KYA proves the enrollment. Not the moment.
Know Your Agent ties an agent to the person who enrolled it. 5arz adds a signed credential that a real, live person was present for this session.
- Signed per session
- Checked offline
- Free to start
AI-generated imageConsent given once is not the same fact as a person being there now.
Accounts get resold, shared or handed to a script. Only a fresh check at the moment of the event can show that.
Two measurements, two different facts.
Not a competitor comparison. Most serious flows will want both.
| Compared on | KYA — Know Your Agent | Human attestation — 5arz |
|---|---|---|
| Fact established | This agent is enrolled to this account holder, within set limits | A real, ID-verified, live human was present for this session |
| Established when | At enrollment, then carried forward | At the moment of the verified session |
| If the account is shared or resold | The enrollment travels with it | A fresh credential per session |
| Who can check it | Varies by scheme | Anyone — public JWKS, no account with us |
| Privacy | Identity known to the enrolling institution | Pseudonymous subject hash |
| Good for | Scope, spend limits, revoking the agent | Evidence a person was there for this session |
5arz does not replace agent identity or KYC. It measures the one thing those layers assume.
Four places it breaks.
The account changed hands
The agent is still validly enrolled. The person running it is not the one who enrolled it.
Applications at scale
Agents make applying nearly free. Fresh proof of a present person brings the signal back.
Approvals in multi-agent systems
A person approves a plan; sub-agents run actions nobody reviewed. Measure at the irreversible step.
Human review that quietly isn’t
If an agent can pay for “the human step”, your gate may be another model. A per-session attestation shows the difference.
From person to proof in four steps.
A human verifies
ID + liveness, run by our partners. 5arz gets only a signed result.
5arz signs the session
A short-lived ES256 credential with a pseudonymous subject and the task type.
The agent presents it
Your endpoint receives it alongside whatever the agent is doing.
You verify locally
Fetch our public keys once, cache them, check signatures locally.
Fetch the keys. Check locally.
- The subject is a hash, not a name
- Record jti and reject reuse
- Treat exp as the freshness bound
Agents can discover and register over our MCP server and OpenAPI.
// GET https://api.5arz.com/.well-known/jwks.json // any standard JWT library, any language const claims = await verify(credential, jwks) // ES256 claims.iss // https://5arz.com claims.vct // credential type claims.jti // one per verified session claims.sub_hash // pseudonymous subject claims.sybil_checked // uniqueness — currently always false claims.task_type // what was verified claims.exp // short-lived by design
Where AI transparency law is pointing.
- EU AI Act Article 50 transparency duties applied from 2 August 2026, for specific system classes — not AI generally.
- California’s AI Transparency Act (SB 942, as amended by AB 853) became operative the same day, for large generative AI providers.
- Both mark what a machine made. Neither asks for proof of what a person did.
5arz does not sell an Article 50 or SB 942 compliance product. General information, not legal advice — confirm your obligations with counsel.
Questions about KYA
What is Know Your Agent (KYA)?
Vetting an AI agent that acts for a user: what it is, who published it, who enrolled it and what it may do. It’s the agent-era counterpart to Know Your Customer.
How is this different from bot detection?
Detection guesses whether traffic looks automated. A human attestation is a signed claim that a verified, live person was present — the signature either checks or it doesn’t.
Do I have to choose between KYA and a human attestation?
No. KYA shows the software is what it claims and was authorized. The attestation shows a person was actually there. They fail in different ways, so they work well together.
What if there is no human — a fully autonomous agent?
Then no attestation exists, and its absence is the signal. The risk is a system that can’t tell “a person was there” from “nobody was asked”.
Is biometric data stored?
Not by 5arz. ID and liveness are done by our verification partners, Stripe Identity and Didit. 5arz never receives the selfie or ID image — only a signed result.
How do I verify a credential?
It’s a standard ES256 JWT. Fetch the public keys from api.5arz.com/.well-known/jwks.json, cache them, and verify with any JWT library. Re-fetch when keys rotate.
Know the agent. Then measure the human.
Free to start, no card. Or let your agent register itself over MCP.