KYA: A Framework-Agnostic Trust Layer for Autonomous Systems with Verifiable Provenance and Hierarchical Policy Composition
2026-05-25 • Cryptography and Security
Cryptography and SecurityArtificial IntelligenceComputers and SocietyMultiagent SystemsSoftware Engineering
AI summaryⓘ
The authors introduce KYA (Know Your Agents), an open-source system that helps operators trust and manage autonomous agents by detecting when agents behave incorrectly or untrustworthily, beyond just being slow. KYA uses five main parts including signature checks, a trust scoring system for humans and AI, and methods to verify and audit interactions securely. It works with many agent frameworks, quickly processes thousands of operations per second, and effectively detects most adversarial attacks tested. The system is available as a Python package under an open-source license. Overall, the authors present KYA as a tool to improve security and trust in automated systems.
ObservabilityAutonomous systemsTrust scoringEd25519 signatureMulti-anchor pinningAgent governanceAuditable interactionsDelegation attributionAdversarial detectionPython package
Authors
Kolawole Quadri
Abstract
Observability tells operators when an agent is slow. KYA tells operators when an agent is wrong, drifting, leaking, or quietly going rogue. We present KYA (Know Your Agents), an open-source trust and governance layer for autonomous systems composed of five primitives: (1) a four-gate inbound apply pipeline composing Ed25519 signature verification with multi-anchor pinning, persist-time expiry, only-tighten composition, and operator-approval-as-default; (2) an only-tighten composition algebra over a three-channel multi-tenant hierarchy (platform default,tenant override, signed external recommendation); (3) KYP -- Know Your Principal, a schema-level unification of trust scoring across human users, AI agents, and service accounts; (4) auditable interaction-multiplier amplification over an AIVSS-shaped additive baseline, with bounded asymmetric per-interaction multipliers carrying stable audit codes; and (5) two-axis delegation attribution combining a static observation-gated delegation-trust premium with zero-config runtime orchestrator-blame at three SDK hook surfaces. KYA is framework-agnostic across 22 agent frameworks. The pure-function scorer runs sub-millisecond at p99 and the system sustains ~1,800 ops/sec at 20 concurrent workers with HMAC chain integrity preserved end-to-end. The four-gate inbound apply pipeline rejects forged, expired, loosening, and unapproved recommendations on every trial (1,200 / 1,200) with sub-millisecond p99 latency on SQLite. KYA detects 89% of 1,200 adversarial probes from PyRIT and Garak, including the recently-published topology-guided multi-agent attack. The system is available under Apache 2.0 as the veldt-kya package on PyPI (release candidate at submission time; stable v0.1.0 forthcoming)