Know Your Agent
Know Your Agent (KYA).
Know Your Agent (KYA) is the practice of verifying an AI agent's identity, the permissions it holds, and that a real customer authorized it, before letting it transact. It extends KYC and KYB to software agents.
KYA is where CIAM meets payments risk. A merchant or bank can no longer assume the party at checkout is the human customer. It needs to know which agent is acting, who that agent works for, and whether this action falls inside what the customer allowed.
Most of that evidence already lives in a CIAM system. The customer's verified identity, the consent they gave, the delegation they granted to an agent, and the scopes on the agent's token are all identity records. KYA asks you to keep them linked, so a transaction can be traced from agent to delegation to verified person. The Know Your Agent for CIAM guide covers that data model.
The market is converging on that model without a shared standard. Ant International, Mastercard and Visa (September 10, 2026) are working on interoperability principles across their separate agent protocols. Experian Agent Trust and Shufti Know Your Agent (covered by Help Net Security on October 30, 2026) both tie an agent to a verified principal and a mandate. Our reading: the principal binding is the part to get right, and it is a CIAM record. The human principal entry covers proof that a live person sits at the root.
KYA is the identity layer, not the whole decision. Per-transaction checks such as an agent transaction probability score sit on top of it and judge whether a specific payment fits the authority the agent holds. For the commerce side of this shift, see how AI agents find, compare, and buy.
Common questions
What is Know Your Agent?
Know Your Agent (KYA) is the practice of verifying which AI agent is acting, what it is permitted to do, and that a real customer authorized it. It extends KYC (verifying people) and KYB (verifying businesses) to software agents that buy, book, or transact for a user.
How is KYA different from KYC?
KYC verifies that a person is who they claim to be, usually once at onboarding. KYA verifies the agent acting for that person, the scope of its permissions, and whether this specific action was authorized. KYA depends on KYC, because the agent's authority traces back to a verified customer.
What are the parts of a KYA program?
The PYMNTS and Trulioo framing names three: identity verification of the agent, permission controls that limit what it can do, and real-time monitoring that confirms the user authorized it. A CIAM system supplies the customer identity and the delegation record those parts rely on.
Who is using KYA today?
Payments networks are the earliest adopters. Mastercard's Agentic Commerce Trust Framework, announced September 30, 2026, uses Skyfire for KYA verification and pairs it with a per-transaction Probability Score. It was in US-only testing at announcement.
Is there a common KYA standard across payment networks?
Not yet. On September 10, 2026, Ant International, Mastercard and Visa announced a collaboration toward a KYA interoperability framework based on shared principles: agent traceability to a verified operator or cardholder, shared certification requirements, and continuous monitoring. Each network keeps its own protocol and verification process, so for now KYA differs by network and vendor.
What does a KYA product check?
Commercial KYA products follow a similar shape. Shufti's Know Your Agent (October 28, 2026) links each agent to a principal verified through KYC or KYB, enforces that principal's mandate of permitted actions, limits and expiry, assigns a trust score, and keeps an audit trail. Experian Agent Trust (April 30, 2026) binds consumer, device and agent and issues a per-transaction trust token.
Related terms
In the guides
Authentication for AI Agents: OAuth Patterns for Non-Human Identity
How AI agents authenticate in 2026. The on-behalf-of pattern, delegated agent identity, OAuth 2.1 Dynamic Client Registration, and where the patterns are still being invented.
Identity Verification and Proofing (IDV/KYC): A CIAM Guide for 2026
How to prove a real person matches a claimed identity at signup: document capture, liveness, authoritative-data checks. The 2026 stack, the deepfake escalation, and where CIAM ends.
Know Your Agent: Identity for AI Agents That Buy on a Customer's Behalf
What a CIAM team must build when a customer's AI agent shows up at login, account, or checkout: delegated consent, agent sessions, step-up, audit, and revocation.