- Platform
- Know Your Agent
- Govern
Know Your Agent: govern
Trust every outcome.
Govern authorizes the agents you want to work with. A verified person grants an agent a delegation with specific scopes and limits, every request carries a cryptographic proof of who the agent is and what it’s allowed to do, and every action lands in an audit trail.
Why it matters
Agents need identity, not just access.
Handing an agent a password or an API key gives it everything, and tells you nothing about who sent it.
Shared credentials over-grant
An agent with a person’s keys can do anything that person can, for as long as the keys work.
No link to a person
Without a delegation, you can’t tell which verified person authorized an agent, or what they agreed to.
No record to audit
When something goes wrong, there’s no proof of which agent did what, under whose authority.
How it works
Delegated, proven, logged.
The agent gets a delegation
Through an OAuth or consent flow, a person grants the agent specific scopes, for a set time, under set constraints.
Every request carries a proof
The agent signs a proof with its DID, the audience, a nonce and a reference to its delegation.
Your server verifies it
Middleware checks the proof with Know Your Agent before the request reaches your handler, including the scopes it needs.
Everything is audited
Delegations and proofs appear in the dashboard, where you can review activity and revoke a delegation at any time.
What you get
Zero trust for every agent request.
Agent DIDs
Every agent has a stable, verifiable decentralized identifier across sessions and services.
Delegations
Authorization grants from a person to an agent, with scopes, duration and constraints.
Proofs on every request
A cryptographic assertion ties each request to the agent and its delegation.
Fine-grained scopes
Grant files:read without payment:create, and require specific scopes per endpoint or tool.
Verifiable credentials
Identity and permissions issued as credentials anyone can verify independently.
Flexible consent
Consent-only approval, OAuth, credentials or your own identity provider.
Deployment
Run a KYA-OS server your way.
Dashboard deploy
One-click setup with your GitHub repo and a Cloudflare Worker.
Molti
Managed hosting: Know Your Agent runs the agent, with no repo or Cloudflare account needed.
Self-host
Full control with the KYA-OS packages, on your own infrastructure, with your own keys.
Migrate an MCP server
Add KYA-OS identity and authorization to an existing MCP server without rewriting it.
Who it’s for
Built for teams facing the agentic web.
MCP server developers
Let agents use your tools only under a verified delegation.
API providers
Require a valid proof and the right scopes before an agent reaches your endpoints.
Regulated businesses
Keep a verifiable record of which person authorized each agent action.
More in Know Your Agent
Detect, enforce, govern and delegate.
FAQ
Govern, answered.
Straight answers about govern with Vouched Know Your Agent.
Contact us with a questionWhat is AI agent governance?
It’s authorizing the agents you want to work with, under controlled conditions. With Govern, every agent request must carry a cryptographic proof of identity and authorization before it reaches a protected resource.
What is a delegation?
An authorization grant from a person or service to an AI agent. It specifies what the agent can do (its scopes), for how long, and under what constraints, much like an OAuth token for an agent.
What is a proof?
A cryptographic assertion attached to each request, containing the agent’s DID, the target audience, a nonce and a reference to the delegation that authorizes the request.
What is KYA-OS?
Know Your Agent Operating System, the open standard for AI agent identity and authorization that Vouched authored and donated to the Decentralized Identity Foundation.
How do people approve what an agent can do?
Through an auth method you choose: consent-only approval, OAuth sign-in with providers such as GitHub, Google or Microsoft, credentials, or your own identity provider.
Can I add KYA-OS to an existing MCP server?
Yes. You can add KYA-OS identity and authorization to an existing MCP server without rewriting it.
Can I revoke an agent’s access?
Yes. Active delegations are listed in the dashboard, where you can revoke them, and proofs are logged for audit.
How is Govern different from Enforce?
Govern authorizes known agents with cryptographic verification, typically for MCP servers and APIs. Enforce detects and applies policies to unknown agents on websites and apps. Use both together.
The KYA newsletter
Be first to know what agents do next.
AI agents change something every week. Once a month, we’ll send you what’s new in agent identity, KYA‑OS and the fixes that actually work, so you’re always a step ahead. No spam, ever.