What is Know Your Agent (KYA)?
Know Your Agent (KYA) is a framework for verifying an AI agent’s identity, binding it to a responsible person or organization, and determining what actions or transactions it is authorized to perform.
KYA addresses a different subject from Know Your Customer (KYC). KYC verifies people or businesses, while KYA identifies and authorizes autonomous software acting on their behalf. The two can work together in agentic commerce and other workflows where an AI agent interacts with external services.
KYA at a glance
-
Who it verifies: An autonomous AI agent and its relationship to a developer, business, user, or other responsible principal.
-
What it establishes: Machine-readable identity, relevant credentials, and the scope of the agent’s authority.
-
When it applies: During onboarding and again when an agent requests access or initiates a transaction.
-
What it does not replace: KYC, OAuth, IAM, API keys, or payment-network infrastructure.
-
Why it matters: A service may need to distinguish an authorized agent from an unidentified bot and evaluate whether a requested action is permitted.
KYC vs KYA for AI agents
KYC and KYA are complementary controls. KYC can establish the legitimacy of the person or business behind a workflow. KYA can then identify the autonomous agent and apply agent-specific authorization when it acts.
|
Comparison |
KYC |
KYA |
|---|---|---|
|
Target actor |
A person or business |
An autonomous AI agent |
|
Primary goal |
Verify customer identity and support applicable compliance requirements |
Verify agent identity and determine whether its requested actions are authorized |
|
Verification inputs or timing |
Commonly uses customer or business information and documentation during onboarding and throughout the relationship |
Can use developer identification, existing authentication, interaction history, transaction history, and other digital credentials during onboarding or at the time of an action |
|
Authorization model |
Establishes who the customer or business is, but does not by itself define an agent’s authority |
Applies scoped, revocable, and potentially transaction-level authority to a verified agent |
|
Example |
A business verifies an account holder before opening an account |
A service verifies an agent and checks whether it may make a specified purchase on the account holder’s behalf |
Why AI agents need a distinct identity model
AI agents do not present passports, birth certificates, or physical addresses as their own identifiers. They operate through software credentials and may take actions without a person completing an authentication prompt for every step.
Identifying the person or organization behind an agent remains important, but it does not answer every operational question. A service may also need to know which agent is acting, which principal authorized it, what task it is performing, and whether the requested access or transaction falls within its current authority.
KYA provides a structure for answering those agent-specific questions. It is particularly relevant when autonomous agents access third-party services or initiate payments across the open internet.
How KYA verification works technically
KYA implementations vary, but the verification process generally involves three connected functions: identity binding, credential verification, and authorization at the time of use.
1. Identity binding
Identity binding links an agent to a responsible principal, such as its developer, deploying organization, business customer, or user. The resulting relationship should make it possible for a relying service to identify the agent and understand who authorized or operates it.
This step does not eliminate the need to verify the underlying person or business. When a regulated workflow requires KYC or KYB, those checks can establish the principal’s identity while KYA establishes the agent’s relationship to that principal.
2. Credential verification
The agent presents a machine-readable credential or token to a service. The service verifies the credential and evaluates the claims needed for the requested interaction, such as the agent’s identity, issuer, verification status, or authorized scope.
Verification inputs may include developer identification, existing authentication methods, interaction history, and transaction history. Different providers can use different inputs, so a KYA credential should not be interpreted as proof of every possible security, compliance, or payment check.
3. Continuous or transaction-level authorization
Identity verification is not the same as permission. After identifying the agent, a service must determine whether a particular action is allowed. That decision may consider the requested resource, delegated scope, task, transaction amount, spending controls, risk signals, and the credential’s current validity.
Authorization can be evaluated continuously or for each sensitive transaction rather than treated as a permanent result of onboarding. Credentials and permissions should also be revocable when the agent, principal, or requested activity no longer meets policy.
KYA complements established security controls. OAuth can define delegated scopes, IAM can enforce organizational access policies, API keys can authenticate a credential, and workload identity can identify a service. KYA adds agent-specific identity context and authorization for autonomous actions; it is not a universal replacement for those systems.
Skyfire’s implementation of KYA
Skyfire implements KYA as a portable identity token for machine-to-machine verification. The token is intended to let an autonomous agent present a verified identity when accessing or transacting with participating third-party services without relying on a human MFA prompt for each interaction.
Skyfire’s Agentic Wallet addresses the related payment layer. It can associate payment authorization and spending controls with a verified agent identity rather than only with a card or other payment credential. This helps a relying service evaluate which agent and task initiated a transaction.
Together, the KYA token and Agentic Wallet form Skyfire’s identity and payment-authorization layer for autonomous agents. They do not replace payment networks, settlement systems, KYC obligations, or general-purpose identity and access management.
Experian Agent Trust and KYA
Experian Agent Trust is a separate framework that applies KYA concepts to AI-driven commerce. Experian describes four stages: verifying identity and payment, binding a human to an agent, validating intent and risk, and enabling secure transactions. It also describes KYA as an emerging ecosystem rather than an idea owned by one provider.
Experian’s framework and Skyfire’s implementation should not be treated as interchangeable products. Experian emphasizes identity, consent, intent, fraud risk, and continuous decisioning. Skyfire provides a portable KYA token and an Agentic Wallet focused on agent access and payment authorization. Public commentary has described Skyfire as participating in the broader Agent Trust initiative, but the available authoritative Experian product page does not document the technical interoperability between the two systems. Any integration claim should therefore be limited to separately verified implementations.
Frequently asked questions
What is Know Your Agent (KYA) verification?
Know Your Agent verification is the process of establishing an AI agent’s identity, linking it to a responsible principal, verifying its machine-readable credentials, and deciding whether it is authorized to perform a requested action or transaction.
KYA vs KYC for AI agents: what is the difference?
KYC verifies the person or business behind an account or transaction. KYA verifies and authorizes the autonomous agent acting for that principal. A workflow may require both rather than choosing one or the other.
How does KYA verification work technically?
A KYA system binds an agent to a principal, issues or accepts a verifiable credential, checks that credential when the agent interacts with a service, and evaluates whether the requested action falls within current policy and delegated authority.
Does KYA support continuous authorization?
It can. Instead of relying only on an onboarding decision, a KYA implementation can reevaluate authorization for sensitive actions or individual transactions and revoke credentials or permissions when conditions change.
Does KYA replace OAuth?
No. OAuth defines delegated access and scopes. KYA adds verified agent identity and agent-specific context that can inform authorization decisions. The two can be used together, along with IAM, API keys, workload identity, KYC, and payment controls.
