Know Your Agent approaches compared
“Know Your Agent” has become an umbrella term. This overview places the approaches neutrally and shows what KYA verifies independently.
In short
Skyfire, Akamai, Visa, Mastercard, Google and FIDO use “Know Your Agent” differently. KYA is the neutral verifier above them and already verifies Mastercard Verifiable Intent and Cloudflare Web Bot Auth today.
One term, many approaches
Since 2025, payment networks, edge providers, identity verifiers and standards bodies have used the term “Know Your Agent”. The question is always the same: may this agent act, and for whom? The answers differ in which of the four questions they cover and whether they produce evidence third parties can verify.
Comparison
| Approach | What it does | Answers | Status at KYA |
|---|---|---|---|
| Skyfire KYA | Open protocol with JWT tokens: agent and principal are identified to websites and merchants. | Identity, principal | Signature verifiable with a published JWKS; profile in preparation |
| Akamai Agentic Security Framework | Edge platform connecting agent identity with Visa TAP, Skyfire and Experian. | Identity, access | Platform feature, no presentable evidence |
| Cloudflare Web Bot Auth | Signed HTTP requests per RFC 9421 with a key directory of the agent operator. | Identity, operator | Verified: Ed25519 and RSA-PSS, against the published test vectors |
| Visa Trusted Agent Protocol | Signed HTTP requests per RFC 9421 so merchants can recognize trusted agents. | Identity | RFC 9421 method is verified; TAP profile follows with license-clean sample data |
| Mastercard Verifiable Intent | Three-layer SD-JWT chain: issuer, user, agent – with constraints such as amount ranges and payees. | Instruction, scope, delegation | Verified: immediate and autonomous, against the official reference |
| Google AP2 | Mandates for agentic commerce; newer versions converge with Verifiable Intent. | Instruction, scope | Converged SD-JWT chain via the VI adapter; classic JSON mandates recognized |
| FIDO working groups | Standardization of agent authentication and agent-initiated commerce based on AP2 and Verifiable Intent. | All | Adopted as soon as specifications are available |
| Mandact (reference implementation) | Issues mandates, decisions before execution and receipts; Mandact comes from the operator of KYA. | Instruction, scope, decision, receipt | Verified by the KYA verification profile like any other issuer |
| Vendor platforms (e.g. identity verifiers) | Proprietary methods binding agents to verified persons. | Identity, principal | Verifiable once an open, signed format exists |
Where KYA stands
KYA is not another protocol but the neutral verifier above them. It translates any evidence into the same ten checks and the same assurance scale, regardless of who issued it. Formats are added when there is a public specification and real test vectors.
What an approach must provide to be verifiable
- A signed, openly specified format
- A published key or a way to obtain it independently
- A statement about the principal and the scope, not only about identity
- Test vectors or a reference implementation
Sources and status
Status of this overview: 12 October 2026. It is reviewed at least every six months.
- Skyfire, Know Your Agent (KYA): https://skyfire.xyz/know-your-agent-kya/
- Akamai, partnership with TollBit und Skyfire: https://www.akamai.com/newsroom/press-release/no-free-crawls-akamai-tollbit-and-skyfire-turn-traffic-into-revenue
- Akamai, Agentic Security Framework (Marketscreener): https://www.marketscreener.com/news/akamai-unveils-agentic-security-framework-to-power-trusted-ai-driven-interactions-and-commerce-ce7f5cdeda8cf724
- FIDO Alliance, announcement of 28 April 2026: https://www.fidoalliance.org/fido-alliance-to-develop-standards-for-trusted-ai-agent-interactions/
- Verifiable Intent, reference repository: https://github.com/agent-intent/verifiable-intent
- Web Bot Auth, reference repository: https://github.com/cloudflare/web-bot-auth
- AP2, reference repository: https://github.com/google-agentic-commerce/AP2
- RFC 9421, HTTP Message Signatures: https://www.rfc-editor.org/rfc/rfc9421