Know Your Agent (KYA)

advancedexperimental

The practice of identifying AI agents: verifying who stands behind the agent, on whose behalf it acts, and what authorization it has received.

In plain terms

If someone goes to the post office for your registered letter on your behalf, they are asked for a power of attorney: who they are, on whose behalf they act, and exactly what they can collect. Know Your Agent asks the same question of the machine. If an AI agent buys, books, or signs a contract on your behalf, the other party must know whether there is a genuine mandate behind it.

The name is modeled after the banking world's KYC (Know Your Customer). There, the bank identifies the person before opening an account. Here, the online store, bank, or provider identifies the software acting on behalf of a human.

It is needed because websites have essentially recognized only two groups so far: humans and bots. Some known, useful bots were let in, such as search engine crawlers, while the rest were filtered out as far as possible. The agent is a new case: a machine, but one that shops and handles matters on behalf of a specific person or company. KYA helps distinguish an agent acting on a legitimate mandate from a fraudulent or runaway program.

How it works

Registration: the agent's developer or operator identifies themselves with a trusted entity, such as a card company or identity provider, and the agent receives a unique digital identifier.
Connection to the principal: the agent is linked to the person or company on whose behalf it acts and who is responsible for its actions.
Authorization recording: in machine-readable form, it specifies what the agent can do, such as how much it can spend, in which stores, and for how long.
Verification on the other side: when the agent arrives at a website, it presents a digitally signed credential, and the receiving party uses this to verify its identity and permissions.
Logging and revocation: the agent's actions are recorded so they can be traced in case of dispute, and the principal can revoke permission at any time.

An everyday example

You ask your AI assistant to book a flight to Barcelona for up to 60,000 forints. If the airline's website supports agent identification, it will not block it as a robot, because the agent can prove it is purchasing on your behalf and within the specified budget. The payment can then go through, and you can later review what was done in your name.

Who is affected

bank customer, investorIf an agent pays or transfers on your behalf, the bank can decide whether to accept the order based on KYA. If something goes wrong, KYA data helps prove who authorized what; who bears the loss is determined by laws and contracts. → Money

entrepreneur, executiveThe online store must decide which agents are allowed to purchase, otherwise it risks losing customers or opening the door to fraudsters.

developerThe agent you build can only access payment and trading systems if it can identify itself and its principal. → Code

lawyer, citizenTo establish liability, it must be proven who commissioned the agent and for what. The KYA provides evidence for this, but liability rules are defined by law. → Law

A common misconception

MythKYA verifies that the agent is reliable and will make sound decisions.

In realityKYA only verifies who stands behind the agent, on whose behalf it acts, and what permissions it has received. A properly identified agent can still make mistakes or be deceived.

Limits and risks

There is no unified standard: multiple competing solutions exist, so an agent identified in one system may not necessarily be accepted by another.
Identification does not protect against bad decisions: a verified agent can still buy the wrong product or fall for hidden instructions on a malicious website.
If the agent's ID or access key is stolen, the thief can act in your name, so it is advisable to set narrow scopes and short validity periods.
Detailed logging also raises data protection issues: providers can get a precise picture of what your agent does on your behalf.

Similar, but not the same

Know Your Customer (KYC) – KYC identifies the person or company, while KYA identifies the software acting on their behalf and its authorization.
CAPTCHA and bot filtering – The goal of robot filtering is to exclude unwanted machines, while the goal of KYA is to admit legitimately operating machines.
Two-factor authentication – Two-factor authentication strengthens entry with a second step (for example, a code sent to a phone) to confirm it is really you. KYA verifies that an agent acting in your absence received authorization from you.

Related concepts

Broader

AI-agent, digital identification, AI governance, AI safety

Narrower

Agent ID, Authenticated Delegation, Agentregiszter

On the edge

Know Your Customer (KYC), Agent-based commerce, Agent payment protocol, Prompt injection, Ember a folyamatban

A brief history

The term was modelled on the financial sector's KYC (know-your-customer) rules, when AI agents that shop and pay on their own appeared. It spread more widely in 2025, when major card networks, payment and technology companies introduced their first solutions for identifying agents.

Where things stand

By the end of 2026, multiple competing solutions and industry initiatives exist, but there is no unified standard, and KYA is not explicitly mandated by law. In practice, the payment and online commerce sectors are mainly experimenting with it.

Status: 2026 November

In the news

Appears in 4 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Agent identity: LexisNexis, Mastercard and Trulioo build Know Your Agent toolsNov 4, 2026 · Money
Mastercard expands Agent Pay with new trust and intelligence servicesSep 28, 2026 · Money
Visa, Mastercard and Ant seek to align AI agent verification, but disagree on the solutionSep 14, 2026 · Money
MCP publishes new roadmap focused on long-running processes and AI agent authenticationAug 24, 2026 · Code

Also known as

KYA · Know Your Agent · ismerd meg az agentedet · agent identification · agent authentication · AI agent identity · agent verification · meet your agent

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.