AI agents can now be tasked with opening accounts, placing orders or moving money, and Shufti has launched a service to check who authorised them and what they may do. Its Know Your Agent system combines agent identity checks with permission rules, aiming to give businesses a way to distinguish approved automation from impersonators.
Watch Desk analysis
What happened
Shufti’s Know Your Agent (KYA) gives each agent a time-limited credential that can be revoked. The company says it checks the agent’s identity, links it to a verified person or business, and applies a mandate covering permitted actions, limits and expiry.
Shufti says requests outside a mandate, or above a risk threshold, can trigger a human check using selfie liveness verification. The service also keeps an audit trail of requests, decisions and revocations. Its launch announcement was published by Help Net Security on 30 October.
Why it matters
A valid login token does not tell a business whether an agent is acting for the right person or staying within that person’s instructions. KYA is aimed at that gap: it puts identity, authorisation and action-specific limits in the path before an agent accesses data or starts a transaction.
The launch is a company’s description of its own product, not evidence that the checks prevent fraud in practice. Still, it gives businesses a concrete model to assess as automated agents move from answering questions to taking consequential actions.
Our read
The useful idea is not simply giving an agent a digital ID. It is tying that identity to a revocable mandate, then escalating actions that fall outside the agreed boundaries. Businesses considering agent-driven transactions should ask how those rules are configured, tested and audited, rather than treating a trust score as a magic stamp.
What to watch
- Whether Shufti publishes independent performance or fraud-prevention results.
- Which businesses adopt KYA and what actions they permit agents to take.
- How often the system escalates requests for human approval.
Discussion spark: For AI agents handling purchases or financial actions, should human approval be required for every transaction, or only when an agent steps outside a pre-set mandate?
Sources and evidence
- Source update (30 October 2026, 12:53 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.