Visa, Mastercard, and Ant International have a new Know Your Agent (KYA) interoperability framework. At first glance this sounds good. But we’ll need a very high level of trust that these “agents” are tied down.
Ted Miracco, CEO, Approov:
“Know Your Agent is an important first step, and it’s encouraging to see the networks aligning on it. However knowing who built or authorized an agent is not the same as knowing what is actually making the request. A key or a certificate proves someone holds a credential. It doesn’t prove the software using it is the authentic agent, unmodified, and not one of a thousand copies. We learned that lesson securing mobile apps. As agents start spending money, trust has to be established at every request, not just at onboarding.
“Certification only tells you what an agent should be. Merchants and payment APIs also need proof of what is actually running, verified cryptographically, not just inferred from behavior after the fact. The framework sets the accountability rules. The next step is making them enforceable within the software itself.”
This is a good start. But more needs to be done to make something like KYA useful. Let’s hope it gets useful in a hurry.
Related
This entry was posted on September 12, 2026 at 7:20 pm and is filed under Commentary with tags Ant International, MasterCard, Visa. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Visa, MasterCard and Ant International launch “Know Your Agent” framework
Visa, Mastercard, and Ant International have a new Know Your Agent (KYA) interoperability framework. At first glance this sounds good. But we’ll need a very high level of trust that these “agents” are tied down.
Ted Miracco, CEO, Approov:
“Know Your Agent is an important first step, and it’s encouraging to see the networks aligning on it. However knowing who built or authorized an agent is not the same as knowing what is actually making the request. A key or a certificate proves someone holds a credential. It doesn’t prove the software using it is the authentic agent, unmodified, and not one of a thousand copies. We learned that lesson securing mobile apps. As agents start spending money, trust has to be established at every request, not just at onboarding.
“Certification only tells you what an agent should be. Merchants and payment APIs also need proof of what is actually running, verified cryptographically, not just inferred from behavior after the fact. The framework sets the accountability rules. The next step is making them enforceable within the software itself.”
This is a good start. But more needs to be done to make something like KYA useful. Let’s hope it gets useful in a hurry.
Share this:
Like this:
Related
This entry was posted on September 12, 2026 at 7:20 pm and is filed under Commentary with tags Ant International, MasterCard, Visa. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.