Know Your Agent (KYA)

KYA · Agent verification

Definition

Know Your Agent (KYA) refers to the practices of verifying who is behind an AI agent and what it is allowed to do before dealing with it, by analogy with Know Your Customer in banking. The term comes mainly from payments and identity vendors and has no single agreed definition.

What the term covers today

Usage varies from one source to another. In payments it mainly means checking that an agent is entitled to transact on someone's behalf. In identity and fraud prevention it extends to checking the agent, its operator and its reputation. Experian, for instance, presents it as a framework for building trust in interactions driven by AI. As no authority has fixed the meaning, it is worth asking what any given vendor includes under the label.

Three questions KYA should answer

  • Is this really the agent it claims to be? See agent identity.
  • Who answers for it? There should be an organization and a named person behind it.
  • What is it entitled to do? This is the authority side, ideally with a verifiable and revocable mandate, such as a payment token with a ceiling and allowed merchant categories.

What KYA leaves to you

KYA is designed for the party facing the agent, such as a merchant wondering whether to accept a purchase. It tells you little about your own agents and whether their decisions are acceptable. An organization can therefore pass every external verification and still have no answer to the question of who allowed this decision. The two approaches work together: KYA for the agents that come to you, and AI agent governance for those acting on your behalf.

Frequently asked questions

What is the difference between KYC and KYA?

KYC verifies a person or a company before doing business with them, under anti-money-laundering rules. KYA transposes the idea to software acting for someone. It is an industry practice at this stage, without an equivalent legal regime.

Is KYA a legal obligation?

Not as such, to our knowledge, in the EU at the date of this page. Sector rules may lead you there indirectly, for example in payments.

Where does your organization stand?

ACF Score measures your agentic governance in about 10 minutes, the AI Act checker tells you which obligations apply, and ACF Control applies your rules before an agent acts.

Take the ACF ScoreAI Act checkerACF Control

Related terms

AI agent identityThe means of recognizing which agent is acting, on whose behalf, in which version and under which mandate.AI agent authorization vs authorityAuthorization is what an agent can technically reach; authority is what it is entitled to decide. Governing an agent requires both, and they often diverge.AI agent decision authorityThe scope of decisions an AI agent is entitled to take by itself, set by the organization and bounded by limits written in advance.

See all 25 terms in the glossary

Primary sources

Written by Vincent Dorange, creator of the Agentic Commerce Framework®. Last updated .