package suffices.
2. Run npm ci and npm run gate; exit 0 confirms the state.
3. Serve the contents of dist/ from your own web server. For URLs without .html, add a rule such as try_files $uri $uri.html $uri/ =404 (nginx).
4. Adopt the security headers from vercel.json, in particular the Content Security Policy.

Verification makes no network requests and reports nothing back. It therefore also works in networks without internet access.

Support for rollout and issuance

For issuing mandates and decisions before execution there is the reference implementation Mandact. For requirements, rollout and acceptance in your organization, Innopulse Consulting GmbH supports projects directly.

Request a conversation

All industries at a glance

• Financial services

  How financial institutions verify whether an AI agent was authorized for a payment, order or claim: mandate, scope, revocation and receipt, recomputable.

• Commerce and payments

  How merchants and payment providers verify whether an AI agent was allowed to buy on its customer's behalf: Verifiable Intent, Web Bot Auth, mandate and receipt.

• Public sector

  How public administration, courts and public enterprises prove on whose behalf an AI agent acted: mandate, delegation, receipt and an independent timestamp.

• AI agents in insurance: claims, policies, evidence

  AI agents report claims, compare policies and conclude contracts on someone's behalf. What insurers and intermediaries must verify and how evidence helps.

• AI agents in travel and mobility: booking with evidence

  AI agents book trains, flights and hotels, rebook during disruptions and manage mobility passes. What providers must consider to admit agents safely.

• AI agents in procurement: ordering within limits

  AI agents order supplies, negotiate terms and manage suppliers. How companies transfer authority rules, signing rights and evidence to agents.

• AI agents in healthcare: administration with evidence

  AI agents book doctor's appointments, submit invoices to health insurers and pass on requests. What practices and insurers verify and how data stays protected.

• AI agents in real estate: renting, managing, evidence

  AI agents apply for apartments, book viewings and commission tradespeople. What property managers verify and where tenancy law requires a signature.

• AI agents in logistics: booking, customs, safeguards

  AI agents book freight capacity, track shipments and prepare customs declarations. Which actions need limits and how representation in customs is proven.

• AI agents in telecommunications: contracts and SIM swaps

  AI agents switch plans, cancel contracts and request new SIM cards. Which actions telecom providers admit and why SIM swapping needs protection.

Frequently asked questions

How do companies integrate KYA?

In the browser for individual cases, as a package without dependencies in their own systems, or with the kya-verify command line in pipelines. All paths deliver the same results.

Does data leave our network?

No. The engine makes no network requests and can run entirely within your own network.

Which level should we require?

That depends on the risk. For payments, at least KYA-A3 is advisable; for disputes, KYA-A4 with an independently anchored point in time.

Who issues the mandates?

A mandate service of your choice. KYA verifies evidence independently of the issuer according to an open verification profile.

Is there support for adoption?

Yes. Through the contact page, you can reach the operator with questions on integration, verification profile and test vectors.