Know Your Agent (KYA): The Behavioral Trust Layer for AI Agents

AI agents now register, transact and negotiate on their own, and the question “can we trust this agent?” has become a daily operating problem. Know Your Agent, or KYA, is the discipline that answers it. This pillar guide explains what KYA is, why identity alone falls short, what a behavioral trust layer measures, what public data reveals about the agent economy and how teams can put KYA into practice.

For two decades, financial firms have relied on Know Your Customer, or KYC. KYC asks who a person is and whether the firm may serve them. The same question now applies to software. Agents hold wallets, sign transactions, buy goods and call services. Each of these acts carries risk, and each needs a decision: should this agent be allowed to do this?

KYA is the answer to that decision problem. It gathers evidence about an agent and its operator, turns the evidence into a risk view and sets limits for what the agent may do. A good KYA process works fast, runs without human effort for most cases and leaves a clear record for the cases that go wrong.

This guide serves as the hub for our series on the topic. It explains the core ideas and then points to detailed articles on identity, registries, funding chains, fraud patterns, card-network risk and checkout verification. Along the way, it uses public data from the ERC-8004 agent ecosystem to show what trust looks like at scale. It also marks limits clearly, because honest limits make a framework more useful.

What Is Know Your Agent (KYA)?

Know Your Agent is the process of deciding whether an AI agent may act and how far it may go. It combines identity, authorization and behavioral evidence into one risk decision. The word “agent” covers any autonomous or semi-autonomous software that acts on behalf of a person, a company or another agent.

The Core Question

Every KYA process tries to answer three linked questions.

1. Who is this agent? Identity evidence links the agent to an operator and a registry entry.
2. What is it allowed to do? Authorization evidence shows the scope that a user or system granted.
3. How likely is it to cause a loss? Behavioral evidence estimates risk from the operator’s history, funding and fleet links.

The first two questions have well-known tools. Registries, credentials, tokens and signed mandates handle them. The third question has fewer tools, and it decides most losses. KYA is incomplete without it.

KYA Compared With KYC

KYA borrows from KYC, yet it differs in important ways. The table below summarizes the contrast.

Dimension	KYC (people)	KYA (agents)
Subject	A natural person or company	A software agent and its operator
Identity cost	Documents and checks, costly to fake at scale	A registration or a wallet, cheap to create in bulk
Typical signals	Documents, address, device, behavior	Owner wallet, funding source, creator record, fleet links
Main abuse	Stolen or synthetic identities	Fleets of cheap agents, bad funders, drift
Update cycle	Periodic review	Continuous, because profiles change fast
Decision time	Minutes to days	Milliseconds to seconds

Two differences matter most. First, agent identities cost almost nothing to create, so identity checks filter very little. Second, agents act at machine speed, so the check must be automatic and continuous.

Why KYA Matters Now

Agents moved from demos to deployed systems quickly. Three forces make KYA urgent.

Agent Volume Is Growing

The ERC-8004 ecosystem offers a public window into this growth. By Week 41 of 2026, ChainAware’s index held 568,590 agents, up from 274,792 in the launch analysis. McKinsey has estimated that agent-mediated commerce could reach between $3 trillion and $5 trillion globally by 2030, and even a fraction of that figure implies a large volume of machine-initiated payments. ChainAware’s own coverage of the agentic economy also reports that a majority of new DeFi protocols now include an autonomous agent, a claim we flag as ours and not as an independent statistic.

Registration Is Cheap

An open registry lets anyone register an agent for the price of a transaction. That openness is a feature for builders and a gift for abusers. In the launch analysis, 51.8% of indexed agents sat in the Elevated Risk or Untrusted tiers, and 21.1% carried the farm flag. Cheap identities scale faster than trust.

Money Is Moving

Agents now handle payments, trades and treasury actions. OpenAI and Stripe launched the Agentic Commerce Protocol, and Google introduced AP2. Card networks run their own agent programs. Where money moves, fraud follows, and the cost of a weak trust decision rises with every new integration.

The Cost of Doing Nothing

Teams that skip KYA face two bad choices. They can accept all agent traffic and absorb fraud, promotion abuse and disputes. Alternatively, they can block all agent traffic and lose a growing channel. KYA offers a third path: allow good agents, limit uncertain ones and refuse bad ones, with evidence for each decision.

Identity Is Necessary but Not Sufficient

Most early KYA efforts focus on identity. That focus makes sense, because a merchant or protocol must first recognize an agent. Yet identity answers only one of the three questions.

What Identity Frameworks Offer

Several efforts build agent identity. Trulioo describes a Digital Agent Passport that carries an agent’s origin, legitimacy, authorization and consent, and its Know Your Agent explanation frames the concept for commerce. A report on Baselayer’s $35M Series A shows the capital flowing into agent identity platforms. On public chains, ERC-8004 defines identity, reputation and validation registries, and its specification is public.

These efforts deliver real value. They let counterparties recognize an agent, attach revocation and build audit trails. In addition, they also create a shared language for the industry.

Where Identity Stops

Identity proves that an agent is registered. It does not prove that the agent’s operator is honest. A registered agent can belong to a fleet of thousands. It can be funded by a wallet that also funded a rug pull. Its creator can have a record of honeypots. None of this appears in a registration entry.

Our analysis of KYA versus agent identity develops the point in detail. Its core message is simple: identity tells you who, and behavior tells you whether to trust. A system that stops at the first answer treats a well-documented fraud the same as a well-documented honest operator.

What a Registry Can and Cannot Tell You

ERC-8004 is a strong foundation. Its reputation registry lets clients publish feedback about agents, and its validation registry lets validators attest to results. The specification also protects against one simple abuse: an agent’s owner or approved operators cannot submit feedback for their own agent. Gaming therefore happens elsewhere, through Sybil wallets that submit friendly feedback or through fleets that appear independent.

The article on ERC-8004 trust signals walks through what each registry proves and where feedback can mislead. A registry records claims. Moreover, a trust layer evaluates the claimants.

The Four Evidence Groups

A behavioral trust layer collects evidence in four groups. Each group answers a different part of the risk question.

Group One: The Owner Wallet

The owner wallet controls the agent. Its history shows how the operator behaves on chain. Past interactions with fraud, mixers, scam contracts or sanctioned addresses raise risk. A long, clean history lowers it. ChainAware’s fraud models assign a fraud probability to the owner wallet, and the number feeds the agent’s score.

Group Two: The Feeder Address

The feeder is the address that funded the owner wallet. Funding chains reveal intent that a wallet’s own history may hide. A fresh wallet funded by a verified exchange looks different from a fresh wallet funded by an address tied to a rug pull.

The analysis of funding-chain risk explains why this signal matters. In the launch data, 741 agents were funded by confirmed rug pull operators, and the feeder was traceable for about 38% of indexed agents. Where the feeder could not be traced, the FEEDER_UNKNOWN flag applies.

Group Three: The Creator Record

The creator wrote or deployed the agent. A creator with a history of rug pulls or honeypots poses a risk to everyone who interacts with the agent. This evidence is rare but severe. In the launch analysis, the CREATOR_RUG_HISTORY flag appeared on a tiny fraction of agents, 0.02%, and each case deserves attention.

Group Four: Fleet Detection

Fleets are groups of linked agents under one operator. They arise because registration is cheap. Fleet detection looks for shared owners, shared funders and shared patterns. In the launch data, 21.1% of agents carried the FARM_DETECTED flag. Fleets matter because they distort reputation, inflate activity and exploit incentives.

Why Four Groups Beat One

Any single group can mislead. A clean owner wallet may hide a dirty feeder. Furthermore, a clean feeder may fund a farm. A clean farm member may have a creator with a bad record. Combining the four groups raises the cost of evasion, because an attacker must clean up every layer.

The ChainAware Agent Trust Score

ChainAware’s Agent Trust Score turns the four evidence groups into a single number and a set of flags. It rates ERC-8004 agents from 0 to 1,000 and groups them into five tiers.

Tier	Score range	Meaning	Share at launch
Sovereign	800-1000	Strong, clean evidence across groups	20.9%
Trusted	600-799	Mostly clean, minor concerns	12.7%
Provisional	400-599	Mixed or thin evidence	14.6%
Elevated Risk	200-399	Material risk signals	25.8%
Untrusted	0-199	Severe risk signals	26.0%

How the Score Is Delivered

The score is free for public indexed agents, with 1,000 queries per month and no signup. A web interface lets anyone look up an agent. Software can call the score through an API or through the Prediction MCP, so that agents and backends can check a counterparty before they act. The score covers Ethereum, BNB Smart Chain, Base and Avalanche C-Chain, and Mantle support is in progress.

Our launch article on the Agent Trust Score lists the full breakdown, and the piece on why trust comes first in agentic commerce explains the strategic case.

Named Flags

Flags give plain reasons for each score. The main ones are FARM_DETECTED, FEEDER_UNKNOWN, EIP7702_DELEGATED, FEEDER_CEX_VERIFIED, FEEDER_RUG_HISTORY and CREATOR_RUG_HISTORY. Teams can set rules by flag, for example stricter limits for unknown feeders or automatic review for rug pull history.

What the Public Data Shows

Public data lets anyone test claims about agent trust. ChainAware indexes the ERC-8004 ecosystem and publishes weekly tracker reports. Together, the launch analysis and the tracker series form one of the larger public views of agent behavior.

The Launch Analysis

The launch analysis covered 274,792 ERC-8004 agents. Its headline numbers are stark.

• 51.8% of agents sat in the Elevated Risk or Untrusted tiers.
• 21.1% carried the FARM_DETECTED flag.
• 9.5% carried the FEEDER_UNKNOWN flag.
• 7.6% carried the EIP7702_DELEGATED flag.
• 1.0% carried the FEEDER_CEX_VERIFIED flag, a positive signal.
• 0.3% carried the FEEDER_RUG_HISTORY flag.
• 0.02% carried the CREATOR_RUG_HISTORY flag.
• 741 agents were funded by confirmed rug pull operators.

The numbers show a registry where trust is the exception and not the rule. Only about a third of agents reached the top two tiers. Registration, in other words, did not guarantee quality.

The Weekly Tracker

The weekly ERC-8004 Agent Trust Tracker follows registrations, owners, median trust and flag shares week by week. Several data points stand out.

Week	Observation
Week 31	Agents per owner reached 2.54, showing how many agents each operator ran
Week 34	Registrations hit a record 31,979
Week 36	Median trust of new agents reached a record 918, the first time in the Sovereign tier
Week 38	Agents per owner fell to 2.30
Week 40	6,893 registrations, median trust back at 200, 518,885 agents indexed
Week 41	10,706 registrations from 7,435 owners, median trust 101, 568,590 agents indexed

The Week 36 tracker and the Week 40 tracker show how quickly the picture can shift in a few weeks.

What the Swings Teach

Quality does not move steadily. A record median of 918 in Week 36 gave way to a median of 101 in Week 41, the lowest since Week 5. By contrast, a policy tuned to one week’s average can fail in the next. KYA must therefore refresh and respond to change, not issue a one-time verdict.

Farms Persist

The farm-detected share stayed in a narrow range across several weeks: 18.73% in Week 32, 18.39% in Week 33 and 17.05% in Week 34. By Week 40 it stood at 16.12%. Defenders do not remove fleets by naming them once, and operators adapt. For a deeper reading of these series, see our study of agent fraud patterns from the ERC-8004 tracker.

Technology Shifts

The count of EIP-7702 delegated accounts rose about 33.8% between Week 35 and Week 40. New account mechanics change what signals exist and how attackers hide. KYA models must follow these shifts, which is another reason continuous updates matter. In Week 41, FEEDER_UNKNOWN reached 12.84%, and Base added 37,037 agents, showing how activity moves across chains.

The KYA Series: What Each Article Covers

This pillar sits at the center of a series. Each article takes one topic in depth. The summaries below show how the pieces fit together.

KYA vs Agent Identity

This article separates identity from trust. It explains what passports, registries and credentials prove, shows where they stop and describes how behavioral evidence completes the picture. Read it first if your team treats identity as the whole of KYA.

ERC-8004 Trust Signals

This article examines the three ERC-8004 registries. It clarifies what feedback signals mean, how Sybil wallets can inflate them and why an external trust layer adds value.

Funding-Chain Risk

This article follows the money. It shows how the feeder address reveals intent, how the 741 rug-pull-funded agents surfaced and why FEEDER_UNKNOWN deserves caution.

Agent Fraud Patterns From the Tracker

This article reads the weekly series as a fraud dataset. It covers farms, registration waves, delegation shifts and the swings in median trust.

Agentic Commerce Fraud and the Four-Party Model

This article applies KYA to card payments. It explains how agents strain the issuer, acquirer, merchant and network roles, and which new fraud scenarios follow.

Verifying AI Agents at Checkout

This article turns the ideas into a checkout design with three layers: credentials and tokens, mandates and behavioral evidence.

The Wider Landscape of Agent Trust

KYA does not exist in a vacuum. Several communities work on parts of the problem, and the picture changes quickly.

Identity and Credential Vendors

Identity vendors focus on recognition and attestation. They issue passports, verify operators and maintain registries. Their strength is a clean answer to “who is this?” Their limit is that identity rarely predicts behavior.

Payment Protocols and Networks

OpenAI and Stripe’s Agentic Commerce Protocol gives agents a shared payment token. Payments Journal covered the launch. Google’s AP2 uses signed mandates, and its announcement describes intent, cart and payment mandates. Card networks run programs of their own, and a report on the Visa and OpenAI partnership shows how networks and AI firms move together. A liability analysis at FinTech Wrap Up argues that agents remove traditional fraud signals and that the merchant of record may carry much of the risk. That piece is opinion, and liability rules are still developing.

Behavioral and On-Chain Intelligence

Behavioral providers score wallets, funders and fleets. ChainAware works in this layer. The review of the agent trust infrastructure race compares how different providers approach agent trust, and the guide to Web3 trust verification systems maps the wider field.

How the Pieces Combine

Identity answers who. Payment protocols answer how to pay and what was allowed. Behavioral intelligence answers whether to trust. A mature KYA stack uses all three, and the weakest layer usually decides the losses.

A Practical KYA Framework

Teams can adopt KYA step by step. The five-step framework below suits protocols, marketplaces, payment firms and platforms.

Step One: Inventory Agent Touchpoints

List every place where an agent can act on your system: registration, API calls, payments, trades, listings, votes and claims. Each touchpoint needs a decision rule. Many teams discover touchpoints they had not planned for, so the inventory itself pays off.

Step Two: Define What Agents May Do

Write down allowed actions, limits and conditions. Separate low-risk actions, such as reading public data, from high-risk actions, such as moving funds. Low-risk actions may need only a registration check. High-risk actions deserve the full stack.

Step Three: Gather the Three Layers of Evidence

Collect identity evidence (registry entries, credentials), authorization evidence (mandates, tokens, scopes) and behavioral evidence (owner, feeder, creator, fleet). Normalize the outputs so that the policy engine can read them. The free tier of the Agent Trust Score makes the behavioral piece easy to test.

Step Four: Map Evidence to Decisions

Turn evidence into rules. Start with tiers and flags, then add product-specific rules. The table below shows an example for a platform that handles payments.

Operator tier	Suggested treatment
Sovereign	Full access, light monitoring
Trusted	Full access with periodic review
Provisional	Reduced limits, step-up for large actions
Elevated Risk	Small limits, human confirmation for most actions
Untrusted	No access to high-risk actions

Flags adjust the defaults. Rug pull history on a feeder or a creator should lead to the strongest response. An unknown feeder should lead to lower limits and closer monitoring. A farm flag should trigger operator-level aggregation.

Step Five: Monitor, Store and Improve

Re-score agents on a schedule. Store the evidence and the decision for every action. Track approval, dispute and incident rates by tier. Adjust thresholds with data. A KYA process that stays static falls behind, as the tracker swings show.

KYA by Role

Different teams use KYA differently. The sections below describe the needs of each.

Protocols and DApps

Protocols that accept agent interactions face fleets, sybil attacks and incentive farming. Screening wallets before they interact beats simulating transactions alone. The guide to Web3 fraud detection for DApps explains the approach, and the overview of Web3 Sybil protection systems covers fleet defenses. Compliance-minded teams can consult the compliance guide for DeFi.

Agent Marketplaces and Directories

Marketplaces list agents for users to hire or call. A directory that lists every registered agent without a trust view exposes users to farms and fraud. Showing tiers and flags next to each listing helps users choose and rewards honest operators.

Payment Providers, Acquirers and Merchants

Payments teams carry the visible liability. They need credentials, mandates and a behavioral tier for every agent purchase, plus an evidence store for disputes. Our articles on agentic commerce fraud and checkout verification give detailed designs.

Exchanges and Regulated Platforms

Regulated firms add sanctions and anti-money-laundering duties. The Financial Action Task Force publishes guidance on virtual assets, and the U.S. Treasury maintains the OFAC sanctions list service. These duties apply whether a person or an agent initiates a transfer. Tools such as ChainAware Investigation produce a structured wallet report in about a minute, and the page on autonomous compliance screening shows how screening and agents work together.

Investors and Allocators

Investors who delegate capital to trading agents need to know who stands behind them. The guide on how investors should evaluate AI trading agents shows how behavioral evidence supports due diligence. Funding chains and creator records matter most when capital is at stake.

Growth and Acquisition Teams

Growth teams use agents to reach users, while attackers use agents to farm incentives. Behavioral scoring separates real users and honest agents from farms. The page on Web3 user acquisition shows how behavioral data supports targeting.

Agent Builders and Operators

Builders face verification from the other side. A well-run operator benefits from a clean record, because it earns higher limits and smoother access. Practical steps include funding from transparent sources, avoiding mass registration, keeping mandates narrow and checking your own score before others do.

How KYA Works in Four Short Scenarios

The scenarios below are invented to illustrate reasoning. They do not describe real incidents.

Scenario One: The Lending Protocol

A lending protocol lets agents borrow against collateral. Moreover, a new agent arrives with a valid registration. KYA finds that the owner wallet is clean but funded by an unknown source, and that the agent belongs to a farm of dozens of linked agents. The protocol assigns a low tier, caps the loan size and aggregates exposure across the farm. A naive system would have treated each agent as independent and allowed the full loan size many times over.

Scenario Two: The Agent Marketplace

A marketplace lists a research agent that claims strong performance. Feedback entries look positive. KYA reveals that most feedback comes from newly created wallets that share a funder with the agent’s owner. The marketplace flags the listing and shows the tier next to the reviews. Users see the context and choose accordingly.

Scenario Three: The Online Store

An online store accepts agent checkout. Furthermore, an agent buys ten gift cards under a valid mandate. The operator holds the Elevated Risk tier and carries the FEEDER_UNKNOWN flag. Likewise, the store applies a small limit for the tier, asks the user to confirm and avoids a likely chargeback.

Scenario Four: The Treasury Agent

A DAO considers handing a treasury task to an agent. Due diligence checks the creator record, the funding chain and the fleet links. The creator shows a prior rug pull. Beyond that, the DAO declines and picks another agent. The check took minutes and prevented a major loss.

What the Scenarios Share

In each scenario, identity and authorization were in order, and behavioral evidence made the difference. That pattern recurs across the series, and it explains why KYA needs the third layer.

Why Behavioral Signals Work

Behavioral signals work because they are costly to fake at scale. A passport can be forged once and used a thousand times. By contrast, a clean funding history cannot be forged cheaply, because it requires real transactions with real counterparties over time. Therefore, behavior carries information that identity cannot.

The Economics of Evasion

Attackers respond to costs. When registration costs a few cents, attackers register thousands of agents. Moreover, when a clean history costs weeks of activity and real funds, attackers must choose between speed and credibility. A good trust layer raises the cost of credibility without raising the cost for honest operators. In other words, honest operators already hold the evidence that a trust layer reads.

Why Funding Chains Matter

Money leaves a trail. An owner wallet that received its first funds from a verified exchange tells a different story from one funded by a mixer or a flagged address. Funders rarely change, because operators tend to reuse the same sources. As a result, a bad funder links many agents at once and exposes whole fleets with one finding.

Why Fleets Matter

Fleets distort every metric that teams rely on. Activity counts inflate, reputation scores skew and incentive programs leak value. Fleet detection also protects honest operators, because it stops farms from drowning out genuine agents. In the launch data, more than one in five agents showed farm signals, so ignoring fleets means ignoring a large part of the ecosystem.

Why Creator History Matters

Creators repeat behavior. A creator who deployed a honeypot or ran a rug pull once is more likely to do it again than a creator with a clean record. This signal is rare, and its rarity makes it powerful. When it appears, teams should treat it as a strong reason to refuse high-risk access.

Why Continuous Scoring Matters

Profiles change. Funding sources shift, ownership changes and fleets grow. The weekly tracker shows how fast the aggregate picture moves, with the median trust of new agents ranging from 918 in Week 36 to 101 in Week 41. A score computed once and cached for months would miss these shifts, so serious deployments refresh scores on a schedule.

Ten Agent Risk Patterns and How KYA Responds

Teams that understand the patterns can design better rules. The list below covers ten patterns that appear across agent ecosystems, along with a defensive idea for each.

1. The Registration Flood

An operator registers thousands of agents in a short window. The goal may be to farm incentives or to bury honest agents in noise. Fleet detection and operator-level limits respond best.

2. The Clean Front

A new agent shows a spotless owner wallet created for the purpose. Funding-chain analysis reveals the dirty source behind it. The feeder flag and the tier respond.

3. The Borrowed Reputation

An agent collects positive feedback from linked wallets. The registry shows a good score, but the feedback comes from Sybil wallets. An external trust layer evaluates the reviewers and discounts the feedback.

4. The Patient Build

An attacker runs a quiet agent for months, then abuses it. Scheduled re-scoring and drift monitoring shorten the window.

5. The Creator Recycle

A creator with a bad record deploys a new agent under a fresh wallet. Creator-level evidence links the new agent to the old record when the link exists on chain.

6. The Delegation Shell

An owner account delegates execution through EIP-7702 to hide the real actor. The EIP7702_DELEGATED flag prompts closer review, since legitimate uses also exist.

7. The Cross-Chain Hop

An operator moves activity across chains to escape history. Multi-chain coverage and wallet-level screening reduce the blind spot.

8. The Fleet Split

An operator splits a large action across many agents to stay under per-agent limits. Operator-level aggregation closes the loophole.

9. The Compromised Agent

A weak agent falls to a hostile prompt or a stolen key. Behavior suddenly changes, and anomaly rules and step-ups limit the damage.

10. The Mandate Stretch

An agent acts inside a valid but overly broad mandate. Narrow mandates, tier-based limits and confirmation prompts help.

Patterns Share a Cause

All ten patterns exploit one fact: identities are cheap and evidence about operators is hard to see without a trust layer. KYA’s job is to make that evidence visible and actionable.

Walkthrough: Auditing One Agent Step by Step

A concrete walkthrough shows how the pieces fit. The example is generic and uses no real agent.

Step One: Find the Agent

Start with the agent’s identifier or its owner wallet. The free Agent Trust Score interface accepts the lookup, and the API accepts the same inputs for automated flows. Confirm the chain, since the same operator may run agents on several networks.

Step Two: Read the Tier

The tier gives the first impression. A Sovereign or Trusted result suggests clean evidence across the four groups. In addition, a Provisional result suggests thin or mixed evidence, which is common for new agents. An Elevated Risk or Untrusted result suggests material risk signals. At this point, the decision is not final, because flags may change the picture.

Step Three: Read the Flags

Flags explain the tier. For example, FEEDER_UNKNOWN tells you that the funding source could not be traced. In addition, FARM_DETECTED tells you that the agent appears to belong to a group of linked agents. By contrast, FEEDER_CEX_VERIFIED tells you that a verified exchange funded the owner, which supports a more positive view. Rug pull flags deserve a strong response.

Step Four: Look at the Context

Context matters. A treasury action of large size needs more evidence than a small read-only request. Likewise, a flagged agent that asks for low-risk access can proceed with limits, while the same agent asking to move funds may need a decline. Match the response to the action.

Step Five: Decide and Record

Choose a response: approve, limit, step up or decline. Record the tier, the flags, the action and the reason with a timestamp. As a result, you can explain the decision later to the operator, an auditor or a dispute team.

Step Six: Schedule the Next Check

Set a re-check date. Low tiers deserve shorter intervals, and high tiers can wait longer. Moreover, set an event-based trigger for large changes, such as a new funder or a jump in fleet size.

Going Deeper When Needed

Some cases justify a deeper review. For example, a large counterparty, a compliance-sensitive transfer or an unexplained flag may call for a full wallet investigation. ChainAware Investigation turns a wallet address into a structured report, and the article on investigation reports and wallet forensics shows what the output looks like. Furthermore, the comparison of forensic and AI-based crypto analytics explains when each approach fits.

Four Approaches to Agent Trust Compared

Teams often combine approaches, but each has strengths and limits. The table below compares four common ones.

Approach	Main strength	Main limit
Allowlists and blocklists	Simple and fast	Age quickly, miss new identities
Identity and credentials	Clear answer to who an agent is	Cheap to create, silent on intent
Registry reputation	Public and open	Feedback can be gamed by Sybil wallets
Behavioral trust scoring	Judges operators, funding and fleets	Probability, not proof, and chain coverage limits

Combining the Approaches

No approach wins alone. Allowlists reward known partners with a smooth path. Blocklists stop known bad actors at once. Identity and credentials let you recognize agents and attach revocation. Registry reputation adds community signals. Behavioral scoring covers the large middle, where most new agents sit. In practice, a layered design uses all four and weighs them by action risk.

Why Behavioral Scoring Fills the Gap

New agents appear faster than humans can review them. Allowlists cannot include them yet, and blocklists have not caught them yet. Behavioral scoring evaluates them on arrival, using the history and funding that already exist on chain. For that reason, behavioral scoring is the layer that scales with open registration.

A Detailed Playbook for Tier-Based Policy

Tiers give teams a shared language. The sections below describe how to design a policy around them.

Sovereign (800-1000)

Sovereign agents show strong, clean evidence. Treat them as preferred counterparties. Offer standard or higher limits, skip routine step-ups and monitor lightly. Even so, keep the re-scoring schedule, because a change in funding or fleet links can lower a tier quickly.

Trusted (600-799)

Trusted agents show mostly clean evidence with minor concerns. Offer standard limits and review them periodically. If a flag appears, check which one, and decide whether to adjust limits.

Provisional (400-599)

Provisional agents show mixed or thin evidence. This tier includes many honest newcomers. Offer lower limits that rise with clean behavior, and ask for confirmation above a threshold. Fairness matters here: a path to a higher tier keeps good operators engaged.

Elevated Risk (200-399)

Elevated Risk agents show material risk signals. Offer small limits, require human confirmation for most meaningful actions and monitor closely. For high-resale goods or irreversible transfers, a decline is often the right default.

Untrusted (0-199)

Untrusted agents show severe risk signals. Decline high-risk actions. Allow low-risk read-only access if your system needs it, and log the attempts. Repeated attempts may justify a block.

Using Flags as Modifiers

Flags adjust tier-based defaults. The matrix below shows common adjustments.

Flag	Common adjustment
FARM_DETECTED	Aggregate limits across the fleet
FEEDER_UNKNOWN	Lower limits, closer monitoring
EIP7702_DELEGATED	Review the context before changing limits
FEEDER_CEX_VERIFIED	Positive signal, supports faster limit growth
FEEDER_RUG_HISTORY	Strong response, often decline
CREATOR_RUG_HISTORY	Strong response, often decline

Handling Disputes About Scores

Operators sometimes challenge a decision. A fair process includes an appeal route, a re-check of the evidence and a documented outcome. Appeals also act as a quality loop, since they reveal cases where the model or the policy needs work.

Integration Patterns

Teams integrate KYA in several ways. The pattern depends on volume, latency needs and stack.

Direct Lookup

A service calls the score for a single agent when needed. It suits low volume and simple flows. Direct lookups give the freshest result, but they add latency to each action.

Batch and Cache

A background job scores many agents on a schedule and stores results locally. Real-time decisions read from the store. This pattern suits high volume. It also supports analytics, since the store holds a history of tiers.

Agent-Native Access

Agents themselves can query trust before they transact. The Prediction MCP exposes ChainAware’s tools to AI agents, so that an agent can check a counterparty as part of its own reasoning. Furthermore, the article on Prediction MCP for AI agents explains how this works. In practice, an agent that checks a counterparty before paying behaves more safely than one that does not.

Wallet Screening Alongside Agent Scoring

Many teams already screen wallets for fraud, rug pull risk and compliance. The fraud detection API supports wallet-level checks, and the guides to rug pull detection tools and wallet auditing providers compare options. Agent scoring adds the agent layer on top of these checks.

Designing for Failure

Plan for lookup failures. A safe default is a lower limit plus a step-up, not full approval or full block. Log every fallback. Set a latency budget and monitor lookup error rates, because a control that silently fails is worse than none.

Metrics That Show KYA Works

A KYA program deserves measurement. Likewise, a small set of indicators keeps it honest.

Metric	What it shows
Share of traffic by tier	The risk mix of your agent population
Approval rate by tier	Whether higher tiers pass more easily
Incident and dispute rate by tier	Whether lower tiers cost more
Step-up rate	Friction for good agents
Fleet detections	How many linked groups the program finds
Time to decision	Impact on user experience
Evidence completeness	Readiness for disputes and audits
Appeal outcomes	Model and policy quality

If incident rates do not rise as tiers fall, thresholds need work. Beyond that, if step-up rates climb, the policy may be too strict. If fleet detections drop to zero for weeks, check that the detection still works.

Testing Policies Before Launch

Replay past agent activity against a new policy. Count how many actions the policy would have approved, limited or declined, then compare with real incidents. This test costs little and prevents painful surprises.

Building Your Internal KYA Capability

Organizations that treat KYA as a standing capability get better results than those that treat it as a one-off project.

Who Owns KYA?

Ownership depends on the organization. In a protocol, security or risk teams usually lead. Moreover, in a payments firm, fraud and payments engineering share the work. In a marketplace, trust and safety often leads. Whoever owns it needs authority across teams, because KYA touches product, engineering, legal and support.

Skills to Build

The core skills are policy design, data analysis, integration engineering and incident response. Policy design turns evidence into rules. Data analysis tunes thresholds and tracks metrics. Integration engineering keeps the stack reliable. Incident response handles disputes and attacks. Small teams can cover these skills with a few people, as long as someone owns each.

Tools to Assemble

A practical toolkit includes a trust score source, a verifier for credentials and mandates, a policy engine, an evidence store and a dashboard. Teams can start with spreadsheets and scripts. Later, they can move to dedicated services as volume grows. Throughout, modular interfaces keep options open.

Rituals That Keep It Alive

A short monthly meeting reviews the dashboard, the largest overrides and one lesson from a recent incident. Furthermore, a quarterly review revisits tiers, limits and flags. An annual exercise tests the stack against a simulated attack. These rituals cost little and keep the program sharp.

Evaluating KYA Providers

Providers differ widely. A short evaluation list helps buyers compare them.

1. Scope. What exactly does the product verify, and on which chains or rails?
2. Handling of newcomers. New identities: are they scored on behavior, or only after reports?
3. Fleet detection. Linked agents: does it connect them, or only score them one by one?
4. Freshness. How often does it refresh, and can you trigger a re-check?
5. Explainability. Explanations: are there tiers and named flags, or only a number?
6. Access. Does the vendor offer a free tier, an API and agent-native access such as an MCP server?
7. Limits. Limits: does it say plainly what it does not cover?
8. Privacy. Is there data minimization and a clear retention rule?
9. Evidence. Published data, such as weekly trackers, lets you check the claims.

ChainAware answers these questions in public. It publishes the launch analysis and the weekly tracker, offers a free tier and states its coverage limits. You can inspect the evidence before you buy anything.

KYA Across the Agent Lifecycle

Agents move through stages, and KYA applies at each one.

Registration

At registration, the registry records the agent. KYA can score the owner, feeder and creator on arrival, so that directories and marketplaces display trust signals from the first day.

Onboarding

When an agent connects to a service, the service decides its access. KYA sets initial limits by tier and flags. Fair paths let honest newcomers grow.

Operation

During operation, the agent acts and the service observes. KYA monitors behavior, aggregates activity by operator and re-scores on schedule. Drift and fleet growth appear in this stage.

Incident

When something goes wrong, KYA supplies evidence. Stored scores, flags and decisions show what the team knew when it acted. As a result, disputes resolve faster, and lessons feed back into policy.

Offboarding

When an agent leaves or an operator changes, KYA closes the loop. Credentials are revoked, limits are removed and records are retained for the required period. Clean offboarding prevents stale access from becoming a hidden risk.

Governance, Privacy and Fairness

KYA touches sensitive questions. Teams that plan for them early avoid costly reversals later.

Data Minimization

Collect the evidence that supports a decision and avoid collecting more. Wallet addresses and agent identifiers are pseudonymous, yet linked data can reveal patterns about people. Document what you collect, why you collect it and how long you keep it.

Explainable Decisions

Operators deserve a plain reason for each limit or decline. Tiers and named flags make explanations easy. In contrast, a black-box number without reasons weakens support, appeals and dispute defense. Explainability also helps internal teams debug policies.

Fair Paths for Newcomers

Every honest operator starts with a thin history. A policy that treats all young agents as dangerous punishes newcomers and slows the ecosystem. Offer lower initial limits that rise with clean behavior. Moreover, publish what operators can do to improve their tier, such as funding from transparent sources and avoiding mass registration.

Human Oversight

Automated decisions need human review. Sample decisions each month, review the largest overrides and keep an appeal route open. Human oversight catches model errors, and it builds trust with operators.

Change Control

Track changes to thresholds, models and rules. A change log explains shifts in approval and incident rates, and it helps audits. Without one, teams cannot tell whether a movement came from policy or from the environment.

Working With Legal and Compliance

Legal and compliance teams should review liability maps, retention rules and customer notices. In regulated sectors, they should also confirm how sanctions and AML duties apply to agent flows. The Financial Action Task Force guidance on virtual assets and the OFAC sanctions list service provide starting points. Liability for agent-initiated payments remains unsettled, and analysts differ on who should carry it, so teams should verify their own position with counsel.

Honest Limits of KYA

A trustworthy framework states what it cannot do. Several limits apply today.

Coverage. The Agent Trust Score covers on-chain ERC-8004 agents and their wallets, on Ethereum, BNB Smart Chain, Base and Avalanche C-Chain, with Mantle in progress. Agents that never touch a public chain need other behavioral sources, and closed ecosystems hold their own data.

Probability, not proof. A tier estimates risk. It cannot prove intent. Honest operators can land in lower tiers, and sophisticated attackers can sometimes reach higher ones. Teams should treat the score as one input into a policy and not as a verdict.

Funding visibility. The feeder was traceable for about 38% of indexed agents at the time of analysis. For the rest, the FEEDER_UNKNOWN flag applies. Missing evidence is itself a signal, but it is a weaker one than a confirmed bad funder.

Fast-moving targets. Attackers adapt, standards shift and new account mechanics change the signals. Models and policies need regular updates.

Intent in the user’s head. No layer proves what a user truly wanted. Mandates and confirmations come closest, and some disputes will remain.

Liability rules. Networks, regulators and courts are still working out who bears the loss in several agent flows.

Why Stating Limits Helps

Clear limits help teams design around them. A merchant that knows the score covers only on-chain agents will add card-ecosystem data for card-only agents. In addition, a compliance team that knows the score is a probability will keep a human in the loop for sensitive cases.

Common Mistakes in KYA Programs

Teams repeat a small set of mistakes. Knowing them in advance saves months.

1. Treating identity as trust. A registered agent is not necessarily a safe agent.
2. Scoring agents one at a time. Fleets hide in operator-level patterns.
3. Checking once. Profiles change, so scores need refresh cycles.
4. Ignoring the funding chain. Clean wallets can hide dirty sources.
5. Trusting registry feedback blindly. Sybil wallets can inflate it.
6. Blocking all agents. A blanket ban gives up a growing channel.
7. Approving all agents. Open acceptance invites cheap fleets.
8. Skipping evidence storage. Disputes then turn into guesswork.
9. Using vague confirmations. Users who see unclear prompts click through.
10. Ignoring fallbacks. A failed lookup needs a defined outcome.
11. Overreacting to single flags. A flag is a prompt to look closer, not a verdict.
12. Waiting for final standards. Standards arrive slowly, and agent traffic is here now.

Myths About Agent Trust

Myths slow adoption. Four deserve a direct answer.

Myth: “Agents Are Just Bots”

Bots follow fixed scripts, and agents reason and adapt. This difference matters for fraud, because agents can change tactics mid-attack. Bot defenses based on fixed signatures miss adaptive behavior.

Myth: “A Good Reputation Score Settles It”

Reputation systems record feedback. Feedback can be gamed by Sybil wallets and fleets. A trust layer evaluates the sources of feedback and the operator behind the agent, not just the numbers.

Myth: “Only Big Players Need KYA”

Small protocols and merchants face the same fleets and farms as large ones. Free tools and simple tier tables let small teams start.

Myth: “KYA Will Slow Everything Down”

Well-designed KYA runs in milliseconds for most cases and adds friction only for risky ones. Honest agents in higher tiers often move faster than before, since they earn higher limits and fewer step-ups.

Why Open Registries Need an External Trust Layer

Open registries bring real benefits. They let builders publish agents without permission, and they create a shared namespace. However, openness also means that the registry cannot judge quality on its own. A registry stores claims, and anyone can make claims.

The Registry Cannot Be Its Own Judge

A registry that tried to judge operators would need to take on gatekeeping, which defeats its purpose. Instead, the registry stays neutral, and other parties build judgment on top. Directories, marketplaces, protocols and merchants each add their own views. An external trust layer supplies common evidence so that each party does not need to rebuild the same analysis.

Shared Evidence, Local Decisions

A good trust layer separates evidence from decisions. The evidence, such as tiers, flags and funding links, is shared. In addition, the decisions, such as limits and responses, stay local. A lending protocol and an online store can read the same tier and apply different rules. In this way, the layer serves many uses without forcing one policy on everyone.

Neutral Data Builds Confidence

Neutral, published data builds confidence. When a provider publishes its analysis and its weekly trackers, outsiders can check the numbers and challenge the method. Public scrutiny improves the models, and it protects honest operators from unfair labels. For that reason, transparency is part of the product and not an extra.

Industry Snapshots

Different industries feel agent risk in different ways. The snapshots below summarize typical needs. They are illustrative and do not describe specific firms.

Decentralized Finance

DeFi protocols face farms, Sybil attacks and incentive abuse. They need fast wallet and agent screening, operator-level limits and clear policies for automated actors. Many also need compliance views for sanctioned addresses. Funds move without chargebacks, so prevention matters more than dispute.

E-Commerce and Retail

Online retailers face promotion abuse, resale fraud and disputes. They need credential checks, mandate checks and tier-based limits for agent checkout. Moreover, they also need evidence for chargebacks. Because margins are thin, even small leaks add up quickly.

Travel and Ticketing

Travel sellers face fast, high-value bookings with tight time windows. They need live confirmation for large bookings and strong credentials for agents that search at machine speed. Reliable logs help during disputes.

Software and Subscriptions

Software firms face trial abuse, license resale and renewal disputes. They need operator-level limits on trials, standing mandates for renewals and alerts for price changes.

Gaming and Digital Goods

Game studios and digital marketplaces face farming, account resale and bot economies. Agents can amplify all three. Fleet detection and tier-based eligibility for rewards protect honest players and keep in-game economies healthy.

Financial Services

Banks, exchanges and payment firms carry the heaviest compliance load. They need credentials, mandates, behavioral scores and sanctions screening, with audit trails for supervisors. The extra work protects licenses and customers.

Research and Data Services

Data providers and API platforms face scraping fleets and quota abuse. Agent-level credentials plus operator-level limits keep service quality high for honest users. Behavioral tiers help decide who receives priority access.

What the Snapshots Show

Every industry needs the same three layers, but each weights them differently. Funds that cannot be reversed lean on prevention. Industries with disputes lean on evidence. Regulated sectors lean on audit trails. KYA flexes to fit each case because it separates evidence from decisions.

Where KYA Is Heading

Several trends will shape the next two to three years.

Trend One: Trust Becomes Machine-Readable

Agents will check agents. When one agent considers paying another, it will query a trust layer first. Machine-readable trust, delivered through APIs and MCP tools, will become part of the standard agent toolkit. The overview of the Web3 agentic economy explains why this shift is underway.

Trend Two: Standards Converge

Credential formats, mandate formats and payment protocols will narrow over time. Thin adapter layers will bridge the gap while the field settles. Teams that keep modular interfaces will adapt more easily.

Trend Three: Liability Rules Firm Up

Networks, regulators and courts will clarify who bears the loss in agent-initiated transactions. Until then, teams should plan for the merchant of record to carry much of the risk, and they should store evidence that supports a defense.

Trend Four: Fleets Get Subtler

Operators will spread activity across more agents, more funders and more chains. Detection will move from single-agent signals toward operator-level and graph-level patterns. The persistence of farms in the tracker data suggests that this arms race will continue.

Trend Five: Behavioral Evidence Joins the Standard Stack

Credentials prove who, mandates prove what was allowed, and behavioral evidence estimates risk. Risk teams will treat the three as one stack, much as they treat tokens, authentication and risk scoring in card flows today.

Trend Six: Multi-Chain and Cross-Rail Coverage

Agents will use several chains and several payment rails. Trust layers will expand coverage and connect on-chain and card-based evidence. For now, each ecosystem needs its own behavioral data, and the design principle, judge the operator and its funding and fleet, carries across.

A 90-Day KYA Roadmap

Teams can move from nothing to a working program in three months.

Days 1 to 30: Discover and Baseline

Inventory agent touchpoints. Tag agent traffic in logs. Look up a sample of your agents and counterparties in the free Agent Trust Score, and record the tier mix. Read network, acquirer and regulatory guidance relevant to your sector.

Days 31 to 60: Design and Pilot

Write a one-page policy with limits by tier and responses by flag. Pilot the policy in monitor-only mode on live traffic. Compare what it would have done with what actually happened, and refine thresholds.

Days 61 to 90: Enforce and Operate

Turn the policy on for new agent activity. Start storing evidence for every decision. Launch the metrics dashboard and schedule monthly reviews. Name an owner for escalations and appeals.

After Day 90

Review quarterly. Add new chains and data sources as they become available. Share findings with partners, since shared learning raises the standard for everyone.

Questions Boards and Regulators Will Ask

Senior leaders and supervisors will ask about agent risk soon. A prepared team can answer five questions with evidence.

1. How much of our activity comes from agents? Channel tags and dashboards give the number.
2. What do agents cost us in losses and disputes? Incident data by tier gives the answer.
3. How do we know an agent may act? Credential and mandate checks give the answer.
4. How do we manage risky operators? Tier-based limits and re-scoring give the answer.
5. Who is responsible when something goes wrong? A liability map and an owner for escalations give the answer.

Written answers, kept current, turn a vague risk into a managed one. They also speed up audits, partner reviews and investor diligence.

Why Act Early

Early action has three advantages. First, baselines come cheap before volume grows, and they guide later choices. Second, early adopters shape internal norms and vendor relationships. Third, attackers target weakly defended ecosystems first, so teams with controls in place become less attractive targets.

The cost of starting is low. Moreover, the Agent Trust Score has a free tier. A simple tier table takes an afternoon to write. Evidence storage needs only a few fields. The cost of waiting is harder to see until a fleet drains a promotion budget or a bad funder reaches a treasury.

Lessons From Reading the Tracker Over Time

A single snapshot hides dynamics. Reading the weekly series side by side teaches lessons that no one report shows. Five lessons stand out for teams that design KYA programs.

Lesson One: Averages Mislead

Median trust of new agents moved from a record 918 in Week 36 to 200 in Week 40 and 101 in Week 41. Therefore, a team that tuned a policy to the Week 36 mix would have faced a very different population five weeks later. Policies should hold up across the range, not only at the average.

Lesson Two: Volume and Quality Do Not Move Together

Registrations hit 31,979 in Week 34, a record, and fell to 6,893 by Week 40 before rebounding to 10,706 in Week 41. However, quality did not follow volume in a simple way. A quiet week can bring good agents, and a busy week can bring waves of weak ones. As a result, volume alone is a poor predictor of risk.

Lesson Three: Operators Run Many Agents

Agents per owner stood at 2.54 in Week 31 and 2.30 in Week 38. In other words, the typical owner runs more than two agents. That average hides a long tail of operators with far more. Consequently, operator-level analysis catches patterns that agent-level analysis misses.

Lesson Four: Farm Shares Stay Elevated

The farm-detected share held near 17% to 19% across Weeks 32 to 34 and stood at 16.12% in Week 40. Although the share drifted lower, it stayed material. For this reason, fleet detection must stay on permanently and not run as a one-off cleanup.

Lesson Five: New Mechanics Shift the Ground

Delegated accounts grew about 33.8% between Week 35 and Week 40, and Base added 37,037 agents in Week 41. In addition, the FEEDER_UNKNOWN share reached 12.84% that week. These shifts show why models need regular updates and why coverage must expand across chains.

Why Public Trackers Matter

Public trackers let outsiders check claims. They also create a shared reference for the industry, so that teams can compare their own traffic with the wider registry. Furthermore, they build a record that lets analysts see which defenses work over time. The tracker series is available through the weekly posts, including the Week 29 report, the Week 31 report and the Week 32 report.

Questions Technical Leaders Ask

Technical leaders tend to raise the same questions. Short answers help them plan.

How much engineering effort does a first version need?

A first version is small. In addition, a lookup client, a tier table, an evidence store and a dashboard cover the basics. Moreover, the free tier lets teams test without a contract. Larger deployments add caching, batch scoring and alerting.

Where should the check run?

Teams choose between inline checks, cached pre-checks and edge gateways. Inline checks suit low volume. Cached pre-checks suit high volume. Edge gateways suit platforms with many services. In every case, keep the components modular so that you can swap parts later.

How do we avoid blocking good agents?

Use limits before blocks. Offer lower initial limits that rise with clean behavior. In addition, keep an appeal route and review a sample of decisions each month. Fair design keeps honest operators engaged.

How do we handle agents on chains we do not cover?

Fall back on wallet-level screening, conservative limits and step-ups. As coverage grows, move those agents into the standard flow. Meanwhile, log every fallback so you can see how often it occurs.

How do we prove to regulators that the program works?

Keep documented policies, stored evidence and metrics. Show approval, incident and appeal data by tier. Besides that, show change logs and review minutes. Regulators value consistent process as much as any single control.

How do we keep up with attackers?

Refresh scores on a schedule, watch for drift and review the tracker data. Additionally, run red-team exercises each year, and update rules when you learn something new. Attackers adapt, so defenders must adapt too.

Why Votes Are Not Trust: The Sybil Problem

Review-based rankings share a basic weakness. Anyone can create 50 wallets, register 50 agents and let them upvote a 51st. That is a plain Sybil attack, and a score built on votes cannot see it. The example is an illustration, yet the tracker shows that such fleets are real: 21.1% of agents carried the farm flag at launch. Votes measure what other accounts say. Behavior shows what an operator did.

ChainAware takes a different route. The Agent Trust Score uses on-chain behavior only, with no reviews, no ratings and no self-reported data. Faking a clean funding history costs real money and time, while 50 upvotes cost almost nothing. Moreover, an attacker’s own address and feeder address pass through ChainAware’s machine-learning fraud detection, so abnormal behavior lowers the score instead of raising it. Honest limits still apply: on-chain data is costly to fake, not impossible to fake, which is why the fraud models watch the attacker as well as the agent.

Why ChainAware Is Credible in This Layer

ChainAware did not start with agents. Its models analyze more than 25 million wallet addresses, more than 2.4 billion predictive data points and more than 1.8 million contracts checked for honeypots. The company reports 95% accuracy for its per-address fraud model, and anyone can verify it against public data through ScamDB. In a test on PancakeSwap on BNB Smart Chain, covering weeks 10 to 20, the rug pull model predicted 90.1% of rug pulls before they happened, as documented on the rug pull verification page. Separately, more than 940,000 rug pulls have been documented after the fact, and ChainAware covers them in its weekly rug pull news. The Agent Trust Score applies this record to agents. It predicts risk and does not rank popularity.

Key Facts at a Glance

• Know Your Agent (KYA) is the process of deciding whether an AI agent may act and how far.
• KYA combines identity evidence, authorization evidence and behavioral evidence.
• Identity shows who an agent is. Behavioral evidence shows whether to trust it.
• Registration is cheap in open registries, so fleets and bad funders pass identity checks.
• The Agent Trust Score rates ERC-8004 agents from 0 to 1,000 across five tiers: Sovereign, Trusted, Provisional, Elevated Risk and Untrusted.
• Inputs include the owner wallet, the feeder address, the creator record and fleet detection.
• At launch, 51.8% of 274,792 indexed agents sat in the Elevated Risk or Untrusted tiers, and 21.1% carried the farm flag.
• By Week 41 of 2026, 568,590 agents were indexed, and the median trust of that week’s new agents was 101.
• The score is free for public indexed agents, with 1,000 queries per month and no signup.
• Coverage today includes Ethereum, BNB Smart Chain, Base and Avalanche C-Chain, with Mantle in progress.

Frequently Asked Questions

What does KYA stand for?

KYA stands for Know Your Agent. It is the process of deciding whether an AI agent may act and how far.

How is KYA different from KYC?

KYC verifies people and companies. KYA evaluates software agents and their operators, using signals such as owner wallet history, funding source, creator record and fleet links. Agent identities cost far less to create than human identities, so KYA relies more on behavior.

Is agent identity enough for KYA?

No. Identity shows who an agent is, but it does not show whether the operator is honest. Behavioral evidence completes the picture.

What is the Agent Trust Score?

It is ChainAware’s 0 to 1,000 rating for ERC-8004 agents. Furthermore, it groups agents into five tiers and adds named flags that explain the reasons.

What are the five tiers?

Sovereign (800-1000), Trusted (600-799), Provisional (400-599), Elevated Risk (200-399) and Untrusted (0-199).

What does the score measure?

It measures the owner wallet’s fraud probability, the feeder address that funded the owner, the creator’s rug pull and honeypot record, and fleet-level farm links.

Is the Agent Trust Score free?

Yes for public indexed agents, with 1,000 queries per month and no signup. Higher volumes run through the API or the Prediction MCP. See the Agent Trust Score page for details.

Which chains does it cover?

Ethereum, BNB Smart Chain, Base and Avalanche C-Chain, with Mantle in progress.

What is a feeder address?

It is the address that funded an agent’s owner wallet. The funding source reveals intent that the wallet’s own history may hide.

What is a farm or fleet?

A farm is a group of linked agents under one operator. Farms inflate activity, distort reputation and exploit incentives.

What does the FARM_DETECTED flag mean?

It means the agent appears to belong to a group of linked agents. In the launch analysis, 21.1% of agents carried it.

Can honest agents receive low scores?

Yes. New agents have thin histories and may start in lower tiers. A fair policy gives them a path to improve through clean behavior and transparent funding.

Does KYA work for card payments?

The principles carry over. Instead, the Agent Trust Score itself covers on-chain agents and wallets, so card-only ecosystems need their own behavioral data. Our articles on agentic commerce fraud and checkout verification cover the card side.

Who is liable when an AI agent causes a loss?

Rules are still developing. Some analysts expect the merchant of record to carry much of the risk by default. Confirm your position with counsel and your payment partners.

Where should a team start?

Inventory agent touchpoints, look up a sample of agents in the free tool, write a tier-based policy and store evidence for every decision.

A Short Glossary

• Agent: software that acts on behalf of a person, company or another agent.
• Operator: the person or company that runs an agent.
• KYA (Know Your Agent): the process of deciding whether an agent may act and how far.
• ERC-8004: an Ethereum standard for agent identity, reputation and validation registries.
• Agent Trust Score: ChainAware’s 0 to 1,000 rating for ERC-8004 agents.
• Tier: one of five bands of the score, from Untrusted to Sovereign.
• Feeder: the address that funded an agent’s owner wallet.
• Farm or fleet: a group of linked agents under one operator.
• Sybil attack: the use of many fake identities to gain influence or rewards.
• Mandate: a signed record of what a user authorized an agent to do.
• Payment token: a limited-use stand-in for a payment method.
• Step-up: an extra confirmation before approval.
• Drift: a gradual change in an agent’s behavior away from its intended purpose.
• Rug pull: a scam in which creators drain funds and abandon a project.
• Honeypot: a contract designed to trap funds.

Conclusion: Make Trust a Layer, Not a Hope

Agents will keep multiplying. Registration will stay cheap, and money will keep moving through machine decisions. In that world, trust cannot rest on paperwork alone. It needs evidence about who stands behind each agent, where the money came from and how many siblings the agent has.

KYA gives teams a structure for that evidence. Identity tells you who. Authorization tells you what was allowed. Behavioral evidence tells you whether to trust. Together, they let teams welcome good agents, limit uncertain ones and refuse bad ones, with a record for every decision.

Start small. Look up a few agents today, write a one-page tier policy this week and store evidence from the first day. Then expand coverage, tune thresholds and share what you learn.

To go deeper, read the rest of the series: KYA versus agent identity, ERC-8004 trust signals, funding-chain risk, agent fraud patterns, agentic commerce fraud and checkout verification. Teams that want to see how an agent fleet applies these ideas can read about ChainAware’s 32 Claude sub-agents, and teams that need deep wallet reviews can look at the ChainAware investigation reports.