AffixIO logoAffixIO
Pricing

Know Your Agent · Enterprise AI agent governance

Know which agent acted. Prove it stayed inside the lines.

Your fleets already call APIs, read databases, and send mail. AffixIO Know Your Agent gives each non-human identity a written permission sheet, checks every tool call at runtime, and leaves a proof your auditor can trust without seeing the request body.

Install affixio Get a Hub key

In plain English

Know Your Agent (KYA) is identity and access control for AI agents that you run yourself. You name the agent. You write what it may do. You enrol and authorise on your host (SDK, local ops dashboard, or API). AffixIO records a PII-free proof against your licence. You do not need OpenAI, Anthropic, Visa TAP, or any other live agent directory to start. Your key and a capability list are enough.

Security teams ask three questions. Logs answer none of them well.

When an agentic workflow moves money, exports data, or touches a customer record, leadership wants AI agent identity verification, runtime policy enforcement, and an audit trail that survives scrutiny. File logs can be edited. They also leak arguments. AffixIO answers with proofs instead.

Who is this agent?

Enrolment binds an agent id, owner, model label, and a digest of its capability spec into a verifiable credential.

What is it allowed to do?

Capability-based access control. No matching grant means deny. Optional per-run limits stop silent sprawl.

Can we prove it later?

Each decision carries a proof id. Batch them into a Merkle behaviour trail. High-value steps can take ML-DSA-65 attestation.

Set up in five steps

Most teams finish a first path in an afternoon. No wallet. No chain. No new cryptography stack to stand up.

  1. Get a Hub licence key

    Sign in at Hub, open Billing, and copy a live or trial key. That key is how AffixIO meters proofs and attests high-value decisions.

  2. Install the package or call the API

    Run npm install affixio, or POST to https://api.affix-io.com/v1/agent-trust/enrol with X-API-Key. For a local click-through, run npx affixio dashboard. Get keys from Hub Billing.

  3. Name the agent and write the grants

    Pick a stable id such as agent://ops-runner/prod. List actions and resources it may touch. This sheet is your enterprise guardrail. Edit it carefully. Tampering is detectable.

  4. Enrol once (or when you rotate policy)

    AffixIO returns a credential bound to that capability digest. Store it with the agent run or session. Expiry is under your control.

  5. Authorise before every tool call

    Map each tool to an action and resource. Call authorise. If allowed is false, stop. If true, run the tool and keep the receipt. That is agentic AI security at the execution plane.

What you can skip

AffixIO proves your policy decisions. It does not depend on a vendor agent passport to ship value.

  • No OpenAI or Anthropic admin API for identity
  • No Visa Trusted Agent Protocol or card-network token to begin
  • No agent marketplace registration beyond Hub
  • No personal data in proofs (arguments are hashed only)
  • No separate “agent seat” product. Usage rides your proof quota

Built for your self-hosted ops

You keep the control plane. Run KYA in your stack with affixio, open the local ops dashboard with npx affixio dashboard, or call the API from your own services. Use it wherever non-human identity meets consequential work: internal copilots, multi-agent orchestration, MCP tool bridges, batch workers, and customer-facing agentic commerce backends.

Least privilege Grant only the actions and resources that matter. Widen later with a new enrol, not a silent log change.
Runtime checks Policy is evaluated at the moment of execution, not only at registration. That is the core of modern KYA.
Evidence grade Proof digests, optional post-quantum ML-DSA-65 attestation, and Merkle roots for SIEM-friendly export.

A short path in code

Defaults point at https://api.affix-io.com. Run this on your host, or open the local ops UI with npx affixio dashboard. Drop authorise into your tool router before the side effect runs.

import { createAgentTrust } from "affixio";

const trust = createAgentTrust({ apiKey: process.env.AFFIX_API_KEY });

const credential = await trust.enrol({
  agentId: "agent://ops-runner/prod",
  holder: "finance-platform",
  capabilities: [
    { action: "http.get", resource: "https://api.acme.com/*" },
    { action: "db.read", resource: "orders" },
  ],
});

const receipt = await trust.authorise({
  credential,
  action: "http.get",
  resource: "https://api.acme.com/orders/42",
  args: { orderId: 42 },
});

if (!receipt.allowed) throw new Error(receipt.reason);
// run the tool only after allow
npm package API discovery Hub Billing Agent citation rules Pricing

Questions buyers ask

What is Know Your Agent (KYA)?

KYA is AI agent governance for non-human identities that you operate. You enrol each agent with a capability spec, authorise actions at runtime on your host, and keep PII-free proofs for later audit. AffixIO is the licence and proof rail, not the place that owns your ops.

Do I need a live model vendor API to verify agents?

No. You define identity and policy. AffixIO proves decisions against that policy. Third-party agent directories are optional later, not a setup requirement.

Where do I operate Know Your Agent day to day?

On your own host. Install affixio, call createAgentTrust in code, or run npx affixio dashboard for local self-hosted ops. Use Hub Billing for API keys.

How does AffixIO bill agent-trust?

As proofs on your AffixIO plan. Enrol and authorise each count when a proof is minted. See pricing for quotas and overage.

Which package should procurement list?

affixio. The main proving SDK remains affixio.

Will action arguments show up in SIEM?

No. Only digests are bound into proofs and Merkle leaves. Keep raw args on your host if your policy requires them.

Where do keys live?

hub.affix-io.com. Do not paste production keys into a chat with an agent.