AI Agent Identity and Know Your Agent (KYA)

AI agent identity, often called Know Your Agent or KYA, is the practice of giving every agent a verifiable identity tied to a named human owner before it is allowed to act, especially to spend. Just as Know Your Customer underpins human finance, KYA underpins agent finance: you cannot govern, attribute, or be accountable for an agent's payments if you do not know which agent did what and who is responsible for it. Identity precedes payments, not the other way around.

This post explains the accountability gap, what an agent identity should contain, and why a registry and a named owner are the foundation of safe agent spend.

The accountability gap

Picture a finance lead asking a simple question: "An agent spent 2,400 USD last month, which agent, run by whom, under what authority?" In many deployments there is no clean answer. Agents share a single API key or a single card. They are spun up and torn down without record. When something goes wrong, there is no way to point to a responsible human. That is the accountability gap, and it is the single biggest reason agent spend feels risky.

The gap is not just operational. It is a compliance and trust problem. Auditors, customers, and partners increasingly expect to know that money moved by software was authorized by a person and is traceable to that person. Without identity, you cannot give them that assurance.

What an agent identity should contain

A useful agent identity is more than a name. At minimum it should capture:

When every agent carries this, every payment can be tied back to a who, a why, and a set of rules. That is the precondition for everything else.

Why identity comes before payments

It is tempting to bolt identity on later, after the agent is already spending. That order is backwards, for three reasons.

1. Attribution. If agents share credentials, you cannot tell which one made a given payment. Identity first means every transaction is attributable from the first dollar. This is what makes a real audit trail possible.
2. Policy. Spend controls and approval thresholds attach to an identity. Without one, your rules have nothing to bind to. With one, each agent gets exactly the limits it should. See spend controls.
3. Containment. When an agent is compromised, you want to revoke that agent, not panic-rotate a shared key that breaks everything. Per-agent identity means per-agent revocation.

This is why our model pairs each agent with a capped wallet and a named owner from the start. Identity is not a feature you add; it is the foundation the rest sits on.

The registry

Once each agent has an identity, you need a place to manage them: a registry. A registry answers, at any moment, which agents exist, who owns each one, what each is allowed to do, and what state it is in. It is the source of truth for governance. A few things a good registry enables:

• One view of every agent and its owner, so nothing is operating in the dark.
• Lifecycle control, activating, suspending, and retiring agents cleanly, so access tracks reality.
• Policy assignment, attaching the right limits and approval rules to each agent.
• Fast containment, suspending a single agent and revoking its credentials in seconds.

Without a registry, identity is a good intention. With one, it becomes an operational control you can actually run.

KYA and KYC, side by side

The parallel is deliberate. Agent finance is reinventing the trust primitives of human finance for software actors, and identity is the first of them.

Common questions

Is an API key enough identity?

No. A shared key tells you a request was authorized, not which agent made it or who owns that agent. Identity means one agent, one owner, one set of credentials, so attribution and revocation work at the level of a single agent.

What if agents spin up and down constantly?

That is exactly why a registry and lifecycle states matter. Ephemeral agents should still be registered, owned, and retired cleanly, so even short-lived agents leave a clear record of who ran them and what they did.

How does identity relate to mandates?

Identity says who the agent is and who owns it. A mandate says what that owner authorized it to spend. They work together: a mandate is only meaningful if you know which agent and owner it binds. Read agent payment mandates.

The takeaway

You cannot safely let an agent touch money until you can say which agent it is and who is responsible for it. Know Your Agent closes the accountability gap with verifiable identity, a named human owner, and a registry that gives you one view and fast containment. Get identity right and policy, audit, and trust follow. Next, read why an audit trail matters or see how it works.