---
title: "Knowledge on Know Your Agent and agent authority"
url: https://knowyouragent.ch/en/knowledge
lang: en
updated: 2026-10-12
license: © Innopulse Consulting GmbH
---

# Knowledge

Background, terms and answers on the authority and receipts of AI agents.

In short

Background on authority, receipts and verification of AI agents, with sources and absolute dates.

## Fundamentals

- 12 October 2026[KYA, KYC, KYB: why agents need a check of their own](https://knowyouragent.ch/en/knowledge/kya-vs-kyc)Know Your Customer checks people, Know Your Business checks companies. Why AI agents need a third check that takes place on every action.

- 12 October 2026[Identity is not authority: what IAM leaves open for agents](https://knowyouragent.ch/en/knowledge/identity-is-not-authority)Authentication and access rights say who acts and what they may access. Why, for AI agents, that does not answer whether a specific action was allowed.

- 13 October 2026[Agentic commerce explained: how AI agents shop](https://knowyouragent.ch/en/knowledge/agentic-commerce)How AI agents search, compare and pay, which approaches payment networks offer for this, and what merchants should check before accepting an agent purchase.

## Comparisons

- 17 October 2026[Agent mandate or OAuth token? The difference](https://knowyouragent.ch/en/knowledge/comparison/mandate-or-oauth)OAuth governs an agent's access to an interface, an agent mandate the individual action on someone's behalf. Differences, use and interplay at a glance.

- 17 October 2026[Agent mandate or API key? Which is safer](https://knowyouragent.ch/en/knowledge/comparison/mandate-or-api-key)Many AI agents work with API keys. Why a key acts like blanket authority and what an agent mandate with limits, revocation and evidence does differently.

- 17 October 2026[SD-JWT VC or W3C Verifiable Credentials? Compared](https://knowyouragent.ch/en/knowledge/comparison/sd-jwt-vc-or-w3c-vc)Two formats for digital credentials: the IETF's SD-JWT VC and the W3C Verifiable Credentials 2.0 data model. Structure, disclosure, adoption and fit for mandates.

- 17 October 2026[Web Bot Auth or bot detection? Recognizing agents](https://knowyouragent.ch/en/knowledge/comparison/web-bot-auth-or-bot-detection)Bot detection estimates from behavior, Web Bot Auth proves the origin of a request with a signature. What each achieves and why shops need both.

- 17 October 2026[RFC 3161 timestamp or blockchain anchoring?](https://knowyouragent.ch/en/knowledge/comparison/timestamp-or-blockchain)Two ways to prove a point in time for agent evidence independently: a timestamp from a timestamp authority following RFC 3161 or anchoring in a public blockchain.

- 17 October 2026[Guardrails or authorization? What secures AI agents](https://knowyouragent.ch/en/knowledge/comparison/guardrails-or-authorization)Guardrails filter what a model says; authorization decides what an agent may do. Why actions with consequences need a deterministic check.

- 17 October 2026[MCP or A2A? Two protocols for AI agents compared](https://knowyouragent.ch/en/knowledge/comparison/mcp-or-a2a)MCP connects agents with tools, A2A connects agents with each other. Purpose, structure, security and how both protocols work together in one architecture.

- 17 October 2026[Decision before or log after? Controlling agents](https://knowyouragent.ch/en/knowledge/comparison/decision-before-or-log-after)Many companies log what their AI agents do. Why a log prevents no damage and what a signed decision before execution changes.

- 17 October 2026[Human approval or a mandate with limits?](https://knowyouragent.ch/en/knowledge/comparison/approval-or-mandate)Should a person approve every action of an AI agent, or should a mandate set the limits? Strengths, weaknesses and the combination that works in practice.

- 17 October 2026[Trusted Agent Protocol or Web Bot Auth? Compared](https://knowyouragent.ch/en/knowledge/comparison/trusted-agent-protocol-or-web-bot-auth)Visa's Trusted Agent Protocol and Web Bot Auth sign agent requests following RFC 9421. What they share, how they differ and what merchants take from it.

- 17 October 2026[Agent mandate or written authorization on paper?](https://knowyouragent.ch/en/knowledge/comparison/mandate-or-written-authorization)A written authorization on paper is made for people, an agent mandate for software. What both achieve, where the law requires form and how companies combine them.

## Use cases

- 17 October 2026[AI agent pays invoices: automating safely](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-pays-invoices)An AI agent checks and pays supplier invoices. How companies secure this with a mandate, a decision before payment, approval thresholds and verifiable receipts.

- 17 October 2026[AI agent books business travel: limits and evidence](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-books-business-travel)An AI agent books train, flight and hotel according to the travel policy. How mandate, delegation, decisions and receipts make bookings traceable.

- 17 October 2026[AI agent manages subscriptions: renewing and canceling](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-manages-subscriptions)An AI agent renews, switches and cancels subscriptions on a customer's behalf. Which limits should apply and how providers can verify actions by agents.

- 17 October 2026[AI agent in customer service: securing refunds](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-in-customer-service)An AI agent handles complaints and books credits or refunds. How limits, decisions and receipts prevent abuse and mistakes in customer service.

- 17 October 2026[AI agent shops online: purchase intent, limits, evidence](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-shops-online)An AI agent shops online on a customer's behalf. How purchase intent, limits and evidence make the purchase safe and traceable for customer and merchant.

- 17 October 2026[AI agent files applications with authorities: proving representation](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-files-applications)An AI agent fills in forms and files applications and notifications with authorities. How representation, identity and evidence work together in e-government.

- 17 October 2026[AI agent books appointments: limits, cancellations, privacy](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-books-appointments)An AI agent arranges, reschedules and cancels appointments with practices, tradespeople and service providers. Which limits apply and how providers verify bookings.

- 17 October 2026[AI agent creates sales offers: binding within limits](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-creates-sales-offers)An AI agent creates and sends offers on a company's behalf. Why binding offers need clear limits and how customers verify the agent's authority.

- 17 October 2026[AI agent manages cloud resources: limits in operations](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-manages-cloud-resources)An AI agent scales servers, adjusts configurations and cuts cloud costs. How mandate, approvals and receipts prevent outages and expensive mistakes.

- 17 October 2026[AI agent runs code deployments: safely into production](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-runs-code-deployments)Coding agents write code, open pull requests and deploy. How mandate, protected branches, approvals and receipts secure deliveries by agents.

## Law and liability

- 12 October 2026[What an auditor needs from an agent action: 12 questions](https://knowyouragent.ch/en/knowledge/evidence-for-agent-actions)A checklist for audit, compliance and counterparties: the twelve questions evidence of an agent action must answer to be independently verifiable.

- 13 October 2026[AI agent liability: who pays when an agent buys the wrong thing?](https://knowyouragent.ch/en/knowledge/ai-agent-liability)Who bears the consequences when an AI agent orders the wrong item or exceeds its limits? An overview of the legal position in Switzerland, Germany and Austria.

- 13 October 2026[Proving authority: AI agents under Swiss, German and Austrian law](https://knowyouragent.ch/en/knowledge/proving-agent-authority)Why proof of authority is decisive for AI agents, what verifiable evidence must contain and how it works under Swiss, German and Austrian law.

- 13 October 2026[EU AI Act and AI agents: what applies to agents](https://knowyouragent.ch/en/knowledge/ai-act-ai-agents)What the European regulation on artificial intelligence means for AI agents: roles, transparency, record-keeping, deadlines and the situation in Switzerland.

- 13 October 2026[Questions on law and liability for AI agents](https://knowyouragent.ch/en/knowledge/faq/legal)Answers to common legal questions about AI agents: liability, contract formation, authority, proof, data protection and regulation in CH, DE and AT.

## Standards and protocols

- 12 October 2026[Timestamps for agent receipts: plain, anchored, qualified](https://knowyouragent.ch/en/knowledge/timestamps-and-trust-anchors)What an RFC 3161 timestamp proves, why the trust anchor decides and how qualified timestamps under ZertES and eIDAS differ.

- 12 October 2026[Swiss e-ID and agent mandates: status October 2026](https://knowyouragent.ch/en/knowledge/e-id-and-agent-mandates)The launch of the Swiss e-ID has been postponed, the trust infrastructure is targeted for the first half of 2027. What this means for mandates to AI agents.

- 13 October 2026[Agent protocols compared: VI, AP2, TAP and Web Bot Auth](https://knowyouragent.ch/en/knowledge/agent-protocols-compared)Verifiable Intent, AP2, Trusted Agent Protocol, Web Bot Auth and Agentic Commerce Protocol compared: purpose, format, cryptography, openness, verifiability.

- 13 October 2026[State of the standards for AI agents](https://knowyouragent.ch/en/standard/status)Where the approaches for AI agents stand today, from Verifiable Intent and AP2 to Web Bot Auth, e-ID and the EUDI wallet, with chronology and KYA support.

## Security

- 13 October 2026[Securing AI agents in MCP: mandates instead of API keys](https://knowyouragent.ch/en/knowledge/securing-mcp-agents)How companies secure tool calls by AI agents through the Model Context Protocol: risks, authorization, decisions before execution and verifiable receipts.

- 13 October 2026[Prompt injection and authority: verification outside the model](https://knowyouragent.ch/en/knowledge/prompt-injection-authority)Why prompt injection cannot be fully prevented in AI agents and why checking authority must happen outside the language model.

## Practice and guides

- 13 October 2026[Adopting AI agents safely: a checklist including data protection](https://knowyouragent.ch/en/knowledge/ai-agent-checklist)A practical checklist for companies adopting AI agents: authority, control, evidence, data protection under Swiss law and the GDPR, operations and contracts.

- 13 October 2026[Verify agent evidence in 5 steps](https://knowyouragent.ch/en/knowledge/guides/verify-evidence)Step by step: verify evidence from an AI agent with KYA, provide the verifying party's trust, read verdict and level, and keep the certificate.

- 13 October 2026[Verify a signed HTTP request (RFC 9421, with IETF example)](https://knowyouragent.ch/en/knowledge/guides/verify-http-signature)Guide: verify a signed HTTP request following RFC 9421 with KYA, using the official IETF example from Appendix B.2.6, including a counter-check with a changed path.

- 13 October 2026[Verify a timestamp (RFC 3161, with FreeTSA)](https://knowyouragent.ch/en/knowledge/guides/verify-timestamp)Guide: create a timestamp following RFC 3161 with OpenSSL and FreeTSA, cross-check it locally and verify it in KYA with the timestamp anchor.

- 13 October 2026[Questions on technology and formats in KYA](https://knowyouragent.ch/en/knowledge/faq/technical)Answers to technical questions about KYA: formats, local verification, verdicts and levels, keys, revocation, timestamps, package and test vectors.

- 17 October 2026[Use the engine in Node.js: verify evidence in the backend](https://knowyouragent.ch/en/knowledge/guides/use-the-engine-in-node)Integrate the KYA engine in Node.js or TypeScript: install, provide trust, call verify(), evaluate verdict and checks. With working code.

- 17 October 2026[Verify evidence in the CI pipeline with kya-verify](https://knowyouragent.ch/en/knowledge/guides/verify-evidence-in-ci)Verify agent evidence automatically in GitHub Actions or any other CI pipeline: the kya-verify command line, exit codes, trust in the repository, report as JSON.

- 17 October 2026[Publish keys as JWKS: a guide for issuers](https://knowyouragent.ch/en/knowledge/guides/publish-keys-as-jwks)As an issuer of agent evidence, create a key pair, publish the public key as JWKS and rotate keys without invalidating older evidence.

- 17 October 2026[Publish and maintain a status list: revocation for mandates](https://knowyouragent.ch/en/knowledge/guides/publish-a-status-list)Create, compress, sign and publish a status list following the IETF Token Status List so mandates can be revoked before they expire. With working code.

- 17 October 2026[Questions from merchants about AI agents: 13 answers](https://knowyouragent.ch/en/knowledge/faq/merchants)What online shops and merchants need to know about shopping AI agents: recognizing, admitting, checking orders, payments, returns, liability and first steps.

- 17 October 2026[Questions from developers about KYA: 13 answers](https://knowyouragent.ch/en/knowledge/faq/developers)Answers for developers: integrating the engine, formats, keys, status lists, exit codes, test vectors, determinism, license and performance.

## Know Your Agent in the DACH region

- 13 October 2026[Know Your Agent in Switzerland: verifying AI agents](https://knowyouragent.ch/en/know-your-agent-switzerland)What Know Your Agent means for Swiss companies: agency under the Code of Obligations, data protection, the e-ID with swiyu and a neutral verifier based in Zug.

- 13 October 2026[Know Your Agent in Germany: verifying AI agents](https://knowyouragent.ch/en/know-your-agent-germany)What Know Your Agent means for German companies: computer declarations and agency under the BGB, GDPR, the EUDI wallet, PSD2 and independent verification.

- 13 October 2026[Know Your Agent in Austria: verifying AI agents](https://knowyouragent.ch/en/know-your-agent-austria)What Know Your Agent means for Austrian companies: authorization under the ABGB, GDPR, ID Austria, the EUDI wallet and independent verification.

## Glossary

- [Know Your Agent (KYA)](https://knowyouragent.ch/en/knowledge/glossary/know-your-agent)Know Your Agent (KYA) is the verification of whether an AI agent was authorized for a specific action – with evidence third parties can recompute independently.

- [Agent mandate](https://knowyouragent.ch/en/knowledge/glossary/agent-mandate)An agent mandate is a principal's signed, machine-readable authorization for an AI agent that defines which actions are allowed, to what extent and until when.

- [Principal](https://knowyouragent.ch/en/knowledge/glossary/principal)The principal is the natural or legal person on whose behalf an AI agent acts and who granted it the mandate.

- [Agent passport](https://knowyouragent.ch/en/knowledge/glossary/agent-passport)An agent passport is a signed credential about an AI agent's identity, usually with a bound key, that does not itself grant any authority.

- [Decision token](https://knowyouragent.ch/en/knowledge/glossary/decision-token)A decision token is a verifying party's signed record that a specific agent action was allowed, denied or escalated before execution.

- [Execution receipt](https://knowyouragent.ch/en/knowledge/glossary/execution-receipt)An execution receipt is the entry that records, after an agent action, what was executed and references the related decision and mandate.

- [Receipt chain](https://knowyouragent.ch/en/knowledge/glossary/receipt-chain)A receipt chain is a sequence of execution receipts in which every entry contains its predecessor's hash, so that any change or gap breaks the chain.

- [Evidence pack](https://knowyouragent.ch/en/knowledge/glossary/evidence-pack)An evidence pack bundles mandate, decision, receipts, status lists and timestamps into one file whose content is protected against change by a manifest.

[All 65 terms](https://knowyouragent.ch/en/knowledge/glossary)

## Questions

**What does KYA verify?**
Whether presented evidence proves that an AI agent was authorized for an action: integrity, issuer, agent and principal, validity, scope, delegation, revocation, execution receipt and timestamp.

**Is there software that issues such evidence?**
Yes. Mandates, decisions and receipts are produced by issuing systems, for example following Mastercard Verifiable Intent or with the reference implementation of the operator of KYA. KYA verifies all of this evidence by the same rules, regardless of who issued it.

**Is my data transmitted?**
No. Verification runs in your browser. The page forbids itself network connections through its Content Security Policy, and there are neither cookies nor tracking.

**Why is my result “indeterminate”?**
Because nothing is disproven, but not everything essential is proven. Common reasons: the issuer's key is missing, no status list was provided, or the mandate is not included. The reason is shown at every check.

[All questions](https://knowyouragent.ch/en/knowledge/faq)

---
Quelle: https://knowyouragent.ch/en/knowledge · KYA – Know Your Agent