Shufti has launched Know Your Agent, a product that checks an AI agent’s identity, confirms that a verified person or business authorized its action and enforces that owner’s permissions before the agent can access data or trigger a transaction.
The identity verification company says agentic commerce lets AI agents open accounts, place orders and move funds for their owners, and that a valid access token alone cannot show whether an agent is genuine or whether an action falls within what its owner approved. Stolen credentials can look legitimate, and fake agents can pose as trusted ones.
Each agent receives a unique, time-bound credential that can be revoked. Agents Shufti already knows are recognized by name, while new or unfamiliar agents are assessed through behavioral biometrics, and every agent is assigned a trust score. Shufti says it already supports agents such as Meta Muse, GrokBot and OpenAI Dots, adding each within a week of its launch.
Every agent is linked to an individual or business verified through Shufti’s existing KYC or KYB checks, part of a platform that recently added bank account ownership checks. The owner, which Shufti calls the principal, sets a mandate for each agent covering permitted actions, limits, expiry and revocation. That mandate is enforced as a policy on every request, with ongoing monitoring for misuse.
Businesses set their own rules. A bank could let agents view balances and pay approved billers while requiring a further check for new payees, and a digital assets platform could allow trades within an approved limit while blocking withdrawals. An online gaming operator could let agents monitor account activity while requiring bets to come from the verified player.
When an agent requests an action outside its mandate or above a high-risk threshold, the authorizing person must complete a brief selfie liveness check, which tests that a live human is present. Shufti says its single-selfie liveness is certified at iBeta Level 3 for resistance to presentation attacks. The system keeps an audit trail of requests, decisions and revocations for each agent and its principal.
“Businesses are already allowing AI agents to act for their customers, and the question of who stands behind each action cannot wait for an answer later,” said Faryam Asif, chief technology officer at Shufti. “Shufti Know Your Agent verifies every AI agent request with a verified owner, a clear mandate, and a record that holds up under review.”
Sources: Shufti, Help Net Security
–
By the ID Tech Editorial Team
