Shufti ties AI agent actions to verified owners and permissions

Shufti has launched Know Your Agent (KYA), a solution designed to address the security risks associated with autonomous AI agents performing actions for individuals and businesses, such as opening accounts or moving funds in agentic commerce environments. The primary challenge identified is that traditional verification methods, like access tokens, are insufficient against threats like credential theft or impersonation, which could lead to fraud or chargeback disputes. KYA tackles this by creating a unified flow: verifying the AI agent's identity, confirming human authorization for specific actions, and checking the agent’s defined permissions before execution.
The system integrates existing KYC/KYB processes with new agent-specific controls. Each agent receives a unique, time-bound credential and is linked to a principal (individual or business) establishing a strict mandate covering permitted activities, limits, and revocation rules. Businesses can customize these mandates based on their operational risk—a bank might limit viewing balances while an iGaming operator restricts bets. Furthermore, Shufti KYA incorporates a human-in-the-loop control for high-risk requests that fall outside established mandates, utilizing a liveness check certified to iBeta Level 3 to maintain accountability over AI actions.

Shufti launched Know Your Agent (KYA), an AI agent verification solution.
The solution verifies autonomous AI agents acting on behalf of individuals and businesses.
Agentic commerce allows AI agents to open accounts, place orders, and move funds for owners.
KYA combines agent recognition, trust scoring, spoof-resistant identity verification, and permission checks.
Each AI agent receives a unique time-bound credential that is revocable.
Known agents are recognized by name; new agents are assessed via behavioural biometrics.
Every agent is linked to an individual or business verified through Shufti’s modular KYC or KYB process.
A principal sets a mandate for each AI agent, covering permitted actions, limits, expiry, and revocation.
Shufti KYA enforces policies on every request and maintains an audit trail of all requests and decisions.
High-risk actions trigger human-in-the-loop control requiring a liveness check certified to iBeta Level 3.
The system currently supports agents such as Meta Muse, GrokBot, and OpenAI Dots within one week of their launch.

This introduction of automated verification protocols marks a critical inflection point in the shift toward agentic commerce; the focus is not merely on authenticating *users*, but architecting demonstrable accountability across an increasingly decentralized layer of automation. The narrative successfully frames risk mitigation—fraud, impersonation, dispute resolution—as the indispensable gateway to economic adoption of AI agents. By framing KYA as extending existing KYC/KYB checks rather than replacing them, Shufti attempts to situate its offering within a known regulatory comfort zone while addressing novel digital vectors of risk.
The core assumption underpinning this architecture is that human intent can be adequately codified into an enforceable "mandate" and monitored via policy enforcement points at runtime. The dual layer of oversight—systemic mandate checks followed by the L3 certified liveness check for threshold breaches—attempts to map the nebulous concept of 'human control' onto measurable, auditable technical gates. This creates a powerful commercial proposition: trust as an engineered feature.
One must question the scope and durability of any "mandate." How robust is policy enforcement against emergent behavior in advanced LLMs that may not be explicitly covered by current rules? Furthermore, the shift toward relying on behavioural biometrics for unverified agents introduces reliance on proprietary biometric data sets and risk models—models whose internal logic remains opaque. This architecture successfully shifts liability management from post-hoc forensic investigation to pre-transactional gatekeeping.
If agentic commerce becomes standard, the beneficiaries are those who can afford compliance infrastructure like KYA; costs will inevitably be borne by businesses that wish to participate in high-trust, automated markets while maintaining clear demarcation between AI function and human fiduciary responsibility. What level of risk is deemed "high enough" to necessitate a selfie verification, and how might this threshold itself become weaponized or circumvented?
Patterns detected: none
Autonomy check: No autonomy signals documented.