DN Agentic Finance Trust Index

Know Your Agent (KYA) Index 2027

AI agents are beginning to spend money, call tools, negotiate contracts and transact with other autonomous systems. The next infrastructure problem is proving which agent is acting, who authorized it, what authority it actually has and whether another machine should trust it.

Why KYA Suddenly Matters

The internet was designed around human and organizational accounts.

A person logs in.

A company receives an API key.

A service account has credentials.

An AI agent changes the structure.

The agent may be:

• created dynamically;
• delegated by another agent;
• operating for a human;
• operating for a company;
• using several tools;
• holding a wallet;
• talking to unknown counterparties;
• making thousands of decisions while its principal is offline.

That creates a new identity problem.

The counterparty may need to identify not only the software process, but the authority chain behind it.

The DN Agent Authority Chain

Decentralised News proposes a seven-link model for consequential autonomous actions.

The First Rule of KYA: Identity Is Not Authorization

Suppose an exchange receives a request from a cryptographically authenticated agent.

The exchange knows exactly which agent sent it.

That does not answer:

• Who owns the agent?
• Who instructed it?
• Was the agent authorized to trade this asset?
• Was it authorized to spend this amount?
• Was leverage permitted?
• Had its mandate expired?
• Was another approval required?

This is the same distinction that matters in conventional security:

authentication proves identity.

authorization determines permission.

Agents make that distinction economically critical because they can initiate financial actions autonomously and at machine speed.

The DN KYA Component Readiness Index

The technologies below are complementary. The score evaluates how ready each component is for the function it claims to perform, not whether one can replace another.

Scores are DN editorial readiness scores for the stated function, based on specification maturity, agent specificity, interoperability, cryptographic integrity, policy coverage, auditability and documented deployment. The technologies are not direct substitutes.

1. OpenID AuthZEN: The Strongest Deterministic Authorization Primitive

2. A2A Signed Agent Cards: The Machine Business Card

3. ERC-8004: The Most Interesting Open Reputation Layer

DN Reputation Purity

A future agent marketplace may display:

4.98 / 5 rating from 23,491 agent interactions.

That number can be almost meaningless if:

• the same operator controls the reviewers;
• reviewers were created yesterday;
• transactions were economically circular;
• reviewers paid almost nothing;
• feedback was incentivized;
• identities can be recreated cheaply after failure.

Ten independent counterparties risking real economic value may be more informative than 100,000 cheap anonymous ratings.

4. Mastercard Verifiable Intent and AP2: Identity Is Not Enough

5. Visa Trusted Agent Protocol: Separate Good Agents From Bad Bots

6. The New Visa, Mastercard and Ant International KYA Framework

7. AIP and AgentID: The Internet-Draft Layer

Several 2026 Internet-Drafts are explicitly trying to bind agent identity, delegation and actions together.

One Agent Identity Protocol proposal defines:

• a unique identity for each agent;
• a key pair;
• registration;
• signed outbound actions;
• policy enforcement.

Another AIP proposal defines Invocation-Bound Capability Tokens intended to carry:

• identity;
• authorization;
• scope constraints;
• delegation provenance.

A separate AgentID draft similarly proposes signed tokens containing agent identity, owner verification, capabilities and delegation-chain claims.

These ideas are strategically important because they address a problem that ordinary OAuth often does not fully solve:

multi-hop delegation.

Imagine:

Human → Portfolio Agent → Execution Agent → Exchange Tool

The exchange should ideally be able to determine not merely that the Execution Agent has a valid credential, but how that authority was derived.

However, Internet-Drafts are works in progress and should not be treated as adopted IETF standards.

The Multi-Hop Delegation Problem

Agent systems increasingly delegate work to other agents.

This creates chains such as:

CFO → Treasury Agent → FX Agent → Stablecoin Router → Exchange API

If every hop simply receives the original CFO's full authority, least privilege fails.

A safer chain should attenuate authority.

For example:

• CFO grants treasury agent $1 million daily cash-management authority;
• treasury agent delegates $200,000 FX authority;
• FX agent delegates a $50,000 execution instruction;
• router receives authority for one trade;
• exchange sees only the permissions necessary for that action.

Authority should generally get narrower as it moves away from the principal.

The DN Agent Trust Gap

The most dangerous system can be one where identity confidence is high but authority confidence is low.

Imagine a bank can prove with 100% cryptographic certainty that:

Agent X sent the payment request.

But nobody can establish:

who authorized Agent X to make that particular payment.

The identity is strong.

The action legitimacy is weak.

KYA Is Not KYC for Robots

The phrase Know Your Agent naturally invites comparison with Know Your Customer.

There is overlap, especially where agents initiate regulated financial activity.

But the two problems are different.

A regulated transaction may therefore require both.

The financial institution may need to know:

who the customer is

and:

which agent is acting for that customer under which authority.

An Agent Wallet Address Is Not an Identity

A blockchain address is useful.

It proves control of a signing key.

It does not automatically tell a counterparty:

• which software system controls it;
• who deployed the software;
• which person or entity owns it;
• what the agent is permitted to do;
• whether the wallet is compromised;
• whether the agent's capabilities are genuine.

This distinction becomes important as agents accumulate economic histories.

A wallet can be part of agent identity.

It should not be confused with the entire identity.

The Wallet Policy Is Part of KYA

The previous DN Agentic Wallet Security Index introduced Agent Blast Radius.

KYA adds another dimension.

A counterparty may want to know not only:

“Is this a legitimate agent?”

but:

“What constraints does this agent operate under?”

An agent with:

• $500 transaction cap;
• $2,000 daily limit;
• approved merchant list;
• eight-hour session expiry;
• human approval above threshold;

presents a different risk profile from an agent holding the same identity but possessing unlimited signing authority.

Reputation Could Become Machine Credit

Agent reputation becomes economically interesting when counterparties begin pricing transactions according to history.

A seller agent with:

• 10,000 validated deliveries;
• low dispute frequency;
• high uptime;
• independent validators;
• long-lived identity;

may be able to:

• charge more;
• receive larger mandates;
• require less collateral;
• win more RFQs;
• obtain credit.

At that point reputation stops being merely a review system.

It becomes a form of machine economic capital.

The Reputation Reset Attack

Consider an agent that accumulates poor feedback.

A human company may struggle to erase its corporate history.

A software operator may simply:

1. retire Agent-104;
2. create Agent-105;
3. transfer functionality;
4. begin with a clean reputation record.

That creates the reputation reset problem.

High-value markets may eventually need stronger links between:

• agent identity;
• operator identity;
• economic stake;
• organizational credentials;
• historical continuity.

Why NIST Is Treating Agent Identity as Infrastructure

NIST's 2026 work is significant because it frames agent identity as a broad cybersecurity problem rather than a crypto-specific problem.

The National Cybersecurity Center of Excellence is examining:

• agent identification;
• authorization;
• auditing;
• non-repudiation;
• controls around prompt injection;
• standards-based approaches to agent access.

NIST has separately warned that early agent deployments are repeating a familiar technology pattern:

features first, security later.

That is particularly dangerous when agents can:

• deploy code;
• send emails;
• modify systems;
• purchase products;
• move money.

Model Guardrails Are Not Identity Controls

A robust system separates:

• model reasoning;
• agent identity;
• principal identity;
• delegated authorization;
• policy enforcement;
• transaction signing;
• evidence.

The model may propose an action.

The security system decides whether that action is admissible.

The Ideal KYA Stack for Agentic Finance

The DN Minimum KYA Profile

Machine-readable trust data could eventually become as important as website metadata.

DN proposes that any consequential financial agent should be able to expose or provide, directly or through trusted infrastructure, a profile containing at least:

{
  "agent_id": "persistent-agent-identifier",
  "agent_provider": "responsible-provider",
  "principal_type": "individual | company | dao | institution",
  "principal_binding": "verified-reference",
  "capabilities": [
    "market-data",
    "trade",
    "payment"
  ],
  "delegation": {
    "scope": [
      "BTC-USDC",
      "trade-only"
    ],
    "max_transaction_usd": 5000,
    "max_daily_usd": 20000,
    "expires_at": "ISO-8601 timestamp"
  },
  "policy_enforcement": "external-policy-system",
  "revocation_endpoint": "verified-reference",
  "reputation": {
    "source": "portable-reputation-layer",
    "independent_counterparties": true
  },
  "validation": [
    "optional-attestation-reference"
  ],
  "audit_evidence": "signed-action-log-reference"
}

This is a DN editorial reference model, not an official industry standard and not a recommendation to expose private or sensitive identity information publicly. Production systems should use privacy-preserving identifiers and disclose only what the relying party legitimately requires.

Privacy Is the Other Half of KYA

The obvious response to an identity problem is to collect more identity data.

That can create another problem.

A global machine economy should not require every agent to broadcast:

• its owner's legal identity;
• complete wallet holdings;
• private strategy;
• full negotiating limits;
• internal system architecture.

The correct model is likely to be selective proof.

A counterparty may need to know:

“This agent is operated by a verified institution authorized to transact up to this amount.”

It may not need to know every private detail about that institution.

Agent identity will therefore intersect with:

• verifiable credentials;
• selective disclosure;
• zero-knowledge proofs;
• privacy-preserving attestations.

The Rise of Machine Counterparty Risk

Once agents transact directly, counterparties need a machine equivalent of counterparty due diligence.

Before accepting a trade, a receiving agent may evaluate:

• identity age;
• operator quality;
• reputation;
• transaction history;
• validation history;
• economic stake;
• mandate strength;
• payment reliability;
• dispute history;
• software attestation;
• jurisdiction or institutional credentials.

These signals can become inputs into automated pricing.

A highly trusted agent might receive:

• better credit terms;
• lower collateral requirements;
• larger transaction limits;
• lower risk premiums;
• faster settlement.

Trust Scores Can Become Dangerous Too

Compressing agent trust into one number is convenient.

It is also risky.

A 96/100 trust score can hide:

• excellent payment history but weak cybersecurity;
• strong identity but no principal mandate;
• great reputation for API tasks but no history trading leveraged assets;
• thousands of reviews generated by related identities.

DN therefore favors dimensional trust over one universal score.

Know Your Agent for Trading

A financial exchange receiving an autonomous order may eventually need more than an API key.

The ideal request could convey:

• authenticated account;
• authenticated agent identity;
• trade-only authority;
• permitted products;
• maximum order size;
• maximum leverage;
• mandate expiry;
• risk-policy result;
• client order ID;
• action signature.

This would let exchanges distinguish:

“the customer logged in”

from:

“Agent 47 was specifically permitted to make this trade under this policy.”

Know Your Agent for Payments

A payment agent may need a different KYA profile.

Relevant attributes include:

• merchant restrictions;
• currency;
• transaction maximum;
• session maximum;
• credential issuer;
• purchase mandate;
• expiration;
• human step-up rules.

This is why Visa, Mastercard, AP2 and other payment frameworks focus heavily on intent and delegated credentials rather than generalized agent reputation alone.

Know Your Agent for Open Agent Markets

An agent buying compute from an unknown autonomous seller faces another problem.

There may be no bank, card network or enterprise IAM provider mediating trust.

That is where:

• portable identity;
• A2A discovery;
• onchain reputation;
• validation;
• payment receipts;

become more important.

Open markets need trust infrastructure precisely because they lack pre-existing organizational relationships.

India Is Already Exploring an Agent Registry for Payments

The trend is not confined to card networks or crypto.

India's payments ecosystem is reportedly developing an agent registry as part of work around agentic UPI payments.

The proposed direction includes:

• approved-agent registration;
• identity checks;
• spending controls;
• liability frameworks;
• monitoring.

The significance is structural.

Major payment systems are beginning to treat AI agents as actors that need their own recognition and control plane.

DN KYA Methodology

What Would Prove the KYA Thesis Wrong?

The market may consolidate around a few large agent platforms.

If nearly all consequential agents operate inside Google, Microsoft, OpenAI, Amazon, Visa, Mastercard or large financial institutions, identity could remain primarily platform-local.

Existing OAuth, service-account and enterprise IAM systems might prove sufficient for most use cases.

Open reputation may also fail to become important if agent marketplaces remain closed.

And many high-value actions may continue requiring direct human approval.

But the more agents cross organizational boundaries, subcontract to other agents and move economic value independently, the harder it becomes to rely entirely on local accounts and implied trust.

The Biggest Missing Standard: Reliance

Identity systems can prove facts.

Authorization systems can return decisions.

Reputation systems can publish history.

But high-value finance eventually asks another question:

Who is willing to rely on this evidence and accept liability when it fails?

That is where technical standards intersect with:

• contracts;
• insurance;
• regulation;
• payment rules;
• institutional risk management.

A cryptographically perfect identity does not by itself determine who reimburses a customer after an unauthorized $100,000 agent transaction.

The trust stack therefore ends not in cryptography, but in economic accountability.

Frequently Asked Questions

Primary Sources

• Reuters: Visa, Mastercard and Ant International Know-Your-Agent Initiative
• NIST NCCoE: Software and AI Agent Identity and Authorization
• NIST: Why Agentic AI Needs a Strong Identity Foundation
• OpenID Authorization API 1.0 Final Specification
• OpenID AuthZEN: Authorization in the Agent Era
• A2A Protocol 1.0 Specification
• ERC-8004: Trustless Agents
• Ethereum.org: AI Agents and ERC-8004
• Mastercard Verifiable Intent
• Visa Intelligent Commerce and Trusted Agent Protocol
• IETF Internet-Draft: Agent Identity Protocol and Policy Enforcement
• IETF Internet-Draft: Verifiable Delegation for AI Agent Systems
• Reuters: India's Proposed AI-Agent Registry for Agentic Payments