Questions
Short answers. The detailed ones are in the verification model and the specification.
- What does KYA verify?
- Whether presented evidence proves that an AI agent was authorized for an action: integrity, issuer, agent and principal, validity, scope, delegation, revocation, execution receipt and timestamp.
- Is there software that issues such evidence?
- Yes. Mandates, decisions and receipts are produced by issuing systems, for example following Mastercard Verifiable Intent or with the reference implementation of the operator of KYA. KYA verifies all of this evidence by the same rules, regardless of who issued it.
- Is my data transmitted?
- No. Verification runs in your browser. The page forbids itself network connections through its Content Security Policy, and there are neither cookies nor tracking.
- Why is my result “indeterminate”?
- Because nothing is disproven, but not everything essential is proven. Common reasons: the issuer's key is missing, no status list was provided, or the mandate is not included. The reason is shown at every check.
- What does KYA-A4 mean?
- All checks up to provenance are proven, and an RFC 3161 timestamp is bound to the content and traceable to an anchor you provided. Whether the timestamp is qualified is not checked by this version.
- Is a valid result a legal confirmation?
- No. It is a technical statement about what the evidence proves. Whether an action was legally effective depends on further circumstances.
- Why doesn't the site fetch keys via did:web?
- Because it makes no network requests while verifying. Copy the issuer's published key into “Trust of the verifying party”. That way you, as the verifying party, decide whom you trust.
- Can I automate verification?
- Yes. The engine also runs on the command line and in CI and produces the same report as the browser.
- Which formats are supported?
- SD-JWT VC, JWS, Mastercard Verifiable Intent (including the converged AP2 chain), signed HTTP requests per RFC 9421 with Web Bot Auth, receipt chains kya-chain/1, evidence packs kya-pack/1, IETF status lists and RFC 3161 timestamps. Classic AP2 JSON mandates are recognized.
- How do I produce evidence that passes here?
- Follow the specification and test against the public test vectors. The reference implementation Mandact offers a ready-made implementation.
- Who operates the site?
- Innopulse Consulting GmbH in Zug, Switzerland. It also develops Mandact. Verification here is independent of it and stays free.
- What does verification cost?
- Nothing, with no limit other than fair use, and no account. That is a matter of principle, not an introductory offer.
- How do I report a security issue?
- Confidentially to info@innopulse.io. The machine-readable details are in /.well-known/security.txt.