Know Your Agent
Know Your Agent (KYA).
Know Your Agent (KYA) is the practice of verifying an AI agent's identity, the permissions it holds, and that a real customer authorized it, before letting it transact. It extends KYC and KYB to software agents.
KYA is where CIAM meets payments risk. A merchant or bank can no longer assume the party at checkout is the human customer. It needs to know which agent is acting, who that agent works for, and whether this action falls inside what the customer allowed.
Most of that evidence already lives in a CIAM system. The customer's verified identity, the consent they gave, the delegation they granted to an agent, and the scopes on the agent's token are all identity records. KYA asks you to keep them linked, so a transaction can be traced from agent to delegation to verified person. The Know Your Agent for CIAM guide covers that data model.
KYA is the identity layer, not the whole decision. Per-transaction checks such as an agent transaction probability score sit on top of it and judge whether a specific payment fits the authority the agent holds. For the commerce side of this shift, see how AI agents find, compare, and buy.
Common questions
What is Know Your Agent?
Know Your Agent (KYA) is the practice of verifying which AI agent is acting, what it is permitted to do, and that a real customer authorized it. It extends KYC (verifying people) and KYB (verifying businesses) to software agents that buy, book, or transact for a user.
How is KYA different from KYC?
KYC verifies that a person is who they claim to be, usually once at onboarding. KYA verifies the agent acting for that person, the scope of its permissions, and whether this specific action was authorized. KYA depends on KYC, because the agent's authority traces back to a verified customer.
What are the parts of a KYA program?
The PYMNTS and Trulioo framing names three: identity verification of the agent, permission controls that limit what it can do, and real-time monitoring that confirms the user authorized it. A CIAM system supplies the customer identity and the delegation record those parts rely on.
Who is using KYA today?
Payments networks are the earliest adopters. Mastercard's Agentic Commerce Trust Framework, announced September 30, 2026, uses Skyfire for KYA verification and pairs it with a per-transaction Probability Score. It was in US-only testing at announcement.
Related terms
In the guides
Authentication for AI Agents: OAuth Patterns for Non-Human Identity
How AI agents authenticate in 2026. The on-behalf-of pattern, delegated agent identity, OAuth 2.1 Dynamic Client Registration, and where the patterns are still being invented.
Identity Verification and Proofing (IDV/KYC): A CIAM Guide for 2026
How to prove a real person matches a claimed identity at signup: document capture, liveness, authoritative-data checks. The 2026 stack, the deepfake escalation, and where CIAM ends.
Know Your Agent: Identity for AI Agents That Buy on a Customer's Behalf
What a CIAM team must build when a customer's AI agent shows up at login, account, or checkout: delegated consent, agent sessions, step-up, audit, and revocation.