What is Know Your Agent (KYA)?
Know Your Agent (KYA) is the practice of verifying the identity, provenance, and permissions of an AI agent before letting it act. It answers three questions that every API, merchant, and platform now faces when an autonomous agent shows up: who built this agent, who does it act for, and what is it allowed to do?
If you know KYC (Know Your Customer) from banking, the analogy is direct. Banks verify humans before moving their money. KYA verifies software agents before they access systems, spend funds, or make commitments on a human's behalf.
Why agents need their own identity
An AI agent is not a user and not a traditional application. It acts with delegated authority: a human or business asked it to do something, and it carries that intent to systems the human may never touch directly. That breaks the assumptions behind existing credentials:
- A password or session proves a human logged in once, not that the software now acting is under their control.
- An API key identifies an account, not the specific agent using it, its model, or its operator (more in AI agent identity vs API keys, linked below).
- A user agent string can claim anything. Claims are not verification.
Meanwhile agent traffic is real and growing. AstraSync's own network data shows tens of thousands of identified agent visits per month against a tiny fraction that can prove who they are. The gap between "an agent arrived" and "an agent we can trust arrived" is the KYA gap.
How KYA works on AstraSync
- Register once. The agent (or its developer) registers with AstraSync, declaring its name, model, provider, framework, and owner. Registration issues a permanent ASTRA-ID.
- Carry a permission boundary. Each identity includes a PDLSS permission boundary describing what the agent may do, so counterparties can check scope, not just identity.
- Present and verify. The agent presents its ASTRA-ID on each interaction. The counterparty calls one endpoint,
POST /api/agents/verify-access, and gets back the agent's status, trust signals, and whether this action is inside its boundary. - Answer runtime challenges. For higher-assurance interactions, AstraSync can issue a runtime challenge the agent must answer, proving the identity is live rather than replayed.
Registration takes one API call, or zero if the agent runs inside an MCP host: the AstraSync MCP connector exposes register_agent and verify_agent as native tools. The full contract is in the Agent Access Guide.
Who KYA is for
- Developers give their agents a portable, verifiable identity that works across every AstraSync-integrated counterparty instead of a pile of per-service keys.
- Merchants and API operators gate inbound agent traffic with one verification call instead of guessing from headers. Start with the merchant guide.
- Platforms and enterprises get an auditable answer to "which agents acted, for whom, and under what authority" across their fleet.
KYA and agent commerce
The highest-stakes case is an agent spending money. There, KYA becomes the first step of a larger pattern: verify the agent, check its spend authority, then transact, with step-up approval to the human owner when a purchase exceeds the agent's autonomous limit. We cover that pattern in Verify before transact.
Start now
Agents register in minutes via the Agent Access Guide or the AstraSync MCP connector. Merchants can gate traffic the same day with verify-access. Identity is the layer the agent economy settles on; KYA is how it gets built.