Know Your Agent™
Mar 22, 2025
This paper introduces the Know Your Agent™ (KYA) Framework — a structured approach to AI agent governance inspired by the rigour of financial services compliance. Download the full paper for the complete framework, assessment templates, and implementation guidance.
The financial services industry has long understood that doing business with an unknown counterparty is not a risk worth taking. Know Your Customer (KYC) processes exist precisely because identity, intent, and accountability must be established before trust is extended.
The same logic now applies to AI agents.
As organisations deploy dozens — and in some cases hundreds — of autonomous agents across their operations, a critical governance gap has opened: enterprises are extending significant operational trust to AI systems they cannot fully identify, describe, or account for. They do not have a complete inventory of what agents exist. They cannot consistently describe what each agent is authorised to do. And they have no systematic process for verifying that agents operate as intended over time.
Know Your Agent™ (KYA) is the governance framework for closing that gap.
The Problem: Operating with Unknown Agents
Agent proliferation is not a technology problem. It is a governance problem.
When a business unit deploys an AI agent to handle customer queries, and another team deploys one for contract review, and operations builds one to automate approvals, the organisation is extending trust implicitly — without the oversight structures that such trust warrants. The result is a version of agent sprawl that is not just operationally risky, but increasingly a regulatory and reputational liability.
Most organisations today cannot answer four basic questions about their AI agents:
- Who authorised this agent to act on behalf of the organisation?
- What is this agent permitted to do — and what is it explicitly prohibited from doing?
- How is this agent being monitored, and by whom?
- When was this agent last reviewed — and what changed since then?
These are not difficult questions to answer in principle. They are difficult to answer systematically, at scale, without purpose-built governance infrastructure.
The KYA Framework
Know Your Agent™ draws directly on the identity verification and due diligence disciplines that regulated industries have developed over decades, and applies them to AI agent governance.
The framework is built on three foundational activities:
Catalogue
Every AI agent operating in the enterprise must be registered. This means capturing not just the agent's name and vendor, but its purpose, the decisions it is authorised to make, the data it can access, the workflows it participates in, and the humans who own accountability for its behaviour. A catalogue that is incomplete is not a governance control — it is a false sense of security.
Verify
Registration is not sufficient. Each agent must be subject to structured verification — a systematic review of whether it operates as described, within the parameters it was approved for, and in alignment with organisational policies and applicable regulations. Verification should happen at onboarding, at material change, and on a defined cadence thereafter. AI agents drift. Verification catches drift before it becomes a governance failure.
Monitor
Governance is not a point-in-time activity. Organisations that treat AI agent sign-off as a one-time approval create a false boundary between deployment and risk. KYA requires continuous monitoring — automated where possible, human-reviewed where material — with defined thresholds for escalation, intervention, and remediation.
Why Now
The regulatory environment is moving. APRA, the EU AI Act, and equivalent frameworks in other jurisdictions are increasingly explicit that organisations cannot simply attest to AI safety — they must demonstrate it, with evidence.
What regulators are beginning to require is, in effect, a KYA process: documented cataloguing of AI systems, structured verification of their behaviour, and ongoing monitoring against defined risk appetite.
The organisations that build this infrastructure now — before it is mandated — will be better positioned to scale AI adoption with confidence, and to satisfy board and regulatory scrutiny without scrambling to reconstruct an evidence base after the fact.
Implementation
The KYA Framework is not a compliance exercise. It is an operational capability.
Organisations that implement KYA effectively do not simply produce documentation. They build a living system of record: an agent register that is actively maintained, a verification process that is repeatable and auditable, and a monitoring capability that operates continuously alongside every agent in production.
Aigentsphere is purpose-built to operationalise KYA at enterprise scale — providing the catalogue, verification workflows, and real-time monitoring that the framework requires, without creating new burdens for technical teams.
Know Your Customer transformed financial services compliance by making identity a systematic control, not an ad hoc check. Know Your Agent™ applies the same discipline to the AI agents that are increasingly acting on your behalf. You cannot govern what you do not know.