Tom Loosemore

Earlier this year I blogged about the idea for a Creative Commons-style legal framework to help services respond to requests from AI Agents claiming to act on behalf of a person.

The more I play with AI Agents, and the more powerful they get, the more I’ve realised that the Creative Commons (CC) model is too optimistic and simplistic. Robust verification that an AI Agent is truly acting on behalf of the person it claims to represent is essential to preventing fraud, or worse. Sadly, the Creative Commons add-a-link-to-assert-your-licence model is way too weak for this level of assurance.

A much better analogy for what’s going to be required is the ‘Know your customer’ (KYC) model imposed by regulators on banks, lawyers etc, and requires them to verify that a customer really is who they say they are.

KYA needs a bit more than that. We need Know Your Agent’ (KYA) to establish what an autonomous AI agent is, who it acts for, what authority it has been delegated, and who remains accountable when it acts.

KYA identifies a delegation, in that an agent should have no interests of its own. So the object of verification shifts from identity to mandate and provenance. KYA is an even harder problem than KYC or KYB (‘On the internet, no-one knows you’re a dog‘), but one that is going to give competitive advantage those countries whose legal and regulatory systems adapt early to embrace AI Agents.

As I was researching this blog post, I picked up that the UK’s Financial Conduct Authority is thinking along similar lines, and will ask UK banks to take a lead on KYA. Good. That’s one approach; there will be lots more tried before we work this one out. Non-trivial problem, is KYA.

Anyway, here’s my set of pithy definitions for KYC, KYB and KYA, lest they prove useful.

Know Your Customer* (KYC): Verifying that an individual is who they claim to be, and understanding the risk they carry, before and during a relationship with your organisation. KYC identifies a person.

Know Your Business** (KYB): The same discipline applied to organisations: confirming a legal entity genuinely exists, who ultimately owns and controls it, and whether it’s operating legitimately. KYB identifies an entity.

Know Your Agent (KYA): Establishing what an autonomous AI agent is, who it acts for, what authority it has been delegated, and who remains accountable when it acts. KYA identifies a delegation.

* If you’re a public service or charity, feel free to change this to be “Know Your Citizen”.

** I know it says Business, but in my head I extend this to include any formally constituted organisation (charities, clubs etc).