- Platform
- Know Your Agent
- Enforce
Know Your Agent: enforce
Control every interaction.
Once you can see agents, decide what each may do. Write a rule in plain language, and Vouched compiles it to a Cedar policy you can dry-run on real traffic before you deploy, then allows, challenges, blocks or redirects agents at the edge or in your app.
Why it matters
Allow-all and block-all both cost you.
Most sites only have two blunt choices for agent traffic. Neither protects revenue.
Block them all
Real buyers who send an agent to shop for them are turned away, and the sale goes with them.
in revenue lost when a real buyer’s agent is blocked, in Know Your Agent’s illustrative example.
Source: Vouched, illustrativeAllow them all
Rogue agents can browse, buy and transact freely, at the scale automation allows.
in fraud loss when a rogue agent is allowed, in the same illustrative example.
Source: Vouched, illustrativeDecide per agent
Enforce turns the class, confidence and verified delegation of each request into a verdict you control.
How it works
From a sentence to a deployed policy.
Choose how to enforce
The Gateway runs at the Cloudflare edge with a DNS change and no code. Middleware runs in Next.js, Express, .NET or Java. You can run both.
Compose in plain language
Describe the rule you want, and Know Your Agent compiles it to Cedar, the policy language your verdicts are written in.
Dry-run on real traffic
Preview the verdict every request would get before anything is enforced.
Authorize and deploy
Deploy when the verdicts look right, then monitor decisions and health from the dashboard.
What you get
Policy you can read before you trust it.
Four verdicts
Allow, challenge, block or redirect agent traffic, rule by rule.
Plain language to Cedar
Write the rule the way you’d say it. Know Your Agent compiles it to Cedar.
Dry-run first
See what every request would get before enforcement starts, and stage rollouts in observe mode.
Edge or in-app
Gateway at the Cloudflare edge with no code, or Middleware in your own stack.
Verified agent signatures
Ed25519 HTTP Message Signatures (RFC 9421) from ChatGPT and other agents are verified, for 100% confidence.
Require a cryptographic identity
KYA-OS enforcement blocks agents at the edge until they present a signed identity.
Gateway or Middleware
Two ways to enforce. Same policy engine.
Gateway
DNS change at the Cloudflare edge. No code. Custom domains and SSL. Captures the TLS fingerprint.
Middleware
SDK in Next.js, Express, ASP.NET Core or Java. Full control over responses. Observe mode for staged rollouts.
Who it’s for
Built for teams facing the agentic web.
Checkout
Let verified agents complete purchases and challenge the rest.
APIs
Apply the same policies to the requests that reach your API routes.
Content and pricing
Keep scrapers off pricing and inventory while helpful agents get through.
More in Know Your Agent
Detect, enforce, govern and delegate.
FAQ
Enforce, answered.
Straight answers about enforce with Vouched Know Your Agent.
Contact us with a questionHow do I stop AI agent fraud without turning away real buyers?
Instead of blocking or allowing every agent, Enforce applies a policy to each request based on its class, confidence and whether it carries a verified delegation. Verified agents can be allowed, unknown agents challenged, and scrapers blocked.
What verdicts can Enforce apply?
Allow, challenge, block or redirect, defined rule by rule in your policy.
How do I write an enforcement policy?
Describe the rule in plain language in Compose. Know Your Agent compiles it to Cedar, you dry-run it against real traffic, and then you authorize and deploy it.
What is the difference between the Gateway and Middleware?
The Gateway runs at the Cloudflare edge: you change a DNS record and need no code, and it captures the TLS fingerprint. Middleware is an SDK in your application, for Next.js, Express, ASP.NET Core or Java, with full control over responses.
Can I test a policy before enforcing it?
Yes. Run a dry test against real traffic to preview verdicts before you deploy. Middleware also has an observe mode for staged rollouts.
How does Enforce verify an agent’s identity?
It verifies Ed25519 HTTP Message Signatures (RFC 9421) from ChatGPT and other agents that cryptographically identify themselves, which gives 100% detection confidence. With KYA-OS enforcement, it can block agents at the edge until they present a signed identity.
Does Enforce include detection?
Yes. Enforce includes everything Detect offers, plus policy-based actions.
How is Enforce different from Govern?
Enforce protects your site and app from unwanted agents by detecting them and applying policies. Govern authorizes known agents to use your APIs under cryptographically verified delegations. They work together.
The KYA newsletter
Be first to know what agents do next.
AI agents change something every week. Once a month, we’ll send you what’s new in agent identity, KYA‑OS and the fixes that actually work, so you’re always a step ahead. No spam, ever.