Who’s Behind the Agent? Three Layers of Know Your Agent
Personal AI agents (Muse) are scraping existing websites and “impersonating” their human operators, which leads to a well-known equation: how to let the good guys (and their agents) in and keep the bad guys (and their agents) out as efficiently as possible.
Commonly categorized as Know Your Agent (KYA). This is a bit of a misnomer and we see three distinct layers and various signals to consider in any allow, block or challenge decision.
Which agent is calling?
The first layer identifies the agent itself, such as Muse from Meta or ChatGPT from OpenAI. There are two ways to do it.
Probabilistic. Infer the answer from request and session signals. For example, request headers and properties or how the client behaves. This needs nothing from the agent, which makes it easy to scale and useful for triaging but is still an estimate.
Deterministic. Each agent declares keys that it will use to sign its requests. This gives you a verifiable signal that a request really came from a known agent. DataDome reports, and our detection suite has also verified, that Muse is already following this approach and signing its request headers with Meta hosted keys.
Who is the person behind it?
The second layer is the legal human: a real person, possessing a digital ID issued by a trusted identity authority. This layer answers whether a real, verified person exists behind the agent. It does not yet say what that person authorized the agent to do.
What did that person approve?
The third layer ties everything together at the transaction level. The person uses their digital ID to sign a mandate that records exactly what they authorized the agent to do. This can include specific relying parties, payment methods, spend limits, expirations, amongst other properties, and is also bound to that specific agent.
The relying party can verify the agent, the human and the authorization on its own. If anything is manipulated in transit the mandate no longer validates.
What does a complete answer look like?
A complete answer holds all three layers at once, each one tied to the one before it, so that any party in the transaction can verify the whole chain independently. The verification chain runs as follows:
Issuing authority > digital ID > mandate > agent > signed headers
The relying party verifies the request came from a trusted agent, a real (and the right) human authorized that agent to carry out this transaction and that human was verified by a trusted issuing authority. When any transaction is disputed months later, a dispute team has complete non-repudiable evidence of the authorization chain.
What this unlocks
With these layers in place, any relying party (bank, insurance carrier, merchant et al) has a much richer set of signals and challenges it can orchestrate as part of executing a given transaction. Perhaps any transaction <$1,000 from Muse is accepted but unknown agents are challenged on every transaction to prove authorization from a human, giving power back to the relying party to be able to best tune their risk engines as agentic transactions continue to scale.
.jpg)
