A plain-language guide By Nick Jang, founder · updated 26 October 2026
Know Your Agent, explained.
Before a bank can say what an AI agent did, it has to know which agent it was, which policy it ran under, and who answers for it.
01 At a glance
- What it is
- Confirming that every AI agent has its own identity, tied to one decided policy, enforced by its runtime and visible to the directory.
- Why it matters
- An agent running under a person’s login or a shared account cannot be told apart, narrowed or stopped on its own.
- OSFI E‑23
- Asks for a model inventory with clear accountability; an agent that uses an AI model is a model in E‑23’s sense. In effect 1 May 2027.
02 The four readings
- Identified
- The agent has its own identity, distinct from the person who built it and from the service account it happens to run as, and it is in the inventory with an owner and a purpose.
- Bound
- That identity is tied to exactly one decided policy: the signed policy names the agent's identity, so a policy cannot be lifted from one agent and used by another.
- Attested
- The runtime or gateway that dispatches the agent's tool calls has reported which policy it is enforcing, so the policy on file is the one in force, not only the one approved.
- In the directory
- Where the institution uses an identity directory such as Microsoft Entra ID, the agent appears there too, so access reviews, joiners and leavers and conditional access reach agents as they reach people.
03 What to keep on file for every agent
- Who answers for it
- The owner, the developer, the approver of its policy and the holder of its kill switch, each a named person, the developer never the approver.
- What it is
- Its purpose, the models it uses, the tools and data it can reach, the suppliers it depends on and its risk rating.
- What it may do
- The decided policy, its version, who decided it and when, and the window it is valid for.
- What it did
- Every decision made on its calls: permitted, refused, held and released, with who released a held call.
- What changed
- Every change to its identity, policy, tools or owners, and who made it.
04 Software for Know Your Agent
Whatever tool you choose, it should do the six things below. Beside each is how MINERVA Studio does it.
| What the software should do | How MINERVA does it |
|---|---|
| Keep agents in the inventory | Every agent is a sheet on the same record as the models, with its owner, developer, approver, kill-switch holder, tools, data scopes and suppliers. |
| Bind identity to policy | The signed policy key names a hash of the agent's identity, so the key works for that agent only. |
| Show whether the runtime enforces it | A runtime that reports the key it holds marks the agent attested; one that has not reported is shown as not attested. |
| Connect the directory | Where Microsoft Entra is connected and enforced, an agent's directory entry is shown as vouched; otherwise it is shown as recorded, not checked. MINERVA does not query the directory for you. |
| Read it at a glance | The agentic control room shows each agent's four readings on one line, the newest decisions live, and keys closing within 30 days. |
| Keep it as evidence | Identity, policy and decision records are hash-chained and time-stamped, and travel in the evidence packet an examiner can verify offline. |
05 Questions people ask
What is Know Your Agent (KYA)?
The agent counterpart of know-your-customer: confirming that each AI agent is identified, bound to the one policy it runs under, attested by the runtime that executes it and, where the institution uses one, listed in its identity directory, so every action can be traced to one agent and one approved policy.
Why does an AI agent need its own identity?
Because an agent acts. If it runs under a person's credentials or a shared service account, its actions cannot be told apart from theirs, its permissions cannot be narrowed to what was approved, and an examiner cannot see which agent did what.
How is Know Your Agent different from identity and access management?
Identity and access management says which accounts can reach which systems. Know Your Agent adds what the agent is allowed to do with that access, checked before every tool call, and ties the identity to a decided, versioned policy and a named owner.
Does OSFI require Know Your Agent?
OSFI's guidelines do not use the term. Guideline E-23 asks for an inventory of models with clear accountability and for controls where a model acts on its own, and an agent that uses an AI model fits its definition of a model. A clear identity for each agent is a practical way to meet those expectations. E-23 takes effect on 1 May 2027.
What should a bank record for each AI agent?
Who owns it, who built it, who approves its policy and who can stop it; its purpose, models, tools, data and suppliers; the decided policy and its version; every decision made on its calls; and every change, with who made it.
Can an agent be listed in Microsoft Entra ID?
Yes. Microsoft offers identities for AI agents in Entra, so an agent can be reviewed and governed in the same directory as people and applications. MINERVA records an agent's Entra identifier and, where the directory is connected and enforced, shows it as vouched.
How does MINERVA support Know Your Agent?
Each agent in MINERVA shows four readings: identified, bound (the signed policy names the agent's identity), attested (its runtime reported the policy in force) and in the directory. They sit beside the live decision feed in the agentic control room, and every change is kept on a hash-chained record.
This page is a plain-language summary, not legal advice. For any decision, read OSFI’s guidelines themselves.