Glossary
Know Your Agent
Know Your Agent is the check a merchant or service runs before it lets an agent transact. The check asks which agent is acting, on whose behalf, and with what authority.
Last verified 2026-10-20
Sources
How the check works
A relying party uses the check before it lets an agent act. The proof can name the agent, the party the agent acts for, the authority for the action, or a combination of those. Directory pages for approaches with a listing are ERC-8004, Microsoft Entra Agent ID, Skyfire, Visa Trusted Agent Protocol, Web Bot Auth, and x401.
Shorter glossary entries for pieces of this check are agent identity, ERC-8004, KYAPay, and Web Bot Auth.
Approaches
Alphabetical by name. Each cell follows the linked source. Nothing on this page is scored.
| Approach | What is verified | How | Who issues it | Status | Source |
|---|---|---|---|---|---|
| Beltic KYA | The agent, the operator who sent it, and whether the action is authorized. | Beltic's site says each agent gets an identity, the request carries the operator and origin, and Beltic keeps a signed record of who acted. Its SDK verifies RFC 9421 HTTP message signatures and validates agent credentials. | Beltic, which its 2026-09-30 release says verifies the agent. | Early access | |
| ERC-8004 | An on-chain agent identifier, feedback about that agent, and a validation result. Payments are out of scope. | An ERC-721 identity registry assigns the agent id and points at a registration file. Separate registries store feedback and validation results. | Whoever deploys the registry. The ERC-721 owner controls the agent record. | Draft | |
| Microsoft Entra Agent ID | The agent identity in a tenant, so access policy, risk checks, and audit logs can apply to it. | The tenant creates agent identities from blueprints. Authentication can use OAuth 2.0. Microsoft also lists MCP and A2A, and says Agent ID is available for all Microsoft Entra customers. | The organization's Microsoft Entra tenant. | Live | |
| Skyfire KYAPay | The individual or organization that controls the agent, and a payment the buyer committed when the token includes pay. | The buyer agent creates a signed JWT. A kya token carries identity claims. A pay token carries the amount the seller charges after delivery. A kya-pay token carries both. Buyers and sellers exchange the token directly. | Skyfire signs tokens created through its API. The JWT shape is also an IETF Internet-Draft. | Live product, draft format | |
| Visa Trusted Agent Protocol | That a Visa-approved agent sent the request. The protocol also describes signatures for consumer recognition and payment. | The agent adds an RFC 9421 HTTP message signature. The merchant rebuilds the signed material and checks it with the agent's public key. | Visa approves the agent. Its 2026-07-02 release says live merchant purchases used Trusted Agent Protocol and the Agent Directory. | Live | |
| Web Bot Auth | Which automated client signed the HTTP request. | The client signs the request and publishes public keys in a directory. The Signature-Agent header points at that directory. Cloudflare's docs describe transitive trust from the site owner to the bot operator to the end user, and an experimental Forwarded header that names the operator. | The bot or agent operator hosts the keys. Cloudflare verifies bots that register a directory with it. | Draft spec, Cloudflare documents verification | |
| x401 | A credential the verifier requested, such as personhood, residency, membership, or organizational standing. Binding an agent identifier is optional. Payment stays on HTTP 402. | The server sends a PROOF-REQUEST header carrying an OpenID4VP request. The agent returns a PROOF-RESPONSE. The draft is version 0.2.0. | The verifier names trusted authorities in the request. | Draft, version 0.2.0 |
Recent developments
Dated statements from the linked source, newest first.
2026-10-19
On 2026-10-19, Skyfire and Forter said Forter's Fraud Management for Agentic Commerce ingests Skyfire Know Your Agent protocol data to enrich decisioning on agentic purchases.
Skyfire and Forter Business Wire release, 2026-10-192026-10-02
On 2026-10-02, the IETF published draft-skyfire-oauth-kyapay-token-02. The draft defines a JWT format for agent identity and payment tokens. It is an Internet-Draft.
KYAPay token Internet-Draft2026-09-30
On 2026-09-30, Beltic said it emerged from stealth with a Know Your Agent platform that verifies an agent's identity, authority, and transactional legitimacy. The release says design partners get early access.
Beltic press release, 2026-09-302026-09-30
On 2026-09-30, Mastercard said it is working with Skyfire, which it calls a provider of Know Your Agent technology, so financial institutions and merchants can recognize trusted agents.
Mastercard press release, 2026-09-30
Listings
Directory listings whose sources describe this mechanism.
| Name | Status | Category | Open source | Mechanism |
|---|---|---|---|---|
| ERC-8004 | Designed | Identity and trust | Yes | Draft Ethereum proposal for three registries: an ERC-721 identity that points at an agent registration file, a reputation registry, and a validation registry. registries, reputation, ethereum |
| Microsoft Entra Agent ID | Live | Identity and trust | No | Identity platform that creates agent identities from blueprints and applies Entra access policy, risk checks, and audit logs to them. enterprise, oauth, audit |
| Skyfire | Live | Payment rails | No | Issues signed KYAPay tokens that bind an agent identity to a payment the buyer has committed, which the seller charges after delivery. wallets, identity, kya |
| Visa Trusted Agent Protocol | Live | Identity and trust | No | Visa specification for merchants to verify an approved agent from an RFC 9421 HTTP message signature bound to the site and the action, with optional consumer and payment identifiers. Visa reports live agent purchases at European merchants through it and its Agent Directory. http-signatures, merchants, cards, agent-verification |
| Web Bot Auth | Beta | Identity and trust | Yes | Method for an automated client to sign HTTP requests so a site can verify which bot or agent sent them. The signature rules are an IETF working group draft, not yet a standard. http-signatures, bots, draft |
| x401 | Beta | Identity and trust | Yes | Draft HTTP protocol at version 0.2.0. A server sends a PROOF-REQUEST header for a verifiable credential, the agent returns a PROOF-RESPONSE, and payment stays on HTTP 402. credentials, http-401, openid4vp |
Questions
- What is Know Your Agent?
- Know Your Agent is the check a merchant or service runs before it lets an agent transact. The check asks which agent is acting, on whose behalf, and with what authority.
- Does this page rank the approaches?
- No. The approaches are listed alphabetically by name. Nothing on this page is scored.
- When was this page last verified?
- Last verified 2026-10-20.