Shufti Know Your Agent: How KYA Verifies AI Agents

AI agents are starting to open accounts, place orders and move money on behalf of real people. That raises a question every bank and online store now has to answer: when an agent shows up at the door, who is actually behind it, and did they really approve this? On October 28, 2026, identity verification company Shufti launched Know Your Agent (KYA), a service designed to answer exactly that.

• What it checks: the AI agent's identity, that a real person authorized the action, and whether the action fits the agent's permissions
• Human-in-the-loop: out-of-mandate or high-risk requests trigger a selfie liveness check by the authorizing person
• Credentials: each agent gets a unique, time-bound, revocable credential and a trust score
• Audit trail: every request, decision and revocation is logged against the agent and its owner

Why Do AI Agents Need Identity Verification?

Here is the core problem, stated simply. A valid access token tells a business that *something* has permission. It does not tell them whether the agent is genuine, who is accountable for it, or whether this specific action is one the owner signed off on. Stolen credentials look legitimate, and a fake agent can impersonate a trusted one. Shufti's announcement frames KYA as closing that gap before an agent can touch data or trigger a transaction.

That is the same thinking behind know-your-customer checks in banking, extended to software that acts for customers. It also complements detection-side work like Cisco's open Project Quarry rules for spotting rogue AI agents: one approach watches behavior, the other verifies identity and authority up front.

How Does Shufti KYA Work?

According to Shufti, the flow has three layers:

• Recognize the agent. Known agents are identified by name; Shufti says it already supports agents such as Meta Muse, GrokBot and OpenAI Dots. Unfamiliar agents are assessed with behavioral biometrics, and every agent gets a trust score
• Link it to a verified human or business. Each agent ties back to a principal verified through Shufti's existing KYC or KYB checks. KYA extends those checks; it does not replace them
• Enforce a mandate. The principal sets what the agent may do, with limits, expiry and revocation, and that mandate is enforced as policy on every request

When an agent tries something outside its mandate or above a risk threshold, KYA brings the human back in with a quick selfie liveness check. Shufti says its single-selfie liveness test is iBeta Level 3 certified for resistance to presentation attacks.

What Could KYA Look Like in Practice?

Shufti gives concrete examples. A bank might let an agent view balances and pay approved billers but require an extra check for new payees. A digital asset platform might allow trades within a limit while blocking withdrawals entirely. A marketplace could let agents buy within a customer-set budget. Each business writes its own rules.

That is the right shape for agentic commerce security: least privilege by default, a human confirmation step for anything unusual, and a complete audit trail when someone asks what happened. Expect "know your agent" to become as routine as two-factor login. More defensive tooling is in our AI security coverage.

Sources: Help Net Security: Shufti ties AI agent actions to verified owners and permissions — October 30, 2026; Shufti press release: Shufti Launches Know Your Agent — October 28, 2026.