Orbit: Agent identity and verification
Know Your Agent (KYA) cluster
Know Your Agent names efforts to tie an AI agent to a verified person or organization before it pays; this cluster covers Skyfire KYAPay, Mastercard's agent registration and the GLEIF vLEI agent mandate proposal.
- Steward
- Several stewards; Skyfire Systems (KYAPay), Mastercard (Agent Pay registration), GLEIF (vLEI and the agent mandate working paper)
- Status
- Mixed; KYAPay individual IETF draft, Mastercard registration live in Agent Pay, GLEIF proposal at discussion stage
- Latest version
- draft-skyfire-oauth-kyapay-token-02 ()
- Primary source
- skyfire-xyz/kyapay: The KYAPay protocol (kyapay.org) (external link)
What it is
Know Your Customer checks a person; tries to answer who stands behind an AI and what it may do before a merchant or network its payment. No single KYA standard exists. Three efforts carry the label in different ways, and lists KYA only as possible future work for its card framework. Source [1]
Skyfire KYAPay
KYAPay is an open protocol in which an carries signed JWTs: a kya token for the agent and its human principal, a pay token for a payment commitment, or a combined kya-pay token, with the typ values kya+jwt, pay+jwt and kya-pay+jwt. Source [2, 3] The skyfire-xyz/kyapay repository, created 2025-06-25 under the Community Specification License, says a full v1.0 specification is still to come and has no releases. Source [2] The text is also an individual IETF draft. It started as draft-skyfire-kyapayprofile on 2026-03-02, was renamed, and its current revision is draft-skyfire-oauth-kyapay-token-02 of 2026-10-02, with authors from Skyfire and Self-Issued Consulting and no working group adoption. Source [3, 4] Identity claims include hid, apd and aid; payment claims include amt, cur and a settlement type stp of coin or card. For cards, the settlement information names visa_vic or mastercard_scof, and PANs and static security codes are prohibited. Source [3]
Mastercard
Mastercard’s developer guidance for Agent Pay says only registered agents can transact: each one passes a security review before certification, certified agents go on kept by the networks, and merchants check signatures against a registry of agent identities. Mastercard publishes no separate specification. Source [5] On 2026-09-30 Mastercard described an (identity, intent, controls, execution and intelligence) and named Skyfire as a KYA provider extended into Agent Pay. Skyfire had already appeared among participants on 2026-06-10. Source [6, 7] Trade press reported on 2026-09-11 that Ant International, Mastercard and Visa would work on KYA interoperability in a program convened by the Monetary Authority of Singapore (reported). Source [8, 9]
GLEIF vLEI agent mandates
The vLEI is GLEIF’s verifiable form of the Legal Entity Identifier, standardized as ISO 17442-3 in 2024. Source [10] GLEIF’s working paper “Agentic AI in Payments: Establishing Interoperable Trust and Control” (cover dated September 2026, announced on the GLEIF blog on 2026-09-01) proposes Credentials anchored in the vLEI. In the paper’s example, an officer with an organizational role issues a mandate credential to a payment agent, built on KERI and ACDC credentials, and a runtime policy engine enforces limits and counterparty rules. Source [11, 12] GLEIF positions this as an organizational trust layer above agent identity. The paper discusses x402, AP2, and Agent Pay, and sketches a pilot that pairs vLEI-checked discovery with an x402-compatible micropayment. No credential schema has been published. Source [11]
Status history
- 2025-06-25: Skyfire’s
kyapayrepository created. Source [2] - 2026-03-02: first KYAPay IETF draft,
draft-skyfire-kyapayprofile-00. Source [4] - 2026-06-10: Skyfire listed among participants. Source [7]
- 2026-09-01: GLEIF announces its agentic payments working paper. Source [12]
- 2026-09-30: Mastercard names Skyfire as a provider for Pay. Source [6]
- 2026-10-02:
draft-skyfire-oauth-kyapay-token-02posted. Source [3]
Relations at a glance
| Protocol | Relation | Note |
|---|---|---|
| Mastercard Agent Pay | Complements | Agent Pay requires registered, reviewed and certified agents; Mastercard named Skyfire as a KYA provider extended into Agent Pay on 2026-09-30, and KYAPay defines a mastercard_scof card settlement type. |
| x402 | Complements | The GLEIF working paper sketches a pilot that pairs vLEI-checked API discovery with an x402-compatible micropayment; a concept only. |
| AP2 | Complements | The GLEIF working paper discusses AP2 and says the relationship with its agent mandate credentials should be explored; no integration exists. |
Sources
- EMVCo Requests Feedback on Framework for Secure, Interoperable and Scalable Card-Based Agentic Payments (external link)
- skyfire-xyz/kyapay: The KYAPay protocol (kyapay.org) (external link)
- KYAPay Token (draft-skyfire-oauth-kyapay-token-02) (external link)
- KYAPay Profile (draft-skyfire-kyapayprofile) (external link)
- The Rails for Agentic Commerce (external link)
- Mastercard Advances Agentic Commerce With New Trust and Intelligence Services (external link)
- Mastercard Launches Agent Pay for Machines to Unlock Super-Fast, Always-On Payments (external link)
- Ant International, Mastercard and Visa initiate collaboration on Know Your Agent interoperability to scale agentic commerce (external link)
- Visa and Mastercard team with Ant on Know Your Agent framework (external link)
- The verifiable LEI (vLEI) (external link)
- Agentic AI in Payments: Establishing Interoperable Trust and Control (external link)
- When AI agents transact, who stands behind them? Why verifiable organizational identity is critical to agentic payments (external link)
- skyfire-xyz GitHub organization (KYAPay drafts and A2A extension) (external link)