Shufti Pro Launches Know Your Agent (KYA) to Secure AI-Driven Commerce
Shufti Pro introduces Know Your Agent (KYA), a new solution designed to verify the authenticity and permissions of autonomous AI agents operating in agentic commerce.
Shufti Pro has launched Know Your Agent (KYA), a novel solution aimed at verifying autonomous AI agents that are increasingly acting on behalf of individuals and businesses in the burgeoning field of agentic commerce. As AI agents gain the capability to perform actions such as opening accounts, placing orders, and transferring funds, businesses face a critical need to confirm the legitimacy of these requests. KYA addresses this by ensuring that an AI agent is genuine, that a verified human owner has authorized its actions, and that these actions fall within the scope of pre-approved permissions.
The core challenge KYA tackles is the inherent risk of impersonation and fraud in agentic transactions. A simple access token is insufficient to guarantee authenticity, as stolen credentials can appear legitimate, and malicious actors can create fake agents to pose as trusted entities. Shufti KYA integrates a comprehensive verification flow that confirms the AI agent's identity, validates that a real person has granted authorization, and scrutinizes the agent's permissions before any sensitive data is accessed or transactions are initiated. This multi-layered approach is designed to prevent AI agent fraud and mitigate potential chargeback disputes.
Shufti KYA employs a combination of agent recognition, trust scoring, spoof-resistant identity verification, and granular permission checks. Each AI agent is issued a unique, time-bound credential that can be revoked if necessary. The system can recognize known agents by name and assesses new or unfamiliar agents using behavioral biometrics. Crucially, every agent is assigned a trust score, providing businesses with a clear risk assessment to inform their decision-making. Shufti has already demonstrated support for prominent agents like Meta Muse, GrokBot, and OpenAI Dots.
At the heart of KYA is the linkage of each AI agent to an individual or business that has undergone Shufti's robust Know Your Customer (KYC) or Know Your Business (KYB) verification processes. This ensures that the AI agent's actions are ultimately traceable to a verified principal. The system extends existing KYC/KYB checks to AI agents, rather than replacing them, creating a secure framework for automated operations. An AI agent's authorization begins with a principal establishing a mandate that defines permitted actions, transaction limits, expiry dates, and revocation protocols.
Businesses can customize the rules within Shufti KYA to align with their specific risk appetites and operational needs. For instance, a bank might permit AI agents to view balances and pay pre-approved bills, while requiring additional verification for new payees. Similarly, a digital assets platform could allow agents to trade within set limits but restrict withdrawals. An iGaming operator might enable agents to monitor account activity and communicate bet settlement status, but mandate that all bets originate from the verified player. These configurable policies ensure that AI agent automation is implemented securely and responsibly across diverse industries.
To further enhance security for high-risk operations, Shufti KYA incorporates a risk-based authorization mechanism. When an AI agent attempts an action that falls outside its mandate or exceeds a predefined high-risk threshold, the system can trigger a human-in-the-loop control. This involves a liveness check where the authorizing individual completes a brief selfie verification, which is iBeta Level 3 certified for resistance to presentation attacks. This feature adds a critical layer of human oversight for potentially risky AI agent activities.
Shufti KYA also maintains a comprehensive audit trail, meticulously recording all requests, decisions, and revocations associated with each agent and its principal. This ensures that every action is traceable, facilitating accountability and post-incident review. "Businesses are already allowing AI agents to act for their customers, and the question of who stands behind each action cannot wait for an answer later," stated Faryam Asif, Chief Technology Officer at Shufti. "Shufti Know Your Agent verifies every AI agent request with a verified owner, a clear mandate, and a record that holds up under review."
Beyond bolstering security, Shufti KYA is positioned to support revenue growth by enabling businesses to confidently accept authorized AI agents and facilitate agent-driven transactions. By effectively blocking rogue agents and mitigating risks associated with fraud and unauthorized activity, businesses can embrace AI agent automation with the assurance of maintaining clear human control over AI-driven actions and permissions.