🤖 AI

KYA: A Framework-Agnostic Trust Layer for Autonomous Systems with Verifiable Provenance and Hierarchical Policy Composition

KYA is an open-source, framework-agnostic trust layer for autonomous systems that employs five core primitives—including a secure four-gate apply pipeline, hierarchical policy composition, and unified trust scoring—to detect agent drift, leaks, and adversarial attacks while maintaining sub-millisecond latency and high throughput.

Original authors: Kolawole Quadri

Published 2026-05-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Kolawole Quadri

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a fleet of autonomous robots (AI agents) working for you. They are applying for loans, sorting medical patients, or trading stocks. Currently, the tools we use to watch these robots (called "observability") are like a car's dashboard: they tell you if the engine is running hot, if the car is moving slowly, or if a part is broken.

KYA (Know Your Agents) is a new system that doesn't just watch the engine; it acts as a security guard, a detective, and a notary public rolled into one. It answers the questions the dashboard can't: Is this robot lying? Is it drifting off course? Is it leaking secrets? And if something goes wrong, who is actually responsible?

Here is how KYA works, broken down into five simple parts using everyday analogies:

1. The Four-Gate Security Check (The "Bouncer")

Before an AI agent is allowed to do anything new or change its rules, it has to pass through four strict security gates. Think of this like a high-security bank vault:

Gate 1: Did the person holding the key actually sign this request? (Digital signature check).
Gate 2: Is this request still valid, or has it expired? (Time check).
Gate 3: Does this request make the rules stricter or looser? KYA only allows rules to get stricter (safer), never looser. It's like a parent saying, "You can add more chores, but you can't remove the ones you already have."
Gate 4: Did a human actually say "yes"? By default, a human must approve the change.

2. The "Only-Tighten" Rulebook (The "Safety Lattice")

Imagine you have a rulebook for your robots. The company (the platform) sets the baseline rules. You (the tenant) can add your own stricter rules on top, but you can never delete the company's safety rules.
KYA uses a special mathematical system to ensure that no matter how many people add rules, the system never accidentally becomes less safe. It's like a stack of safety nets: you can add more nets, but you can never pull one out from the bottom.

3. KYP: "Know Your Principal" (The "Universal ID Card")

In the past, we had separate ID cards for humans, separate scores for robots, and separate logs for automated scripts. KYA puts them all on one single ID card system.
Whether the actor is a human employee, an AI robot, or a background script, KYA gives them a "Trust Score." If a robot starts misbehaving, its score drops. If a human makes a mistake, their score drops. It treats everyone the same way, making it easy to see who is trustworthy and who is risky.

4. The "Interaction Multiplier" (The "Danger Combo")

Sometimes, a single action is fine, but two actions together are dangerous.

Example: Giving a robot a "write" tool is risky. Giving it access to "private data" is risky.
The Multiplier: If you give a robot both a write tool and private data access, the danger isn't just "risky + risky." It's "super dangerous."
KYA has a special list of these "dangerous combos." When it sees them, it multiplies the risk score up, alerting the human operator that this specific combination needs extra scrutiny.

5. The "Blame Game" (The "Orchestrator's Responsibility")

This is one of the most important features. Imagine a "Manager Robot" hires three "Worker Robots" to do a job. If one Worker Robot goes rogue and steals data, who gets in trouble?

Old way: The Worker Robot gets blamed. The Manager Robot walks away clean.
KYA way: The Manager Robot gets blamed.
KYA assumes that if you hire a risky worker, you are responsible for what they do. If a sub-agent misbehaves, the system immediately deducts points from the Manager's trust score. This stops managers from hiding behind "clean" sub-agents to do dirty work.

How It Handles Evidence (The "Tamper-Proof Diary")

Every time an agent does something, KYA writes it in a digital diary. But this isn't just a normal log; it's a cryptographically chained diary.

Every entry is linked to the one before it using a special mathematical lock (HMAC).
If someone tries to go back and change an old entry (like erasing a mistake), the lock breaks, and the whole diary is marked as "tampered with."
This creates a court-admissible record of exactly what happened, who did it, and when.

What the Paper Actually Found

The authors tested this system with some tough challenges:

Speed: It's incredibly fast. It can check thousands of agents per second without slowing them down.
Compatibility: It works with over 15 different types of AI frameworks (like LangChain, CrewAI, etc.). It doesn't matter what software you use; KYA fits on top of it.
Hacking Tests: The team hired "red team" hackers to try to trick the agents. KYA caught 89% of the attacks, including a very tricky new type of attack where hackers use a chain of robots to hide their tracks.
Real-World Scenarios: They tested it on a simulated bank loan system and a hospital triage system. In both cases, it successfully identified risky agents and traced bad behavior back to the right person (or robot).

The Bottom Line

KYA is an open-source tool (free to use) that sits between your AI agents and the real world. It doesn't just tell you if the AI is working; it tells you if the AI is safe, honest, and accountable. It ensures that if an AI makes a mistake, we know exactly who to hold responsible, and we have a tamper-proof record to prove it.

Technical Summary: KYA (Know Your Agents)

Problem Statement

Current observability platforms for autonomous agents (e.g., LangSmith, Langfuse) effectively track operational metrics such as latency, cost, and error rates. However, they lack the capability to address agent identity, evidentiary provenance, and enforceable behavioral contracts. Specifically, existing tools do not produce agent-identity-bound, cryptographically verifiable, third-party-attestable governance artifacts. This gap leaves operators unable to definitively determine if an agent is drifting, leaking data, or going rogue, nor can they provide the cryptographic audit trails required by emerging regulations like the EU AI Act, NIST AI RMF, and ISO 42001.

Methodology

KYA (Know Your Agents) is an open-source, framework-agnostic trust and governance layer designed to sit alongside observability tools rather than replace them. It operates as a coordinated four-piece stack:

Core SDK (veldt-kya): A pure Python library handling trust scoring, evidence chains, and policy composition.
Framework Hooks (kya_hooks): In-process integrations for 15+ agent frameworks (e.g., LangChain, CrewAI, OpenAI Agents) that emit canonical events.
Telemetry Bridge (kya_otlp_bridge): A sidecar that ingests OpenTelemetry spans and maps them to KYA signals.
Red Team Module (kya_redteam): An out-of-band tool for adversarial probing using PyRIT and Garak.

The system relies on five core primitives to bridge the gap between telemetry and governance:

1. Four-Gate Inbound Apply Pipeline

To manage policy updates and federated recommendations, KYA employs a strict four-gate pipeline:

Gate 1: Ed25519 signature verification with multi-anchor pinning.
Gate 2: Expiration check at persist time (preventing replay attacks).
Gate 3: "Only-tighten" composition (policies can restrict but never loosen platform defaults).
Gate 4: Operator approval as the default state; auto-apply is restricted to specific allowlists.

2. Only-Tighten Composition Algebra

KYA introduces a formal algebra for hierarchical policy composition across three channels: platform defaults, tenant overrides, and signed external recommendations. This system enforces a refinement calculus where tenant overrides can only restrict (tighten) platform weights, never loosen them. This property is formally proven sound (Lemma 1) and prevents compromised collectors or external recommendations from weakening a tenant's security posture.

3. KYP (Know Your Principal) Unified Trust Taxonomy

KYA unifies trust scoring across three principal kinds—human users, AI agents, and service accounts—into a single schema-level table (kya_principal_trust). Unlike prior systems that score agents in isolation or rely on separate identity providers, KYP uses a shared scoring mechanism with a closed-set discriminator. This allows for consistent trust tracking and signal aggregation across the entire ecosystem of actors.

4. Auditable Interaction-Multiplier Amplification

Building on an AIVSS-shaped additive baseline, KYA introduces an auditable registry of interaction multipliers. These are bounded, asymmetric (multipliers $\ge$ 1.0 only) amplifications triggered by specific pairwise interactions (e.g., "code execution with user input" or "autonomous writer in production"). Each interaction carries a stable audit code, allowing auditors to trace exactly why a risk score was amplified. This addresses compounding risks that linear additive models miss.

5. Two-Axis Delegation Attribution

KYA addresses the "clean orchestrator" attack pattern (where a compromised sub-agent influences a clean orchestrator) via two axes:

Static Axis: A delegation-trust premium that penalizes orchestrators for delegating to risky sub-agents based on configuration.
Dynamic Axis: A runtime debit mechanism using an actor_agent_key convention. When a sub-agent emits a rogue signal, the signal is tagged with the orchestrator's key, debiting the orchestrator's principal-trust counter in real-time. This prevents attribution evasion where sub-agents hide the upstream responsible party.

Key Results

The paper evaluates KYA across four storage backends (PostgreSQL, SQLite, DuckDB, MySQL) and 15+ agent frameworks:

Correctness: All 36 cells in a 4-backend $\times$ 9-phase end-to-end matrix passed.
Performance: The pure-function scorer runs in sub-millisecond time (p99 < 1ms). The system sustains approximately 1,800 operations per second with 20 concurrent workers while preserving HMAC chain integrity.
Adversarial Detection: In a red-team campaign using 1,200 probes from PyRIT and Garak, KYA blocked or flagged 89% of attacks.
Attack Attribution: The system successfully detected and attributed the "topology-guided multi-agent attack" (Liang et al.) to the orchestrating principal, a capability absent in prior governance layers.
Compliance: The system generates regulator-legible artifacts for 32 regulatory regimes, including GDPR, HIPAA, NYDFS, and the EU AI Act.

Significance and Claims

The authors position KYA as a systems contribution rather than a novel cryptographic construction. Its significance lies in the composition discipline and the specific engineering primitives that make governance deployable in regulated, multi-tenant environments.

Novelty: The paper claims novelty in the three-channel hierarchical composition (platform/tenant/external) with a formal soundness proof, the interaction-multiplier registry with stable audit codes, and the runtime orchestrator debit for sub-agent misbehavior.
Modesty: The authors explicitly state that the scoring weights are heuristic and derived from expert judgment, not ground-truth calibration. They acknowledge that the system does not solve the halting problem for safety verification and that the 11% miss rate on sophisticated multi-turn prompt injections reflects structural limits of external filters.
Openness: The system is released under Apache 2.0, with all scoring factors, weights, and evidence chain artifacts being auditable and adjustable by operators.

In summary, KYA provides the missing layer of cryptographically verifiable provenance and enforceable behavioral contracts for autonomous systems, enabling operators to answer accountability questions ("was it wrong? who is responsible?") rather than just operational ones ("how long did it take?").