Knowledge
Background, terms and answers on the authority and receipts of AI agents.
In short
Background on authority, receipts and verification of AI agents, with sources and absolute dates.
Fundamentals
- KYA, KYC, KYB: why agents need a check of their own
Know Your Customer checks people, Know Your Business checks companies. Why AI agents need a third check that takes place on every action.
- Identity is not authority: what IAM leaves open for agents
Authentication and access rights say who acts and what they may access. Why, for AI agents, that does not answer whether a specific action was allowed.
- Agentic commerce explained: how AI agents shop
How AI agents search, compare and pay, which approaches payment networks offer for this, and what merchants should check before accepting an agent purchase.
Comparisons
- Agent mandate or OAuth token? The difference
OAuth governs an agent's access to an interface, an agent mandate the individual action on someone's behalf. Differences, use and interplay at a glance.
- Agent mandate or API key? Which is safer
Many AI agents work with API keys. Why a key acts like blanket authority and what an agent mandate with limits, revocation and evidence does differently.
- SD-JWT VC or W3C Verifiable Credentials? Compared
Two formats for digital credentials: the IETF's SD-JWT VC and the W3C Verifiable Credentials 2.0 data model. Structure, disclosure, adoption and fit for mandates.
- Web Bot Auth or bot detection? Recognizing agents
Bot detection estimates from behavior, Web Bot Auth proves the origin of a request with a signature. What each achieves and why shops need both.
- RFC 3161 timestamp or blockchain anchoring?
Two ways to prove a point in time for agent evidence independently: a timestamp from a timestamp authority following RFC 3161 or anchoring in a public blockchain.
- Guardrails or authorization? What secures AI agents
Guardrails filter what a model says; authorization decides what an agent may do. Why actions with consequences need a deterministic check.
- MCP or A2A? Two protocols for AI agents compared
MCP connects agents with tools, A2A connects agents with each other. Purpose, structure, security and how both protocols work together in one architecture.
- Decision before or log after? Controlling agents
Many companies log what their AI agents do. Why a log prevents no damage and what a signed decision before execution changes.
- Human approval or a mandate with limits?
Should a person approve every action of an AI agent, or should a mandate set the limits? Strengths, weaknesses and the combination that works in practice.
- Trusted Agent Protocol or Web Bot Auth? Compared
Visa's Trusted Agent Protocol and Web Bot Auth sign agent requests following RFC 9421. What they share, how they differ and what merchants take from it.
- Agent mandate or written authorization on paper?
A written authorization on paper is made for people, an agent mandate for software. What both achieve, where the law requires form and how companies combine them.
Use cases
- AI agent pays invoices: automating safely
An AI agent checks and pays supplier invoices. How companies secure this with a mandate, a decision before payment, approval thresholds and verifiable receipts.
- AI agent books business travel: limits and evidence
An AI agent books train, flight and hotel according to the travel policy. How mandate, delegation, decisions and receipts make bookings traceable.
- AI agent manages subscriptions: renewing and canceling
An AI agent renews, switches and cancels subscriptions on a customer's behalf. Which limits should apply and how providers can verify actions by agents.
- AI agent in customer service: securing refunds
An AI agent handles complaints and books credits or refunds. How limits, decisions and receipts prevent abuse and mistakes in customer service.
- AI agent shops online: purchase intent, limits, evidence
An AI agent shops online on a customer's behalf. How purchase intent, limits and evidence make the purchase safe and traceable for customer and merchant.
- AI agent files applications with authorities: proving representation
An AI agent fills in forms and files applications and notifications with authorities. How representation, identity and evidence work together in e-government.
- AI agent books appointments: limits, cancellations, privacy
An AI agent arranges, reschedules and cancels appointments with practices, tradespeople and service providers. Which limits apply and how providers verify bookings.
- AI agent creates sales offers: binding within limits
An AI agent creates and sends offers on a company's behalf. Why binding offers need clear limits and how customers verify the agent's authority.
- AI agent manages cloud resources: limits in operations
An AI agent scales servers, adjusts configurations and cuts cloud costs. How mandate, approvals and receipts prevent outages and expensive mistakes.
- AI agent runs code deployments: safely into production
Coding agents write code, open pull requests and deploy. How mandate, protected branches, approvals and receipts secure deliveries by agents.
Law and liability
- What an auditor needs from an agent action: 12 questions
A checklist for audit, compliance and counterparties: the twelve questions evidence of an agent action must answer to be independently verifiable.
- AI agent liability: who pays when an agent buys the wrong thing?
Who bears the consequences when an AI agent orders the wrong item or exceeds its limits? An overview of the legal position in Switzerland, Germany and Austria.
- Proving authority: AI agents under Swiss, German and Austrian law
Why proof of authority is decisive for AI agents, what verifiable evidence must contain and how it works under Swiss, German and Austrian law.
- EU AI Act and AI agents: what applies to agents
What the European regulation on artificial intelligence means for AI agents: roles, transparency, record-keeping, deadlines and the situation in Switzerland.
- Questions on law and liability for AI agents
Answers to common legal questions about AI agents: liability, contract formation, authority, proof, data protection and regulation in CH, DE and AT.
Standards and protocols
- Timestamps for agent receipts: plain, anchored, qualified
What an RFC 3161 timestamp proves, why the trust anchor decides and how qualified timestamps under ZertES and eIDAS differ.
- Swiss e-ID and agent mandates: status October 2026
The launch of the Swiss e-ID has been postponed, the trust infrastructure is targeted for the first half of 2027. What this means for mandates to AI agents.
- Agent protocols compared: VI, AP2, TAP and Web Bot Auth
Verifiable Intent, AP2, Trusted Agent Protocol, Web Bot Auth and Agentic Commerce Protocol compared: purpose, format, cryptography, openness, verifiability.
- State of the standards for AI agents
Where the approaches for AI agents stand today, from Verifiable Intent and AP2 to Web Bot Auth, e-ID and the EUDI wallet, with chronology and KYA support.
Security
- Securing AI agents in MCP: mandates instead of API keys
How companies secure tool calls by AI agents through the Model Context Protocol: risks, authorization, decisions before execution and verifiable receipts.
- Prompt injection and authority: verification outside the model
Why prompt injection cannot be fully prevented in AI agents and why checking authority must happen outside the language model.
Practice and guides
- Adopting AI agents safely: a checklist including data protection
A practical checklist for companies adopting AI agents: authority, control, evidence, data protection under Swiss law and the GDPR, operations and contracts.
- Verify agent evidence in 5 steps
Step by step: verify evidence from an AI agent with KYA, provide the verifying party's trust, read verdict and level, and keep the certificate.
- Verify a signed HTTP request (RFC 9421, with IETF example)
Guide: verify a signed HTTP request following RFC 9421 with KYA, using the official IETF example from Appendix B.2.6, including a counter-check with a changed path.
- Verify a timestamp (RFC 3161, with FreeTSA)
Guide: create a timestamp following RFC 3161 with OpenSSL and FreeTSA, cross-check it locally and verify it in KYA with the timestamp anchor.
- Questions on technology and formats in KYA
Answers to technical questions about KYA: formats, local verification, verdicts and levels, keys, revocation, timestamps, package and test vectors.
- Use the engine in Node.js: verify evidence in the backend
Integrate the KYA engine in Node.js or TypeScript: install, provide trust, call verify(), evaluate verdict and checks. With working code.
- Verify evidence in the CI pipeline with kya-verify
Verify agent evidence automatically in GitHub Actions or any other CI pipeline: the kya-verify command line, exit codes, trust in the repository, report as JSON.
- Publish keys as JWKS: a guide for issuers
As an issuer of agent evidence, create a key pair, publish the public key as JWKS and rotate keys without invalidating older evidence.
- Publish and maintain a status list: revocation for mandates
Create, compress, sign and publish a status list following the IETF Token Status List so mandates can be revoked before they expire. With working code.
- Questions from merchants about AI agents: 13 answers
What online shops and merchants need to know about shopping AI agents: recognizing, admitting, checking orders, payments, returns, liability and first steps.
- Questions from developers about KYA: 13 answers
Answers for developers: integrating the engine, formats, keys, status lists, exit codes, test vectors, determinism, license and performance.
Know Your Agent in the DACH region
- Know Your Agent in Switzerland: verifying AI agents
What Know Your Agent means for Swiss companies: agency under the Code of Obligations, data protection, the e-ID with swiyu and a neutral verifier based in Zug.
- Know Your Agent in Germany: verifying AI agents
What Know Your Agent means for German companies: computer declarations and agency under the BGB, GDPR, the EUDI wallet, PSD2 and independent verification.
- Know Your Agent in Austria: verifying AI agents
What Know Your Agent means for Austrian companies: authorization under the ABGB, GDPR, ID Austria, the EUDI wallet and independent verification.
Glossary
- Know Your Agent (KYA)
Know Your Agent (KYA) is the verification of whether an AI agent was authorized for a specific action – with evidence third parties can recompute independently.
- Agent mandate
An agent mandate is a principal's signed, machine-readable authorization for an AI agent that defines which actions are allowed, to what extent and until when.
- Principal
The principal is the natural or legal person on whose behalf an AI agent acts and who granted it the mandate.
- Agent passport
An agent passport is a signed credential about an AI agent's identity, usually with a bound key, that does not itself grant any authority.
- Decision token
A decision token is a verifying party's signed record that a specific agent action was allowed, denied or escalated before execution.
- Execution receipt
An execution receipt is the entry that records, after an agent action, what was executed and references the related decision and mandate.
- Receipt chain
A receipt chain is a sequence of execution receipts in which every entry contains its predecessor's hash, so that any change or gap breaks the chain.
- Evidence pack
An evidence pack bundles mandate, decision, receipts, status lists and timestamps into one file whose content is protected against change by a manifest.
Questions
- What does KYA verify?
- Whether presented evidence proves that an AI agent was authorized for an action: integrity, issuer, agent and principal, validity, scope, delegation, revocation, execution receipt and timestamp.
- Is there software that issues such evidence?
- Yes. Mandates, decisions and receipts are produced by issuing systems, for example following Mastercard Verifiable Intent or with the reference implementation of the operator of KYA. KYA verifies all of this evidence by the same rules, regardless of who issued it.
- Is my data transmitted?
- No. Verification runs in your browser. The page forbids itself network connections through its Content Security Policy, and there are neither cookies nor tracking.
- Why is my result “indeterminate”?
- Because nothing is disproven, but not everything essential is proven. Common reasons: the issuer's key is missing, no status list was provided, or the mandate is not included. The reason is shown at every check.