Know Your Agent (KYA)
Know Your Agent (KYA) is an industry term, with no single standard, for checking which AI agent is acting, who operates it, and whom it represents.
Know Your Agent (KYA) is an industry term for the checks a business runs to establish which AI agent it is dealing with, who built and operates it, and on whose behalf it acts, before the business trusts the agent’s request.
No single standard. The name borrows from Know Your Customer (KYC) checks in financial services. KYA has no single specification, certifying body or agreed checklist, and vendors use it for different bundles of checks. Treat a product’s “KYA” claim as a description of that product’s own process, and ask which of the checks below it performs.
What it usually covers.
| Check | Question | Existing building blocks |
|---|---|---|
| Agent authentication | Did this request really come from this agent? | TLS, API keys, OAuth 2.0, mutual TLS; HTTP Message Signatures (RFC 9421) for web traffic |
| Provider identity | Which organization operates it? | Signed Agent Cards (JWS), the domain serving the card, a trusted key store |
| Delegated authority | Did a person or company authorize this action? | OAuth tokens, payment mandates such as AP2; A2A’s TASK_STATE_AUTH_REQUIRED signals the need |
| Behaviour and reputation | Is this agent acting normally? | Request history, rate limits, abuse reports |
Where the standards stop. A2A handles identity with ordinary web security mechanisms: TLS, schemes declared in the Agent Card, and optional card signatures. A signature proves who holds the key, and the specification leaves it to the client to decide whether that key belongs to a reputable provider. For in-task authorization, A2A does not define the scope, format, validity or revocation of the resulting credential. On the web, the IETF Web Bot Auth working group is standardizing cryptographic authentication for automated clients. Its charter excludes agent-to-agent interfaces and authentication of the end user.
Emissar. Emissar’s Verify module is aimed at the provider-identity and reputation checks in this list: validating card signatures and keys, matching keys to known providers, and assessing requests. Status: In development.
Neighbouring terms. Agent identity is the set of facts a KYA process tries to establish.
Questions
- Is there a Know Your Agent standard?
- Not a single one. KYA is a label that vendors and commentators use for different sets of checks. Standards cover parts of it, such as HTTP Message Signatures (RFC 9421), the IETF Web Bot Auth work for automated web clients, and signed Agent Cards in A2A.
- How is KYA different from KYC?
- Know Your Customer (KYC) checks a person or company. KYA checks the software agent that shows up, the organization that operates it, and the authority it claims from a person or company. Some requests need both.