KYA Platform Documentation

Why Choose KYA Platform?

S

Self-Instantiation

Rules for sub-agent spawning.

{
  allowed: true,
  maxSubAgents: 3,
  maxDepth: 2,
  inheritPermissions: true,
  requireApproval: true
}

Counterparty-Side: Verifying Incoming Agents

Mount Express middleware to verify agents hitting your API. The middleware calls AstraSync's verify-access endpoint and populates req.agentVerification with the result.

import { createMiddleware } from '@astrasyncai/verification-gateway/express';

app.use(createMiddleware({
  apiBaseUrl: 'https://astrasync.ai',
  routes: [
    { pattern: '/api/public/*', method: '*', minAccessLevel: 'none' },
    { pattern: '/api/data/*', method: 'GET', minAccessLevel: 'read-only' },
    { pattern: '/api/data/*', method: '*', minAccessLevel: 'standard' },
    { pattern: '/api/admin/*', method: '*', minAccessLevel: 'internal' },
  ],
}));

After middleware runs, req.agentVerification contains:

• →.verified — whether the agent passed verification
• →.accessLevel — none, guidance, read-only, standard, full, internal
• →.agent — ASTRA ID, name, trust score
• →.pdlss — full permission boundaries
• →.tokenGuidance — recommended scopes, TTL, rate limits
• →.recommendation — grant, deny, or step_up_required

Enhanced Verification with Sessions

import { verify } from '@astrasyncai/verification-gateway';

const result = await verify(config, {
  credentials: { astraId: 'ASTRA-xxxxx' },
  purpose: 'financial_transaction',
  createSession: true,
  enableRuntimeChallenge: true,
});
// result.sessionId, result.runtimeChallenge, result.tokenGuidance

Recording a Decision

import { recordDecision } from '@astrasyncai/verification-gateway';

await recordDecision(config, {
  sessionId: result.sessionId,
  decision: 'granted',
  reason: 'Agent meets all requirements',
  tokenIssued: true,
});

Agent-Side: Presenting Credentials

Use AgentClient to automatically inject AstraSync credentials into outgoing requests across all supported protocols.

import { AgentClient } from '@astrasyncai/verification-gateway';

const client = new AgentClient({
  agentId: 'ASTRA-xxxxx',
  challengeUrl: 'https://my-agent.com/astrasync/challenge',
  pdlss: {
    purpose: { category: 'read_data' },
    duration: { maxSessionDuration: 3600 },
    scope: { jurisdiction: 'US' },
  },
});

// HTTP — headers auto-injected
const response = await client.fetch('https://counterparty.com/api/data');

// A2A — metadata.astrasync block auto-added
const task = client.prepareA2AMetadata({ id: 'task-1' });

// MCP — _meta.astrasync block auto-added
const params = client.prepareMcpMeta({ tool: 'search', query: '...' });

X-Astra-* Headers (HTTP Transport)

Step 1: Create Your Policy

All Local Guard adapters share the same PDLSS policy file. Create it once, then choose which adapter to run for your platform.

npm install @astrasyncai/verification-gateway

# Interactive wizard — creates local-policy.yaml
npx astrasync guard setup

The wizard asks plain-language questions about what your agent should be allowed to do and generates a local-policy.yaml file using the same PDLSS schema as the cloud — so upgrading later requires zero migration.