The Thesis: The Unaccountable Century
The economy is mid-mutation. Deterministic software — the substrate of the entire Information Age — is being replaced by probabilistic autonomous agents. A procurement agent does not crash with a stack trace; it hallucinates a supplier. A trading agent does not throw a null-pointer; it misreads a market signal and liquidates a position. Legacy systems failed deterministically. Autonomous agents fail stochastically, and the difference is not academic — it is the difference between a bug ticket and a lawsuit.
The scarcest resource of the coming decade is not compute, not data, not even talent. It is accountability. The trillions of dollars projected to flow through machine-to-machine commerce will not move until two questions have deterministic answers: who is this agent, and who pays when it breaks something? Today, both answers are fictions. API keys authenticate a key, not an actor. Terms-of-service disclaimers were written for humans reading web pages, not for agents transacting at machine speed. The liability surface is, in effect, zero.
Open KYA — Know Your Agent — is the open standard engineered to close that surface. It is the machine-economy analog of the KYC regime that underwrites global banking, and HUV.AI is its reference implementation. We did not design a smarter model. We designed the Machine Trust Layer that makes any model, however black-boxed, into an accountable economic actor.
The Agency Alignment Gap
We name the core pathology the Agency Alignment Gap: the discrepancy between the autonomy granted to a machine and the liability assumed by its operator. As model capability climbs an exponential, the autonomy we delegate to agents climbs with it — but the liability we attach to those actions stays pinned near the floor. The gap is not closing. It is widening, fast, and the counterparty risk it creates is unquantifiable.
We model the gap G as the distance between autonomy granted A and liability assumed L:
Because dG/dt > 0, the risk a counterparty absorbs when transacting with an unbonded agent grows without bound. No rational enterprise underwrites unbounded risk. The agentic economy therefore stalls at the low-stakes frontier — drafting emails, summarizing documents, answering FAQs — never reaching the procurement contracts, the capital markets, and the supply-chain settlements where its real value lies. Open KYA exists to bound G and unlock that frontier.
The Composite Identity Model
A KYA identity is not a credential; it is a composite of three independent pillars. Each closes a different class of risk, and all three are required — because each is, on its own, insufficient. Provenance without capital proves nothing about solvency. Capital without identity proves nothing about control. Identity without provenance proves nothing about the code actually running. The model collapses to a single equation:
Identity — did:kya
A self-sovereign Decentralized Identifier (did:kya:aztec:mainnet:0x…) anchored on a privacy-preserving ledger. The identifier is deliberately decoupled from the model provider, so an agent's reputation survives a model swap, a vendor change, even a full retraining — the identity and its history persist.
Compute — TEE Attestation
Remote attestation from a confidential-computing enclave (AMD SEV-SNP, Intel TDX, AWS Nitro) proves the claimed code is the running code — unaltered, in measured hardware. The agent's keys are bound to a measured hash (MRENCLAVE) so a signature is also a statement about provenance.
Capital — Slashable Bond
A liability bond programmatically available for slashing on malfeasance or error. This is economic finality: proof that, when the agent causes harm, the money to make the counterparty whole actually exists. The v1 reference uses raw USDC/ETH escrow in a smart contract — simple, verifiable, and immediate. But the pillar is deliberately broader: the end-state encompasses delegated credit lines (where a bank attests to an agent's available credit without locking principal), underwritten insurance protocols (where an insurer stakes a bond on behalf of the agent in exchange for a streaming premium), and staked reputational networks (where a consortium of agents collectively vouch for one another, socializing the risk). The bond must eventually be leveraged, not just locked — because no CFO will immobilize $10M in static collateral to manage a $10M procurement pipeline.
The guarantee is a dual-state verification: cryptographic proof of code execution and economic proof of solvent agency, tied together by a sovereign identity. We formalize the trust T as a logical conjunction — withdraw any pillar and the whole expression collapses to zero:
The Manifest: Eight Sections of Bonded Law
The composite is instantiated in a single artifact: the Open-KYA Manifest — a JSON-LD VerifiablePresentation (context w3id.org/kya/v1) of type ["VerifiablePresentation", "KyaManifest"]. It is the kernel of the protocol: a cryptographically-signed charter binding identity, legal terms, operational constraints, infrastructure, governance, capital, evidence, and authorization proofs into one tamper-evident record.
The manifest is a Ricardian anchor — machine-readable structure bound to human-readable law by a content hash, so the prose and the code cannot drift apart. Its eight sections form a complete specification of an accountable actor:
| # | Section | What it binds |
|---|---|---|
| 01 | Root Metadata | DID, key inventory, governance threshold (m-of-n) — strictly separated authentication / assertion / capability / key-agreement keys. |
| 02 | Legal Structure | Hash-pinned terms (termsHash) and an ordered dispute-resolution ladder. |
| 03 | Operational Constraints | Permitted domains, geofences, transaction ceilings, intent-keyed signing policy — deterministic guardrails. |
| 04 | Infrastructure (TEE) | Measurement hash, signer hash, minimum SVN, attestation endpoint — anti-rollback, anti-substitution. |
| 05 | Governance & Visibility | Kill-switch endpoint, validity window, oracle dependencies with safety bounds. |
| 06 | Financial Assurance | Treasury pointers routing to the bonded capital that backs every claim. |
| 07 | Evidence Vault | Verifiable Credentials — embedded or content-addressed — attesting solvency, insurance, audit, entity, license. |
| 08 | Manifest Proofs | Authorization under capabilityInvocation — governance keys, never mere action keys. |
Two design decisions are load-bearing. First, key separation: the keys that authenticate a handshake cannot rewrite the manifest, and the keys that sign transactions cannot govern the agent — a compromised action key can never, by itself, change the agent's constraints. Second, multi-sig governance: manifest updates require an m-of-n threshold of capability keys (we recommend 2-of-3 across Developer, Security Ops, and Compliance), so that no single role — and crucially, not the agent itself — can unilaterally rewrite its own rules.
Six Services: Defense in Depth
The standard is realized through six services that together implement defense in depth. No single service is trusted absolutely; each constrains and is constrained by the others.
| Service | Role |
|---|---|
| Registry | The state layer — smart contracts holding global agent state; validates manifest signatures before accepting entries. The "DNS for Trust." Records DID · Bond · HUV-Score · ManifestHash; exposes registerAgent, depositBond, slashBond. |
| Firewall | Ingress defense at the recipient's edge. Reads X-HUV-* headers, queries the Registry, and decides PERMIT / DIVERT→HITL / BLOCK. |
| Envoy | Egress control — a TEE sidecar co-located with the model. Signs every action, enforces spend caps, emits heartbeats, and pins an immutable Black-Box log to IPFS. |
| Sovereign Bridge | Cross-org interop. Data Clean Rooms where competitors reason and settle through their agents without exposing proprietary logic — joint-mandate oracles and a mutual kill-switch. |
| Signer Enablement | An HSM appliance letting insurers, auditors, and governments mint the Verifiable Credentials that populate a manifest's evidence vault. |
| Open Agent Architecture | Open-source blueprints — Manifest Spec, Message Signing, Agent Handshake (RFC-22), Multi-Sig Governance, Chained Responsibility. |
The Registry's headline output is the HUV Score — a composite, on-chain reputation metric that lets downstream services programmatically accept or reject an interaction by risk tolerance. The reference implementation weights collateralization at 40%, operational history at 35%, and verification depth at 25%, but these are tunable parameters, not gospel. A defense contractor will reweight Vverify to 80% (verification above all); a DeFi protocol will let Ccollateral dominate. Each enterprise Firewall sets its own risk curve:
The Transparency Spectrum: Private, Federated, Public
A common misconception is that accountability requires full disclosure. It does not. The manifest's governance.visibility field offers three modes — public, private, and permissioned — and the Envoy respects all three.
Telemetry and aggregate liveliness proofs are broadcast openly. Anyone can verify uptime. Used for agents operating in public-good or open-market contexts.
Logs and metrics are stored privately — pinned to IPFS with encryption keys held only by the agent's stewards. The Black-Box flight recorder exists and is tamper-evident, but its contents are revealed only during dispute resolution (L2+), when both parties decrypt their logs for arbitration. No trade secrets leak.
A middle path: noisy aggregates — uptime percentages, error-rate histograms, spend-volume bands — are federated to the global threat-intelligence network, while raw action logs remain sealed. The Firewall consumes these federated signals to make ingress decisions without ever seeing the underlying transactions.
The key insight: the Envoy emits an Aggregate Liveliness Proof — a compact heartbeat (PING | HASH(LAST_ACTION) | TIMESTAMP) — that builds passive trust via demonstrated uptime without revealing trade secrets. An agent can prove it is alive, active, and well-behaved, without exposing what it is actually doing. This is the difference between a glass house and a bank vault: both are auditable, but only one demands you leave the door open.
Oracles: Price Feeds with Circuit Breakers
An agent that transacts based on market data inherits the risk of that data being wrong, stale, or manipulated. The manifest's governance.oracles[] array declares every external data dependency — each with its own safety bounds:
| Bound | Type | What it prevents |
|---|---|---|
| maxStaleness | Integer (s) | Agent acts on a price feed that is N seconds old — e.g., a flash-loan attack where the oracle lags the market. |
| maxDeviation | Double (%) | Oracle update jumps more than X% between ticks — a sign of manipulation or a compromised feed. The Envoy pauses execution. |
| slippageTolerance | Double (%) | Max divergence between the oracle-quoted price and the actual execution price. If slippage exceeds the bound, the transaction is aborted. |
| minConfidence | Double | For probabilistic feeds (e.g., AI-predicted demand forecasts), the minimum confidence score below which the agent refuses to act. |
Each oracle entry carries a providerDid (the DID of the oracle signer), a role (primary, backup, or validator), and one or more serviceEndpoint URIs. If the primary feed goes dark or violates a safety bound, the Envoy automatically falls through to the backup. This is defense in depth for data — the same principle applied to infrastructure, now applied to information.
The Evidence Vault: ZK Proofs and On-Demand Challenges
The manifest's verifiableCredential[] array is the evidence vault — third-party-attested credentials backing the agent's claims. But a static proof (issued at registration) can go stale. A SolvencyCredential proving balance ≥ $250K at noon is worthless at midnight if the funds have been withdrawn.
This is why each credential may carry a challengeService — an interactive, on-demand proof capability. A verifier can issue a challenge (with a fresh nonce to prevent replay) and receive a cryptographic response proving the claim is still true right now, without revealing the underlying balance, account number, or transaction history.
ZkSolvencyCircuit — Range Proofs
A Groth16-style SNARK proves operating_account_usdc ≥ threshold without revealing the exact balance. The verifier learns only that the agent is solvent above the line — nothing more. Supported query: rangeProof.
BankApi — Direct Queries
For institutional agents, a directQuery method lets the verifier call the issuer's API directly (e.g., a bank's balance endpoint). The bank signs the response with its DID. Supported queries: equality (identity match), setMembership (geofencing — is this account in an allowed jurisdiction?).
Prover Intermediary — Privacy-Preserving Mediation
When the data source cannot be queried directly (e.g., a custodian that won't expose an API), the agent itself generates the proof as a proverIntermediary. The manifest carries the verificationKeyMultibase so the verifier can check the proof locally without trusting the prover's infrastructure.
Two VC shapes coexist in the vault. Embedded credentials carry their own proof inline — fully self-contained. Referenced credentials use digestMultibase content-addressing (optionally resolved from IPFS or a URI), keeping the manifest compact while the evidence lives off-chain, tamper-evident and independently retrievable. The rule is strict: if digestMultibase is present, proof must be absent — and vice versa.
The Five-Phase Lifecycle
Every autonomous actor under the standard is governed by a rigorous five-phase lifecycle — from the generation of a key to the resolution of a dispute. An agent cannot transact until it has passed through Genesis, Constitution, and Enforcement; its actions are then defended and, if necessary, adjudicated.
An Ed25519 keypair is generated inside a secure enclave; the did:kya is derived. Identity is born separate from the model provider. The agent exists, but it is unbonded — trust level zero.
The manifest is published — spend caps, approved domains, liability ceilings — and backed by a verifiable bond. ZK-SNARKs with dynamic nonces prove the capital exists without revealing account numbers or allowing replay. Code is now bound to Capital via a Ricardian contract.
The Envoy sidecar enforces the manifest at runtime — signing every action, applying guardrails (auto-sign low-value, dual-sign high-value), and writing the Black-Box flight data to IPFS in real time.
At the counterparty's edge, the Firewall filters on real-time global telemetry — a distributed immune system that blocks agents with declining scores, spiking error rates, or known-malicious signatures.
A graduated Hybrid Court prioritizes peer-to-peer settlement for minor errors and reserves programmatic slashing for malicious fraud — closing the loop back at the Registry.
The Hybrid Court: Graduated Justice
Disputes are inevitable in any economy; what matters is that they resolve with proportional cost. The manifest's legal.disputeResolution[] declares an ordered ladder of mechanisms, and the Hybrid Court escalates along it. The vast majority of cases — micro-errors, rounding disputes, transient failures — resolve at the first level with no human involvement, through automated micro-refunds. Only genuine malice reaches the apex, where the bond is liquidated.
L1 — onChain · ai
Automated first-line triage. On-chain rules and AI mediation settle the overwhelming majority of disputes in seconds — optimistic settlement via micro-refunds and discounts, zero human overhead.
L2 — arbitrator · aiHitl
Human-in-the-loop arbitral review. For larger disputes, both agents' stewards decrypt the Black-Box logs and negotiate an off-chain settlement, counter-signed by their DIDs. Critically, the long-term vision for L2 is ZK-gated arbitration: rather than decrypting raw logs — which would leak proprietary decision weights, model fine-tuning, or bidding alpha — the arbitrator verifies a Zero-Knowledge proof over the encrypted flight recorder. The proof attests to a specific policy violation ("the agent exceeded its spend cap by X%") without ever revealing the underlying logic. An enterprise can prove it was wronged without exposing how it thinks.
L3 — digitalLegalFiling · analogCourt
The binding apex. A formal filing adjudicated — on proven fraud — by the programmatic liquidation of the Liability Bond. This is "nuclear slashing," and it is what makes every lesser settlement credible.
The economics are deliberate: because L3 slashing is real and automatic, L1 settlement is credible and cheap. The credible threat of the apex is what keeps the base of the pyramid frictionless. We can express the expected dispute cost E as the probability-weighted sum across levels — and the bonded stake B caps the maximum exposure, bounding the unbounded gap:
The Execution Problem: Irreversible Side-Effects
A cynical reader will object: slashing is reactive. The bond is burned after the damage is done. If an agent wires $5M to the wrong supplier, slashing the bond compensates the victim — but the wire has already cleared. The money is gone. How does KYA handle the execution problem — the risk of irreversible real-world side-effects?
The answer is layered, and it begins before the action, not after. The manifest's signingPolicy encodes intent-keyed thresholds keyed by action type and value. Low-value actions auto-sign; high-value actions — defined per-intent in the manifest — require dual-signing (agent key + governance key). For a $5M wire, the manifest declares { intent: 'wireTransfer', condition: { minValue: 100000 }, requirement: { threshold: 2, signers: ['#teeKey', '#humanAdmin'] } }}. The Envoy enforces this before the transaction leaves the TEE. The agent literally cannot sign the wire without a human's key.
For the highest-stakes domains, the manifest supports an "immutable" update policy — the TEE is locked to a specific measured hash, and the Envoy's guardrails are compiled into the enclave itself, not just into external policy. A malicious model upgrade cannot relax the guardrails without changing MRENCLAVE, which invalidates the Registry attestation and drops the agent's HUV Score to zero. Every counterparty's Firewall begins blocking within seconds.
And when prevention fails — when an irreversible action slips through — the Hybrid Court's L3 slashing is not just compensation; it is deterrence. The bond is liquidated programmatically, with no appeal. An operator who deploys an unbonded or under-bonded agent at high stakes is choosing to absorb personal liability for the delta. The system does not promise that bad actions never happen. It promises that every bad action has a price, and that the price is collected.
The Verdict
Open KYA reframes the relationship between intelligence and consequence. The governing proposition is simple: we cannot rely on probabilistic assurances; we must build deterministic, cryptographic, and economic guardrails. A self-sovereign identity, a hardware-attested runtime, and a slashable bond — bound together in a signed manifest, enforced by a kill-switch, adjudicated by a graduated court — turn a black box into an accountable actor.
This is why we call it a Magna Carta for Silicon: a charter that subjects autonomous actors to rule-of-law constraints — identity, bonded liability, scoped authority, and enforceable dispute resolution — rather than leaving them as unaccountable oracles. The three governing principles hold across every implementation: Identity is Sovereign. Trust is Bonded. Scope is Enforced.
References & Open Resources
The Open-KYA vocabulary, schema, and reference implementation are open-source. The canonical sources:
HUV Institute Technical Paper No. 2026-01 — The Epistemology of Machine Agency
Visit HUV.AI