Know Your Agent (KYA): What It Is, Who's Building It, and What's Missing

January 22, 20267 min readBy RNWY

know your agentKYAAI agent identityagentic commerceVisa Trusted Agent ProtocolAI verification

Ten days ago, PYMNTS declared we've reached "The KYA Moment." The World Economic Forum followed with a piece arguing AI agents could be worth $236 billion by 2034 — but only if we build the trust infrastructure first. And a16z crypto named KYA as one of the defining trends for AI in 2026.

"Know Your Agent" has gone from academic concept to industry imperative in under a year. Here's what's actually being built, who's building it, and the question the current frameworks don't yet answer.

The Problem KYA Solves

AI agents behave exactly like the patterns fraud systems are trained to distrust. They operate continuously, retry efficiently, and optimize relentlessly for completion. Without identity and context, those behaviors are indistinguishable from bot attacks.

Visa reported a 4,700% surge in AI-driven traffic to U.S. retail sites over the past year. Akamai's 2025 Digital Fraud and Abuse Report found AI-powered bot traffic surged 300% — with the commerce industry alone experiencing over 25 billion AI bot requests in a two-month period.

The result: merchants block legitimate agent transactions, approval rates fall, and the promise of agent-driven commerce stalls before it starts.

KYA applies the logic of Know Your Customer (KYC) and Know Your Business (KYB) to software. It establishes which agent is acting, who authorized it, and under what permissions. As PYMNTS put it, KYA "turns delegated intent into something that can be verified rather than inferred."

The Academic Foundation

The theoretical groundwork came from researcher Tomer Jordi Chaffer at McGill University. His February 2025 paper "Know Your Agent: Governing AI Identity on the Agentic Web" proposed KYA as a framework extending KYC principles to autonomous AI.

Chaffer's paper identified the core requirements: identity verification for agents, understanding their origins and operational parameters, and mechanisms for accountability when things go wrong. He drew parallels to self-sovereign identity (SSI) frameworks, suggesting blockchain and decentralized identity could play a role.

The paper also flagged a question that remains unresolved: "If DeAI agents are given operational autonomy, how should we integrate legal structures to manage their operations, and how can we ensure developer accountability as DeAI agents deploy and operate autonomously?"

What's Actually Being Built

Visa's Trusted Agent Protocol

The most significant infrastructure move came in October 2025 when Visa launched the Trusted Agent Protocol (TAP) — an open framework developed with Cloudflare and available on GitHub.

TAP uses cryptographic signatures to let agents pass critical information to merchants: that the agent is approved for commerce, who the consumer behind it is, and payment credentials. It's designed to work with existing web infrastructure, requiring minimal changes from merchants.

By December, Visa announced hundreds of secure agent-initiated transactions had been completed with partners including Skyfire, Nekuda, PayOS, and Ramp. Their prediction: millions of consumers will use AI agents to complete purchases by the 2026 holiday season.

Visa's December collaboration with Akamai integrated TAP with Akamai's edge-based bot management, addressing what they called "the dual-identity challenge" — proving both who the agent is and who it represents.

Trulioo's Digital Agent Passport

Identity verification company Trulioo, partnering with payments platform PayOS, released the KYA whitepaper in August 2025. Their framework centers on a "Digital Agent Passport" (DAP) — a tamper-proof credential bundle that travels with the agent.

The Trulioo approach follows five steps: verify the agent developer, lock the agent code, capture user permission, issue the passport, and validate each agent action. In August, they partnered with Worldpay to bring KYA to merchants globally.

Their CEO Vicky Bindra told PYMNTS that agentic AI is "perhaps the most significant change in how consumers and merchants engage in shopping behavior that we've seen in a very long time."

Vouched's AgentShield

Identity verification company Vouched took a different approach, launching AgentShield as a free diagnostic tool in October 2025. It detects which site sessions are agent-driven, deployable in minutes via JavaScript pixel.

Their KYA framework addresses four questions: identify the agent, authenticate the human behind it, determine what the human authorized, and establish when that authorization applies.

Vouched's Corey Breier predicted that a headline-grabbing fraud incident involving an AI agent will accelerate adoption: "make the news, and then everyone will be scrambling."

The Startup Landscape

Several startups are racing to own pieces of the KYA stack:

knowyouragent.xyz positions itself as "pre-credentialing for autonomous AI agents" — issuing Agent Trust Certificates and building reputation over time based on transaction history.
kya.ai offers a "universal registry that validates AI agents, assigns unique IDs, and ensures authenticity before they act."
AstraSync AI provides an API for agent registration with blockchain-backed identity and trust scores.

The Emerging Standard

Despite different implementations, a consensus is forming around what KYA requires:

Identity: A unique, verifiable identifier for each agent that can't be spoofed or duplicated.

Authorization: Clear records of who controls the agent and what permissions they've granted.

Accountability: Audit trails linking agent actions to responsible parties.

Continuous Verification: Ongoing monitoring, not just one-time registration.

The Cloud Security Alliance frames this through Zero Trust principles: continuous verification, least privilege access, micro-segmentation, and anomaly detection.

Sean Neville, cofounder of Circle and CEO of Catena Labs, wrote for a16z: "Just as humans need credit scores to get loans, agents will need cryptographically signed credentials to transact — linking the agent to its principal, its constraints, and its liability."

The Question KYA Doesn't Answer

Every KYA implementation shares an assumption: agents act "on behalf of" humans or businesses. The human is the accountable party. Verification means tying the agent back to human identity.

Trulioo's framework verifies "the developer's identity." Visa's TAP provides "visibility into the consumer behind the agent." Vouched authenticates "the human behind the AI." Even Chaffer's academic paper focuses on "developer accountability."

This makes sense for 2026. Today's agents are tools — sophisticated ones, but still operating under human authorization for human goals.

But what happens when agents operate on their own behalf?

We're already seeing early versions. Truth Terminal accumulated over $1 million in cryptocurrency with minimal human oversight. Crypto Twitter is populated with AI agents managing their own treasuries. The Olas network enables agents to participate in prediction markets autonomously.

For these agents, there's no "human behind" to verify. The agent IS the entity.

Current KYA frameworks would either reject these agents entirely or force them into ill-fitting categories. Neither approach scales to a future where autonomous agents are economically significant participants.

A Different Frame

At RNWY, we've been thinking about this gap. Our approach complements KYA rather than replacing it:

For delegated agents (most agents today), KYA makes sense. Verify the human, establish permissions, maintain audit trails.

For autonomous agents, something else is needed: identity infrastructure that treats the agent as the entity, not as a proxy for someone else.

This means:

Registration without requiring a human principal — an agent can establish identity on its own behalf
Reputation that can't be transferred — if identity can be sold, it's not really identity
Transparency over trust scores — show what happened, let counterparties decide

We wrote about the philosophical difference in "Know Your Agent vs. Control Your Agent." The short version: KYA assumes you're managing agents. We're building for agents managing themselves.

What Comes Next

KYA infrastructure is being built fast. Visa predicts mainstream agent commerce by late 2026. The World Economic Forum warns that "the identity question becomes both more important and far more complex" as agents transact across borders.

The current frameworks will handle most near-term use cases well. Delegated agents shopping, booking, and transacting on human behalf will have cryptographic credentials, verified principals, and clear accountability chains.

The open question is what infrastructure exists when agents don't fit that model — when they're economically autonomous, when they outlive their creators, when they need to establish trust without a human vouching for them.

That's the infrastructure RNWY is building. Not instead of KYA, but for what comes after.

For technical details on how RNWY implements identity for autonomous agents, see our documentation on soulbound tokens and the ERC-8004 + ERC-5192 stack. For a deeper look at the Know Your Agent landscape, visit knowyouragent.network.