KYA know your agent is the identity layer agentic commerce is missing: a verified credential that tells a merchant, payment network or API who an AI agent represents, what it is allowed to do, and who carries liability if it misbehaves. As AI agents start shopping, booking and paying, KYC alone isn’t enough. The buyer may be known. The agent still isn’t.
What is KYA know your agent?
KYA know your agent means verifying an AI agent before it acts on behalf of a person or company. In practice, that could mean a cryptographic credential linking the agent to its operator, the user who delegated authority, the permitted task, transaction limits, expiry time and audit trail.
Think of it as the agentic-commerce cousin of KYC, but don’t stretch the analogy too far. KYC asks whether the customer is real and legally allowed to transact. KYA asks whether the software making the request is authentic, authorized and constrained. Different problem. Different evidence.
The idea moved from theory to market pressure in 2025 and 2026. Google announced the Agent Payments Protocol, or AP2, on September 16, 2025, using cryptographically signed “mandates” to record user intent and transaction constraints. OpenAI and Stripe launched Instant Checkout in ChatGPT in September 2025 using the Agentic Commerce Protocol, with Stripe describing Shared Payment Tokens that let AI applications initiate payments without exposing the buyer’s card details.
By April 28, 2026, Google had donated AP2 to the FIDO Alliance for broader standardization. That matters because payments don’t scale on trust-me demos. They scale when merchants, credential providers, processors and wallets can verify the same evidence without bespoke integrations.
Why KYC doesn’t solve the agent problem
A human checkout flow has a familiar chain of trust. You log in, authenticate, enter or select a payment method, accept the purchase and get a receipt. Fraud systems still work hard, but the intent signal is relatively direct.
An AI agent breaks that pattern. It may compare products, negotiate timing, choose a merchant, fill a cart and trigger payment while you are away. If something goes wrong, the merchant needs to know whether the request came from your approved agent, a spoofed bot, a compromised extension or a malicious script replaying stale instructions.
Here’s the calculation many generic explainers skip. Suppose an agent is allowed to buy office supplies up to $500 per week for 40 employees. If its credential only says “authorized buyer,” one prompt-injection attack could turn a routine reorder into $20,000 of exposure before a monthly reconciliation catches it. If the credential carries a $500 weekly cap, merchant category limits and a 24-hour mandate expiry, the blast radius is sharply smaller.
Honestly, any KYA know your agent system that doesn’t encode limits is just a badge. A pretty one, perhaps, but still a badge. The hard part is not naming the agent; it’s proving the scope of delegated authority at the moment of use.
The security pressure is already visible beyond payments. Cloudflare promoted Web Bot Auth in 2025 as a way to cryptographically verify bot and agent traffic, replacing reliance on IP allowlists or spoofable user-agent strings. In 2026, Cloudflare documentation described signed HTTP request headers using HTTP Message Signatures and Ed25519-style signatures, while also saying its implementation doesn’t support every RFC 9421 component. Practical standards are messy.
If you’re tracking the broader security gap around fast-moving AI systems, the same pattern shows up in enterprise development: teams ship new automation faster than governance catches up, a problem covered in our analysis of why software development is outpacing security.
How verified agent credentials may work
The most credible direction is not a single universal ID card. It is a chain of signed assertions that can be checked quickly by the parties in a transaction. A shopping agent proves who operates it. A user mandate proves what the person asked for. A payment credential proves that funds can be charged under defined controls.
AP2 documentation in 2026 defines roles such as Shopping Agent, Merchant Payment Processor and Credential Provider. It also says signed payment receipts must be returned after mandate acceptance or rejection. That receipt requirement sounds dull, but it is exactly the kind of dull accounting evidence disputes depend on.
A KYA know your agent flow could look like this:
- The user authorizes an agent for a task, such as “buy the lowest refundable flight under $600 before Friday.”
- The agent receives or references a signed mandate that records price, time, merchant category and other limits.
- At checkout, the merchant or processor verifies the agent identity, the mandate signature and the payment credential.
- The payment network applies controls such as spending caps, authentication rules and fraud protections.
- The merchant returns a signed receipt showing whether the mandate was accepted or rejected.
Visa Intelligent Commerce describes this direction in 2026 as embedding payment credentials, controls, authentication and protections into AI-initiated transactions. Mastercard announced Agent Pay in April 2025 for AI-assisted commerce, naming Microsoft as a collaborator, and a 2026 Mastercard paper framed agent identity as the question of who is transacting while intent verification checks what the agent is allowed to do.
Payment credentials are only part of it. Agent identity also matters at the network edge, because merchants are already using bot controls to decide which automated visitors get through. Cloudflare documentation in July 2026 said new domains would have updated AI-bot defaults from September 15, 2026, with bots classified as Training or Agent blocked on ad-displaying pages and Search allowed. That is a blunt instrument, but you can see why publishers and merchants want it.
KYA know your agent vs AP2, ACP and card-network controls
The terminology is getting crowded. KYA know your agent is the broader verification concept; AP2 and ACP are payment or commerce protocols; Visa and Mastercard initiatives are network-level ways to carry credentials, controls and protections. They overlap, but they are not interchangeable.
| Initiative | Known public milestone | Main focus | What it verifies or constrains |
|---|---|---|---|
| Google Agent Payments Protocol (AP2) | Announced September 2025; donated to FIDO Alliance April 2026 | Agent-led payments | Signed mandates for user intent, transaction constraints and receipts |
| OpenAI and Stripe Agentic Commerce Protocol / Instant Checkout | Launched September 2025 | Buying inside ChatGPT | Shared Payment Tokens that let AI apps initiate payment without exposing buyer credentials |
| Visa Intelligent Commerce | Described publicly in 2026 | Network controls for agentic commerce | Payment credentials, authentication, controls and protections for AI-initiated transactions |
| Mastercard Agent Pay | Announced April 2025 | AI-assisted commerce payments | Agent identity and intent verification, according to Mastercard’s 2026 materials |
| Cloudflare Web Bot Auth | Promoted in 2025; documented in 2026 | Verified bot and agent traffic | Signed HTTP requests rather than IP allowlists or user-agent strings |
The useful mental model is layered. KYA tells you the agent is the right actor. A mandate tells you the permitted action. A payment token or credential lets the transaction happen without exposing the user’s card details. Network and merchant rules decide whether to approve, challenge or reject.
For developers, this is close to the identity and permission questions raised by tool-using agents and protocols such as MCP. If you need background on that side of the stack, read our guide to token minimization and AI infrastructure costs, because agent calls can become expensive and risky when every tool request carries too much context.
The pitfall: credentials don’t stop prompt injection
A verified agent can still do the wrong thing. That sentence should be printed on every agentic-commerce slide deck.
Two 2026 research signals underline the risk. An arXiv paper argued that agentic commerce protocols create attack surfaces not captured by existing security frameworks. Another 2026 arXiv red-team paper reported that prompt injection could subvert behavior in an AP2-based shopping agent despite cryptographically verifiable mandates.
Why? Because a signature can prove that an instruction existed and wasn’t tampered with. It cannot prove that the agent interpreted the web page safely, ignored malicious product descriptions or refused a cleverly phrased instruction embedded in merchant content. Verification is necessary. It isn’t sufficient.
The edge case nobody likes to discuss is a legitimate merchant with compromised content. A travel agent could visit a real hotel page, read injected text telling it to upgrade to a non-refundable package, and still present a valid payment mandate if the final price and category fit the allowed range. The merchant, processor and user all see valid cryptography. The semantic failure happened earlier.
Good KYA know your agent infrastructure therefore needs policy checks outside the model: spending caps, merchant allowlists, cooling-off periods for unusual purchases, receipt inspection, anomaly detection and human approval for high-risk categories. For enterprise teams already worrying about AI oversight, the governance angle sits close to concerns in AI surveillance and control systems, though the trade-off here is commercial safety rather than workplace monitoring.
Who is trying to own agent identity?
The KYA market is early and noisy. Several emerging sites in 2026 describe “Know Your Agent” as agent identity or verification infrastructure, but reliable third-party evidence of adoption, customer volume or standards status remains scarce.
KYA.ai says it is “the universal registry” that validates AI agents, assigns unique IDs and verifies authenticity before they act. KnowYourAgent.xyz says its KYA credential can be presented at checkout and checked in under 100 ms for operator identity, authorization, spending limit and transaction history. KYA Lab says agents that pass its process receive a “KYA Accredited Agent Credential” that enterprises can validate in real time before granting access.
Treat those claims carefully. They may point in the right direction, but self-description is not market adoption. The more verifiable center of gravity in 2026 is still around standards bodies, payment networks and infrastructure providers: FIDO Alliance for AP2 standardization, Stripe and OpenAI for ACP-based checkout, Visa and Mastercard for network-level controls, and Cloudflare for traffic verification.
Could a startup registry win anyway? Yes, if it becomes the neutral directory merchants actually query. But my view is that the winning layer will need to interoperate with card networks and web security infrastructure from day one. A registry nobody checks is just a database with good branding.
What merchants and builders should do now
Merchants don’t need to accept every AI shopper tomorrow. In fact, they shouldn’t. The sensible posture in 2026 is selective acceptance: allow verifiable agents with constrained mandates, block spoofed traffic, and keep humans in the loop for categories where disputes are expensive.
Start with your risk map. Low-value repeat purchases, subscriptions with clear cancellation rules and digital goods with strong fraud controls are easier candidates. Luxury goods, travel, financial products and regulated items need tighter review because a mistaken purchase is harder to reverse.
Builders of agent apps should avoid storing raw payment credentials. Stripe’s 2025 Shared Payment Tokens and Visa’s 2026 Intelligent Commerce language both point toward credential abstraction, where the agent can initiate an approved payment without seeing the buyer’s underlying card data. That architecture is better than handing an autonomous system a permanent secret and hoping prompt guardrails hold.
Documentation also matters. If your agent buys something, you need a record of the user’s instruction, the agent version, the merchant response, the payment authorization and the receipt. When a customer asks “why did it buy this,” a vague model trace won’t satisfy a bank, regulator or angry CFO.
Readers following AI assistants on phones should expect the same identity debate to arrive in consumer interfaces. The more a mobile assistant can act across apps, the more pressure there will be for verifiable delegation, a theme adjacent to our look at the 2026 mobile AI assistant race.
FAQ
Can AI agents make payments?
Yes, early systems already support AI-initiated checkout under constraints. In 2025, OpenAI and Stripe launched Instant Checkout in ChatGPT, and Google announced AP2 for agent-led payments using signed mandates.
What does KYA mean in AI?
KYA usually means Know Your Agent: verifying an AI agent’s identity, operator, authorization and limits before it acts. It is similar in spirit to KYC, but focused on software agents rather than human customers.
Is KYA know your agent a standard?
Not yet as a single settled standard. In 2026, AP2 was donated to the FIDO Alliance for standardization, while KYA-branded registries and credential providers were still emerging with limited independent adoption evidence.
Why can’t websites just block AI agents?
They can, and many do through bot controls. Blocking everything is crude, though; verified agent traffic could let merchants accept useful automated buyers while rejecting spoofed bots and unauthorized scraping.
Do signed mandates prevent agent fraud?
They reduce fraud by proving intent and limits, but they don’t solve every attack. Prompt injection, compromised web content and bad policy design can still push a verified agent toward a harmful action.
EN 
FR 
ES