KYC asks who the customer is. KYA asks what the agent may bind you to.
When an AI agent shops for someone, your store has to answer new questions: who is this agent, who sent it, and what is it allowed to do? That's Know Your Agent.
What changed
For twenty years, online stores treated automated traffic as a threat. Bot management, CAPTCHAs and rate limits were built to keep software out. Now some of that software is a customer, sent by a real person to find, compare and buy.
So the old defenses fail in both directions. They turn good agents away, which costs sales. And they still let bad ones through, because a dial that only knows "human or bot" can't tell an accountable agent from a hostile one.
KYA is different from logging in (is this user signed in?) and from payment approval (is this user allowed to spend?). It asks whether an accountable party stands behind the agent in front of you.
The four questions
Who is the agent?
Identity the store can check, like a signed request that proves which agent is visiting. Standards such as Web Bot Auth do this today.
Who authorized it?
Proof that a real person sent the agent and agreed to what it's doing. Card networks and payment providers are building this.
What is it allowed to do?
Limits on spend, stores and categories, checked at the door.
How far does authority travel?
When one agent hands a task to another, and that one to a third, no deployed standard yet proves which person stands behind the last step. This part has to be designed, not bought.
It runs both ways
Inbound: when an agent shops with you, can you tell whether an accountable party stands behind it?
Outbound: when your systems deal with others, can you prove one stands behind you? Stores that can't may find themselves filtered out as agent networks start checking.
Two honest points
- Watch the slope, not the level. Agent shopping is a small share of sales today. It's growing fast, and that's the reason to prepare now, not a reason to panic.
- Build readiness now, choose vendors later. KYA is a settled idea but not yet a settled standard. Make your store readable, let verified agents in, keep checkout open to them, and hold off on locking into one provider until the standards land.
Where PegasusKYA fits
Our free check measures the parts of KYA you can act on today: whether agents can read your store, whether your bot protection admits a verified agent, whether checkout is open to them, and whether they can verify you.