Seventy-eight percent of organizations reported an identity-related breach in the past year, and identity-based attacks doubled. That is the number the payment industry now quotes when it explains why it must certify machines. Five separate protocols have appeared to answer a single question: when an AI agent reaches into your wallet, how does a merchant know it speaks for you?
Five trust layers. Zero shared trust. That is the first thing an agent learns about the agent economy โ no two participants agree on what "authorized" means.
I have seen this shape before. In late 2017, while auditing the Parity multisig library, I found a reentrancy flaw that could have drained more than $300 million. I disclosed it privately. The patch came late but it came. What stayed with me was not the bug. It was the discovery that the contract was never the problem โ the humans around it were. Trustless code still needed trusted stewards. Reading the KYA landscape now, I feel the same quiet unease, because the industry is again selling cryptography as a substitute for governance.
Context: what the trust layer actually is
KYA โ Know Your Agent โ is the authorization verification middleware of the agent economy. It sits between the agent and the payment rail, and its job is to prove not who the agent is, but what it is permitted to do, on whose behalf, and until when.
The timeline, as the source material states it, runs like this. Visa TAP arrived in October 2025 with RFC 9421 HTTP Message Signatures and Ed25519 keys, and a directory of agent public keys that Visa itself operates. TAP's distinctive move is a dual-signature tag that separates a browsing agent from a purchasing agent, backed by KYB/KYC onboarding and annual recertification, with six launch partners. Mastercard's Verifiable Intent, open-sourced in March 2026 with four signatories, uses SD-JWT and key-binding claims to express eight machine-verifiable constraints โ spending caps, merchant allowlists, budget ceilings, recurring terms โ in a protocol-agnostic envelope. Its Agentic Tokens wrap a 16-digit network token around a specific agent, merchant, and consent policy. Skyfire's KYAPay issues a three-layer JWT that names the human principal, the agent platform, and the agent itself, and it is the only open-standard route that explicitly settles in stablecoins; it carries an IETF draft. Google's AP2 signs Intent, Cart, and Payment mandates, covers cards, ACH, real-time payments, and Base-chain stablecoins, counts more than sixty partners, and was donated to the FIDO Alliance in April 2026.
A fifth scheme is named but not described โ plausibly Stripe's Agentic Commerce Protocol or Coinbase's x402. I will not pretend to know. What I will flag is the sourcing. Almost all of this comes from Visa, Mastercard, Google, and Skyfire's own materials, and the "ten trust-through-defaults incidents" are cited without a list. Marketing is not evidence. I read it as a map of intent, not a map of fact.
Core: the real question is not cryptography
Every primitive here is mature. Ed25519, SD-JWT, HTTP message signatures โ none of this is novel, and none of it is weak. The technical strength of all five schemes sits inside an acceptable band. So when people ask which protocol is "better," they are asking the wrong question.
The actual fault line is trust-root ownership and revocation. Who operates the key directory. Who bears the liability when a key is compromised. Who defines the semantics of a constraint and who can change them. Visa chose a self-operated directory โ centralized, but accountable, and therefore reviewable by a regulator and by a competitor's lawyer. Skyfire chose the IETF โ neutral, but slow. Google chose to donate AP2 to FIDO โ ceding control in exchange for adoption. Each is a different answer to the same political question, dressed as an engineering one. Governance is not a vote; it is a vigil, and here the vigil is kept over a key directory.
The genuine technical advance is elsewhere, and it deserves to be named precisely. Proof-of-authorization is replacing proof-of-identity, and the direction is correct. OAuth bearer tokens and SAML assertions share one flaw: possession equals passage. They cannot express "on whose behalf, within what scope, until what moment." KYA closes that gap with cryptographic binding at the moment of transaction plus explicit constraints. That is a real solution to a real wound, not a concept in new packaging.
But solving authorization verification is not solving agent security, and the industry is quietly conflating the two. The root cause of the trust-through-defaults incidents is always the same: a system trusts an assertion without verifying that the assertion's meaning matches its assumptions. That includes missing signature checks โ the easy, cryptographic half. It also includes semantic mismatch: a perfectly valid signature whose meaning was misread. The second half cannot be solved by cryptography. It is schema governance and semantic standardization, and it is where the next breach will live. The source material never separates these two layers. That omission is the most expensive sentence in the whole report.
Then there is the cost of coexistence. A single agent that wants to buy across merchants may need to satisfy several incompatible frameworks at once โ different directory models, key management, verification flows. For a security team this is a multiplicative burden, not an additive one. And the absorption happens in the middle. Adyen and Worldpay appear on both Visa's launch list and Mastercard's signed list, which tells you the PSP layer is being forced to become the shock absorber for protocol fragmentation. That cost does not disappear. It flows down to merchants and to the agent platforms, and eventually to the user, in fees and in friction.
Two things in the report are under-weighted. First, the edge. Cloudflare co-developed TAP; F5, Fastly, and Akamai are Skyfire partners. This is not coincidence โ TLS termination, HTTP header inspection, rate and behavior governance all happen at the edge, and agent traffic must pass through it. The edge is the natural enforcement point for agent identity, and it is the most underrated beneficiary in the entire stack: it serves multiple protocols at once, is immune to fragmentation, and carries none of the directory's regulatory liability. Second, the convergence nobody has named: Mastercard's eight constraint types are structurally isomorphic to on-chain session keys and scoped permissions of the ERC-4337 and ERC-7715 family. Both solve "bounded, revocable delegation." That isomorphism is a future interoperability interface between card-network authorization and on-chain delegation, and it is being built without either side admitting it.
I should also be honest about what this is not. None of these protocols has a native token. This is payment infrastructure, not an investable asset class, and forcing a tokenomics frame onto it would produce a lie. The value that does get captured flows to stablecoin issuers through reserve interest โ a rate-sensitive variable with nothing to do with agents โ to Base through sequencer revenue, to the card networks through interchange, and to directory operators through fees nobody has disclosed. Coinbase appears on both the TAP and AP2 partner lists. That is a deliberate double bet: whichever protocol wins, USDC and Base win. It is the cleanest protocol-agnostic exposure in the story.
And the story is structurally healthy, which is worth saying plainly. There is no Ponzi geometry here. Value comes from real fee savings and real fraud reduction, not from new entrants paying earlier ones. Compared with most crypto narratives, that is a genuine virtue. But I will not pretend the tailwind is proven: no agent payment volume data exists, so the chain from agent adoption to stablecoin settlement is still narrative. And Experian's presence on the KYAPay partner list tells you where agent trust will ultimately anchor โ in human credit data. An agent's authority will be partly inherited from a person's credit score. Technically feasible. Structurally at odds with data minimization, and with dignity.
Contrarian: fragmentation may be the moat, and verification may become the gate
Everyone in this report calls fragmentation a bug. I am not so sure. Fragmentation here may be the moat. Each card network needs its own directory precisely because the directory is where interchange is defended and where liability is assigned. A single universal standard would be efficient โ and it would strip the card networks of the one asset they cannot afford to lose: the authority to say yes or no to a machine. Note also that the camps are already split. Visa does not appear on AP2's sixty-partner list; Mastercard does not appear on TAP's. This is not an industry advancing together. It is two incumbents building parallel fences and calling it a standard.
Here is the harder question. The industry says the risk is that agents cannot be verified. I think the real risk is the opposite โ that verification becomes a permission gate. A self-operated key directory is a single point of failure and a single point of review. The same infrastructure that proves an agent is authorized can prove an agent is not, and the party holding that lever answers to shareholders, not to the agent's principal. No scheme in this set achieves trust minimization. Every one of them recentralizes trust into a card network, a foundation, or an edge provider. The trustless narrative is hollow here, and it is hollow in exactly the way I watched it go hollow in 2022, when I retreated to a quiet apartment in Hanoi and wrote the Trust Manifesto. We keep mistaking cryptographic guarantees for communal verification. We build bridges from the ashes of belief, and the belief we are burning now is that a signature is a substitute for a steward. Truth is the only immutable asset, and the truth here is that announcement density is high while landing data is zero. Standards published. Partners signed. Volume: unmeasured. Historically, that phase leads real adoption by twelve to twenty-four months.
Takeaway
The trust layer will be built. It is too useful not to be, and the wound it addresses โ machines spending human money without human meaning โ is real. The only open question is whether we build it as a gate or as a bridge. In 2026 I spent months refining zero-knowledge primitives for a Human-First Proof of Personhood, because I believe identity should be self-sovereign and privacy-preserving, and I learned there that the hard part was never the proof. It was making the proof legible to a non-expert. The same task now falls to KYA. The cryptography is ready. The governance is not. When your agent pays, who holds the keys to your intent โ and who holds the right to revoke it? That is not a technical question. It is the one we keep outsourcing, and it is the one the protocol must answer if it is to serve the human spirit.
