What is Know Your Agent?
Know Your Agent (KYA) is the verification of whether an AI agent was authorized for a specific action: who it is, on whose behalf it acts, what it was allowed to do and whether this exact action was permitted at that moment – proven in a way that third parties can recompute independently.
In short
Know Your Agent (KYA) checks on every action of an AI agent whether it was covered by a valid mandate, and proves it so that third parties can recompute it independently.
Who issues evidence
Evidence is created by issuing systems: by payment networks following Verifiable Intent, by platforms with their own formats or by mandate services such as the reference implementation Mandact from the operator of KYA. KYA stands outside: it verifies every piece of evidence by the same ten checks, no matter where it comes from.
The four questions
- Identity: Which agent acted, and does it hold the key its identifier is bound to?
- Principal: Which natural or legal person instructed it?
- Scope: Which actions, amounts, counterparties and periods does the mandate cover?
- Permissibility with proof: Was the specific action covered at the moment it was executed, and is there a receipt that cannot be changed afterwards?
If one of the four answers is missing, an agent action is not proven, only claimed.
KYA, KYC and KYB
| Know Your Customer | Know Your Business | Know Your Agent | |
|---|---|---|---|
| Subject | Natural person | Company | Software acting on someone's behalf |
| Core question | Who is this person? | Who is behind the company? | Was this agent allowed to do exactly this? |
| Timing | Once, repeated periodically | Once, repeated periodically | On every action |
| Outcome | Identified person | Identified company | Proven or disproven authority |
KYA does not replace KYC and KYB. It builds on them: an agent's principal may be identified through KYC or an e-ID, and only the mandate connects that principal to the agent. In detail in the knowledge article
Identity is not authority
Identity and access management answers who signs in and which systems they may access. An agent that is correctly authenticated and has access to a payment interface is not thereby authorized to trigger a specific payment of a specific amount to a specific counterparty. This gap between access and concrete authority is what KYA is about. Why IAM does not cover it
What KYA evidence consists of
- Mandate
- The principal's signed, machine-readable authorization for the agent, with scope and validity.
- Decision
- The signed decision of a verifying party before execution: allowed, denied or escalated.
- Receipt
- The entry after execution, chained to all earlier ones so that none can go missing or change unnoticed.
- Status list
- The revocation mechanism: shows whether a mandate still holds at the time of verification.
- Timestamp
- A timestamp authority's confirmation that specific content existed at a specific time.
Who needs KYA
- Operators of their own agents: they are principal and verifying party at once and want to be able to prove every action of their agents.
- Auditors: they need receipts they can recompute without access to the operator's systems.
- Counterparties: merchants, platforms and service providers that must decide whether to accept a third-party agent's action.
- Principals: they want to see what happened in their name and what was denied.
How KYA becomes verifiable
KYA translates the four questions into ten deterministic checks with six possible statuses and summarizes the result on an assurance scale from A0 to A4. The formats are openly specified, verification runs locally and every report is reproducible. Verify evidence
Know Your Agent and the identity approaches
The term Know Your Agent is used differently around the world. Many vendors understand it as identity verification of an agent or the person behind it, similar to Know Your Customer. Others mean a risk assessment of agents within a company. These approaches are important, but they mainly answer the question of who is acting.
KYA, as knowyouragent.ch understands it, starts one step later: at the individual action. It verifies whether an agent was authorized for exactly this action, with evidence that third parties can recompute independently. The page Know Your Agent approaches offers an overview.
Know Your Agent in Switzerland and the DACH region
In the German-speaking region, agents meet a body of law that has long known agency: Articles 32 et seq. of the Swiss Code of Obligations, Sections 164 et seq. BGB, Sections 1002 et seq. ABGB. The question of proving authority is not new there, but an old question in a new form. Added to this are data protection, government identities such as the Swiss e-ID and the EUDI wallet, and European rules for AI.
The country pages Switzerland, Germany and Austria put this in context for each country.
General information, not legal advice.
Who KYA is for
- Merchants and platforms that accept orders from shopping agents and want to tell legitimate agents from abuse.
- Banks and insurers that need to accept payments, orders and applications from agents in a traceable way.
- Authorities that want to attribute applications and notifications from agents to a person.
- Companies with their own agents that want to show their agents act within the limits granted.
- Developers who create or verify evidence and need an open verification profile with test vectors for it.
How a verification works
A verification with KYA starts with the evidence an agent presents, such as a mandate, an evidence pack or a signed request. KYA detects the format, verifies the signatures, attributes the issuer, binds agent and principal, checks validity, scope, delegation and revocation, and compares execution with the decision. The result is a verdict with a level and reasons for each step.
Verification runs in the browser or as a package in one's own system. The five-step guide shows what this looks like in concrete terms.
What KYA is not
KYA is not identity verification of people, not bot protection and not an issuing authority. KYA issues no evidence itself and stores none. It verifies evidence that others have issued, according to open rules, and makes the result equally recomputable for everyone involved. This restriction is deliberate: a neutral verifier must have no interest of its own in any of the evidence it checks.
Frequently asked questions
Is Know Your Agent a standard?
KYA is an open verification profile with public test vectors that anyone can implement. It is not a norm of a standards organization; a neutral governing body is being sought.
How does KYA differ from Know Your Customer?
KYC checks at onboarding who a person is. KYA checks with every action whether an agent was authorized for exactly this action.
What does verification with KYA cost?
Nothing. Verification on knowyouragent.ch is free, needs no account and runs entirely in the browser.
Who operates knowyouragent.ch?
Innopulse Consulting GmbH in Zug. It also develops the commercial reference implementation; verification remains independent of it and follows an open verification profile.
Can I use KYA without technical knowledge?
Yes. On the verification page, paste evidence or choose an example and click “Verify”. The certificate explains the result in plain language.
In which languages is KYA available?
In German and English. Terms and results are equivalent in both languages, and every page has its counterpart in the other language.
Is KYA also available as a service for companies?
Verification is public and free, and the engine is available as a package. Mandates and decisions are issued by a mandate service, such as the operator's reference implementation. Verification remains independent of it and follows the open verification profile.