Already 15 months old when the scout caught it.
Know Your Agent (KYA)
What it is
Know Your Agent (KYA) is an identity-and-authorization framework for AI agents that act autonomously in commerce and enterprise systems — extending the "Know Your Customer" (KYC) model from human finance to non-human actors. A KYA check answers three questions in real time: can this agent's credentials and reputation be trusted, which verified human or organization is it acting for, and did that principal actually authorize this specific action. Implementations bind an agent's identity to a registered owner, issue it verifiable credentials, and log its actions for audit, so a transaction or API call can be traced back to accountable humans even when no human clicked anything.
Why it's emerging now
Through late 2025 and 2026, agents started transacting directly — comparing prices, completing checkouts, calling paid APIs — faster than the identity infrastructure meant to secure them. That created three problems at once: scrapers and bad actors got better at impersonating legitimate agents, merchants and banks had no standard way to attribute fraud or chargebacks to a specific agent or its operator, and regulators had no attribution hook at all. Skyfire's KYAPay protocol (launched June 2025) gave the pattern its first commercial framing; identity-verification incumbents (Sumsub, Experian, Trulioo), payment networks (Visa, via Visa Intelligent Commerce), and a dedicated industry body (the MetaComp KYA Framework, April 2026) have since converged on "KYA" as the shared name. U.S. banking regulators formally recognizing verifiable digital credentials under Customer Identification Program rules in September 2026 gives it fresh regulatory teeth.
How it relates to what you know
It sits alongside Enterprise-Managed Authorization (EMA) and Client ID Metadata Documents (CIMD) as another agent-identity pattern, but solves a different half of the problem: CIMD and EMA are about an MCP client proving itself and an enterprise IdP centrally authorizing which servers it can reach, whereas KYA is about proving which human or org an agent is acting for when that agent transacts with external, often financial, systems outside any single protocol's trust boundary — closer to a compliance/commerce layer than a protocol extension.