VeryAI has launched AG9, a Know Your Agent platform that uses palm biometric verification to bind AI agents to verified human owners and signed credentials. The company says the platform is designed for organizations that need to distinguish authorized AI agents from malicious bots, and to confirm that sensitive agent actions have been approved by a real person.
AG9 works by pairing an agent with a human user through the VeryAI app. A user scans the agent’s pairing QR code, reviews the permissions being granted and completes a palm scan to confirm ownership. The agent then receives a signed credential tied to the verified user, declared identity information and permitted behavior scope. When the agent attempts a sensitive action such as a payment, transfer or publication, a partner system can query AG9 and prompt the user to approve the action with another palm scan.
VeryAI says the platform is compatible with existing infrastructure including Cloudflare Web Bot Auth, Auth0 and Microsoft Entra on-behalf-of token workflows, Open Wallet Standard, Okta CIBA, API gateways and browser-agent frameworks. The AG9 public site describes attestations as JWTs verified through public keys, allowing partners to read signed claims rather than rebuild their authentication systems around a new SDK.
“KYC answers the question ‘who is this user?’ That’s no longer enough,” VeryAI founder and CEO Zach Meltzer said. “The question that platforms need to answer is, ‘Who or what is acting right now, and where does the responsibility lie?’”
The launch adds palm biometrics to a growing identity category around AI agents. Proof recently joined FIDO Alliance work on identity standards for AI agents, Sumsub launched AI agent verification for binding automation to verified humans, and World ID introduced tools to link iris-verified identity to AI agents. AG9 applies a similar accountability problem to web, API and transaction flows, using palm verification rather than iris or document-based checks.
VeryAI cites the 2025 Imperva Bad Bot Report, which found that bots accounted for 51 percent of internet traffic in 2024, while malicious bots accounted for 37 percent. The report also found that 44 percent of advanced bot attacks targeted APIs. VeryAI says AG9 is aimed at enterprises, edge networks, API-first platforms, agent developers and regulated sectors that need machine-readable trust signals as autonomous agents interact with services on behalf of people.
–
By the ID Tech Editorial Team
