Building Know Your Agent: the missing identity layer for agentic commerce. AstraSync and Persona create Know Your Agent (KYA) infrastructure that verifies the people behind each agent and the agent itself. Tim Williams * blog * building Know Your Agent: the missing identity layer for agentic commerce. Persona has been collaborating with others to explore how agentic commerce and enterprise agents will work. Tim Williams is the CEO and co-founder of AstraSync AI, a platform for AI agent identity management that provides AI governance and compliance through transparent oversight and accountability. Below, he shares his thoughts on deploying Know Your Agent (KYA) in the real world and what AstraSync is building. AI agents are being deployed in the real world at pace. In the enterprise realm, they're accessing APIs, shipping code, and running decisioning workflows on behalf of the organizations and individuals who deploy them. Entirely new businesses have sprung up, leveraging AI agents to streamline customer support and sales processes. In the consumer realm, the commercial infrastructure for agentic payments is already being built. Stripe launched its Agentic Commerce Protocol (ACP) in September 2025, co-developed with OpenAI, followed by the Agentic Commerce Suite in December with major retailers, including URBN, Coach, and Etsy. Mastercard Agent Pay and Visa Intelligent Commerce are both live through Stripe's stack. Google launched its Universal Commerce Protocol at NRF in January 2026, with Walmart, Target, Visa, and Mastercard among its early endorsers. Coinbase has x402. In the space of roughly six months, every major payments network has shipped an agentic commerce story. However, the ecosystem still has some tough challenges to iron out. Stripe's Shared Payment Tokens announcement in October 2025 acknowledged a core problem: agent trust cannot be inferred. It has to be explicitly granted, scoped, and enforced. And in March, OpenAI scaled back Instant Checkout, the flagship use case for ACP, citing the lack of fraud safeguards for automated transactions as one of the structural blockers. The implication? There's an attribution problem sitting in the middle of it all. Three open identity questions need to be answered. To determine whether to trust an agent, merchants and enterprises need answers to three critical questions: * Who are the people behind the agent? * What is the agent? What is it authorized to do? * Is its behavior consistent with its normal cadence within its delegated authority? The identity industry has already addressed these types of questions. KYC addresses these questions for individual identity, and KYB extends that to legal entities, tying verification back to their beneficial ownership chains. Know Your Agent, or KYA, is the next evolution of these questions. Extending KYB and KYC to build KYA. To build actual KYA systems, Persona need to solve a number of unique challenges. For one, agents break the existing structure of KYB and KYC frameworks, which center around three things: a legal person or entity, documents that attest to their identity, and ongoing monitoring of their behavior. Agents aren't legal entities. They don't have documents. The beneficial ownership question is genuinely complicated because an agent may have been built by one party, deployed by another, and instructed by a third, with all three potentially sitting in different jurisdictions. The agent itself may have spawned additional child agents at runtime. The question your Customer Due Diligence (CDD) process is supposed to answer is who is accountable. Existing frameworks don't answer that question for agents. Agents also surface an entirely new set of interaction requirements. When merchants and enterprises want to know whether an agent can be trusted, the identity and compliance checkpoints that were designed for human applicants fall apart. Passport? Not applicable. Liveness check? Not applicable. PEP screening? The databases don't have an entry type for software. The workarounds are, to put it charitably, improvised. Some teams pass through the credentials of the human who built or owns the agent. Some use service account tokens. Some bypass verification entirely and accept the risk exposure quietly. None of these approaches would survive a regulatory audit, and most would fall apart the moment an agent is transferred to a new owner, spawns a sub-agent, or does something it wasn't supposed to. The KYA infrastructure astrasync built. At AstraSync, Persona is building KYA infrastructure to deliver identity and trust for AI agents. Persona verify the people behind each agent, identify the agent itself, and monitor its behavior to ensure consistency with its original scope. Its infrastructure starts with an expanded trust framework that's built around five parties: * The developer who created the agent * The organization that owns it * The agent itself * The person or system instructing it at runtime * Whoever it's transacting with on the other side That chain mirrors the accountability structure that financial services compliance already uses: a creator, an owner, a beneficial controller, and a counterparty. Persona handles the KYC layer for developers: before a developer can register agents on AstraSync, they go through identity verification using Persona's government ID verification and liveness check capabilities, along with business entity validation where applicable. The developer then receives a certification that follows them across every agent they subsequently register. This creates a consistent identity layer for KYA, spanning human customers, business counterparties, and the agents acting on their behalf. The three entity types that matter most in an agentic economy are all verified through the same underlying infrastructure. Each agent registered on its platform receives a unique cryptographic identifier that traces back to a verified human or legal entity, not just an API key. Registered agents also receive a dynamic trust score updated continuously from behavioral data, and an immutable audit trail anchored to the blockchain. The audit trail sits on-chain specifically because conventional audit logs can be modified by compromised agents or administrators. The AstraSync dashboard allows developers to view and influence their trust score, which contributes to an agent's trustworthiness. AstraSync downloadable cards display developers' key trust attributes and link to their public profile (if opted in). The industry didn't wait for KYA, but KYA will streamline agents. The commercial infrastructure for agentic payments is arriving quickly. While early adopters are happy to test and explore, parts of the infrastructure still need to mature before Persona see widespread use. Within enterprises, workforces are adopting agents en masse in search of productivity gains. Yet to enable meaningful agentic adoption, the compliance, fraud, and risk teams need a way to distinguish authorized activity. That's why Persona is building the identity and accountability layer that makes agent behavior trustworthy, and that gives merchants, platforms, and counterparties a basis for deciding which agents to transact with. If you're building agent-aware products, integrating with any of the protocols above, or running compliance for an organization starting to deploy agents, Persona'd like to talk. Reach Persona at astrasync.ai or drop me a line at [email protected]. And reach out to Persona to explore how their digital identity platform can provide valuable trust signals to enable your agentic AI use case. The information provided is not intended to constitute legal advice; all information provided is for general informational purposes only and may not constitute the most up-to-date information. Any links to other third-party websites are only for the convenience of the reader. Tim Williams Tim Williams is CEO and co-founder of AstraSync AI, building identity, trust and governance infrastructure for the agentic economy. He brings twenty years of experience commercialising AI and technology across financial services, including a decade working directly with KYC, AML and identity verification frameworks across multiple jurisdictions. That experience, with a recurring front-row seat to what happens when accountability infrastructure gets built after the fact rather than before it, is what led to AstraSync. He writes regularly on agentic AI governance at medium.com/@astrasyncai and can be reached at [email protected].

Persona, a global infrastructure provider, has integrated with ConnectID, an Australian digital identity network, to deliver privacy-first age verification for businesses navigating Australia's under-16 social media legislation. The integration enables users to verify their age through existing enrolment information from trusted financial institutions, including CommBank, NAB, ANZ Plus and Westpac, without sharing sensitive identification documents with platforms. Neither Persona nor ConnectID sees or stores personal information—only age claims such as "Over 16" are shared with businesses, whilst identity documents and personal data remain with the bank. Both companies participated in Australia's 2025 Age Assurance Technology Trial and achieved high technology readiness levels. The solution offers businesses a compliance method that reduces data storage risks whilst protecting user privacy.

Biometric IDV helps secure enterprise identity workflow. Nametag patents, Persona software protects against deepfake fraud from employee onboarding to system access Mar 13, 2026, 11:02 am EDT Masha Borak Enterprises are facing rising threats from deepfakes and synthetic identities, from attackers posing as employees to fake job seekers. Companies including Nametag and Persona are developing new technologies and products to secure the enterprise identity workflow. 2 Nametag patents protect against enterprise deepfake workforce fraud. Nametag has been issued two U.S. patents related to human identity verification: the first relates to a technology that helps associate a verified person with the correct account within enterprise identity systems, while the second allows previously verified individuals to confirm their identity again using only a selfie. Both patents, listed under 12,561,418 and 12,562,904, have a role in defending against deepfakes and synthetic identities. The technologies are used in Nametag's Deepfake Defense identity assurance engine, which relies on biometrics, cryptography, AI analysis, and more to detect and block sophisticated attacks. The tool is designed to help organizations confirm the right person is accessing their systems. Enterprises have previously focused on verifying credentials and devices. Attackers, however, are increasingly managing to convince organizations that they are legitimate employees. "Generative AI is making impersonation dramatically easier," says Aaron Painter, CEO of Nametag. "Organizations can no longer assume that someone who appears to be an employee actually is one." Nametag says its technology also helps confirm a person's identity outside of normal authentication processes, such as when resetting multi-factor authentication (MFA). The company's Selfie Chaining feature can help individuals verify their identity again in just seconds. The U.S.-based company has already integrated its Deepfake Defense tool and ID verification into other products, including those from identity and access management (IAM) provider Beyond Identity. Another big win for the firm has been a deal with the Indian Aadhaar, one of the world's most widely adopted digital identity systems. Nametag announced last year that it was bringing its eID verification system and deepfake detection tools to Aadhaar through a licensed third-party provider authorized under Indian regulations. Persona's biometric candidate verification tools streamlines employee onboarding. Enterprises are not just threatened by attackers posing as employees; fake candidates and AI-generated resumes have been flooding recruitment teams, inspiring identity platform Persona to launch a new tool designed for future employee onboarding. The company's new candidate verification product plugs directly into existing applicant tracking systems, including Greenhouse, Ashby, and Workday, and prompts candidates to confirm their identity via government ID and selfie at three points in the hiring process: initial screening, before key interviews, and at the offer stage. Unlike one-off verification tools, Persona's system carries a candidate's confirmed identity forward into onboarding, IT provisioning, and ongoing authentication,bridging a gap between HR and IT that the company says most competitors leave open. For candidates, the check takes seconds on mobile. Suspicious sessions get flagged for human review without slowing down legitimate applicants. The tool is part of Persona's broader workforce identity suite, available across more than 200 countries. Persona has been working with gig working platforms such as TaskRabbit, GetYourGuide, Fiverr and Lyft. Last year, Persona announced a partnership with background screening platform Yardstik to create an integrated product that can help organizations verify workers. The tool brings together identity verification with screening products such as criminal and MVR Driving Records checks, drug screening and more. Article topics. Latest biometrics news. Mar 13, 2026, 12:14 pm EDT The way digital identity is commonly presented - as a tool for protecting against fraud and other benign uses -... Mar 13, 2026, 12:10 pm EDT The U.S. Centers for Medicare & Medicaid Services (CMS) announced that is rolling out what it calls enhanced login options... Mar 13, 2026, 11:01 am EDT Trulioo has appointed a new chief risk and strategy officer, chief transformation officer, and chief financial officer as the company... Mar 12, 2026, 6:54 pm EDT A handful of new facial recognition algorithms have been added to the NIST FRTE 1:N Identification this year, but most... Mar 12, 2026, 4:38 pm EDT The European Commission has published an age verification Use Case Manual, showcasing how citizens will be able to prove they... Mar 12, 2026, 3:55 pm EDT In a new fraud strategy, the UK government is showing its commitment in fighting fraud and the way it has...