Know Your AgentDEVerify evidence
Menu

The KYA method

Four questions, checked in ten steps and summarized in one verdict and one level.

In short

Four questions, checked in four areas with ten steps, summarized in one of three verdicts and one of five levels.

Four questions

  1. Who is the agent? An identifier with a bound key.
  2. On whose behalf does it act? A named principal.
  3. What was it allowed to do? A mandate with scope, limits and validity.
  4. Was this exact action permitted, and where is the proof? Decision, receipt and timestamp.

Four verification areas

  1. Authenticity

    Is the evidence unchanged and from the stated issuer?

    • Format and schema
    • Cryptographic integrity
    • Issuer

  2. Identity and principal

    Who acts, for whom and through which chain?

  3. Authority

    Was the action covered and the mandate in force?

    • Mandate validity
    • Scope of the action
    • Revocation

  4. Proof

    Is the execution recorded and fixed in time?

Three verdicts

Valid, indeterminate or invalid. Disproven and not verifiable are different things and never coincide. All checks, statuses and reasons

Five levels

  1. A0
    KYA-A0Unverified

    Format recognized, nothing proven

  2. A1
    KYA-A1Integrity Verified

    Signatures and hashes match

  3. A2
    KYA-A2Authority Verified

    Mandate valid, action in scope

  4. A3
    KYA-A3Provenance Verified

    Not revoked, delegation unbroken

  5. A4
    KYA-A4Time-Anchored Evidence

    Point in time independently fixed

The rules of the levels

What the method deliberately does not do

  • It does not rate agents or vendors, only presented evidence.
  • It makes no network requests; keys, status lists and anchors are provided by the verifying party.
  • It does not claim timestamps are qualified without an official trust list.

The method in practice

The method can be introduced step by step. Many start by checking authenticity and identity, then add mandates with limits and finally receipts with timestamps. Each step makes actions more traceable. The verification guide shows what this looks like in concrete terms.

Frequently asked questions

Do I have to meet all ten checks?

Not for every action. The verifying party decides which level is needed. For a payment, mandate, scope and revocation should be proven, and for disputes the point in time as well.

Is the method tied to one format?

No. The method describes which questions must be answered. KYA maps different formats onto the same ten checks.

Can I use the method in my own systems?

Yes. The verification profile is available under CC BY 4.0, the engine under Apache 2.0.

How long does a verification take?

Usually less than a second in the browser. Extensive evidence packs can take a little longer because every signature and every hash is recomputed.

What happens to unknown formats?

KYA reports them as an unsupported format instead of silently assessing them as valid or invalid.

Why exactly ten checks?

Each step answers a question of its own, from readability to the point in time. Together, they cover what must be proven for the authority of an action.

Is the method tied to AI?

No. It fits any software that acts on someone's behalf.