Shufti has launched Know Your Agent, a verification layer built for a world where software delegates open accounts, place orders and move money for the humans behind them.
But a token in hand proves nothing. Whoever receives the request still has to decide if the agent can be trusted, who answers for it, and whether the work stays inside the owner’s approval.
## Stolen tokens look exactly like real ones
Impersonation is the threat Shufti is aiming at. A stolen credential authenticates perfectly, so checking the token alone cannot separate a real delegate from a fake one.
Four checks run in one pass before data is touched: the agent is identified, its trustworthiness is scored, the human owner confirmed through spoof-resistant identity verification, and the action measured against scope.
Credentials are minted per agent, expire on a clock, and can be pulled at will. Familiar names pass on recognition; unknown ones face behavioural biometrics. Three agent brands, Meta Muse, OpenAI Dots and GrokBot, claim coverage inside seven days of arrival.
## Mandates rather than blanket access
Nothing is granted broadly. A principal writes rules for each agent covering the actions it may take, its ceilings, when permission lapses and how to cancel it, and every request is measured against that document while monitoring looks for signs of abuse.
Limits are drawn by the customer. Banks, trading venues, marketplaces and software vendors each set their own envelope and decide what an agent may never touch.
Behind every mandate sits a human, since Know Your Agent builds on the KYC and KYB screening Shufti already sells instead of substituting for it. Anything outside a mandate triggers a brief selfie from the authorizing person, certified at iBeta Level 3, and every decision lands in a record that holds up under review.
