As artificial intelligence systems become increasingly capable of communicating, making decisions, and performing tasks independently, verifying who controls these digital agents is becoming a major cybersecurity concern. On November 5, 2026, Malaysia’s Zetrix AI Berhad and China’s Academy of Information and Communications Technology (CAICT) announced a partnership to introduce a Know Your Agent (KYA) service designed to establish verifiable identities and accountability for AI agents. The initiative aims to help businesses, governments, and digital service providers determine who an AI agent represents, what activities it is authorized to perform, and whether its actions remain within approved limits. Announced at international technology events in China and the United Arab Emirates, the initiative also includes plans for cross border testing that could contribute to future international discussions on AI identity standards.
What Is the Know Your Agent Initiative?
The Know Your Agent concept applies principles similar to Know Your Customer (KYC) verification in financial services to autonomous artificial intelligence systems. Traditional identity verification establishes whether a person or business is legitimate before allowing access to certain services. KYA extends that idea by connecting an AI agent to an authenticated individual or organization responsible for its activities.
Under the proposed framework, an AI agent would have a verifiable digital identity that allows another organization or service provider to establish its ownership and authority. This distinction is becoming increasingly important because modern AI systems can do considerably more than generate text or answer questions. They can interact with websites, access business applications, communicate with other agents, retrieve information, and potentially initiate financial transactions.
Without reliable identification, organizations may struggle to determine whether an automated system is operating with legitimate authorization or acting independently beyond its intended responsibilities. A verified identity can provide an additional layer of confidence by connecting digital activity to an accountable owner.
The KYA service introduced by Zetrix AI and CAICT is intended to address this challenge through identity verification, permission management, and records of agent activity. It is a newly launched service intended to contribute to wider standards discussions, rather than a completed international standard already adopted by governments worldwide.
Zetrix AI and CAICT Announce International Technology Partnership
The announcement took place on November 5 at two international technology gatherings: the World Internet Conference in Wuzhen, China, and the ICT Development Forum 2026 in Dubai, United Arab Emirates.
The collaboration brings together Zetrix AI, a Malaysian technology company, and CAICT, a Chinese research institution operating under the Ministry of Industry and Information Technology. CAICT has an established role in research, telecommunications development, and digital technology standards activities.
The partnership reflects growing international interest in establishing reliable digital identities for autonomous AI systems. As businesses increasingly experiment with agentic artificial intelligence, the ability to verify an agent’s identity and permissions could become an important requirement for secure digital transactions.
According to the companies, the proposed system will allow organizations to establish not only which agent is interacting with them but also which individual or business stands behind that agent. This could help reduce uncertainty when automated systems communicate across different companies, platforms, and national borders.
How KYA Verification Could Improve AI Security
One of the central features of the KYA service is its focus on permissions. Identifying an AI agent is only one part of the security process. Organizations also need to know what that agent is allowed to do.
For example, a business might authorize an AI assistant to communicate with approved suppliers, retrieve specific inventory information, and make purchases below a predetermined financial limit. The agent could complete routine transactions independently while requiring human approval for larger payments.
With a permission based identity system, service providers could check whether the agent’s requested activity falls within its approved authority. If an agent attempts to perform an action outside those limits, the transaction could be rejected or referred for additional authorization.
Controlling Delegation Between AI Agents
Another important security feature involves delegated authority. Modern AI systems may increasingly operate through networks of specialized agents, with one system assigning smaller tasks to other automated services.
This arrangement can improve efficiency, but it also introduces a potential security weakness. An agent receiving permission to perform a limited task should not be able to pass greater authority to another agent than it originally received.
The KYA framework is designed to prevent this expansion of permissions. When one AI agent delegates work to another, the delegated authority cannot exceed the original permissions granted by the responsible owner.
This principle could help organizations maintain control over complicated automated workflows. It also provides a clearer basis for investigating incidents when several AI systems participate in the same activity.
Revocable Permissions and Auditable Activity Records
The service also supports permission revocation, allowing an owner to withdraw an agent’s authorization when circumstances change. This is particularly important when an employee leaves an organization, an account becomes compromised, or an automated system begins behaving unexpectedly.
Signed records of agent activity are intended to provide an auditable history of actions. Such records can help organizations establish which agent performed a particular operation, what authority it used, and whether the activity was properly authorized.
Combining identity verification, permission controls, and verifiable records could make autonomous systems easier to supervise without requiring human approval for every routine operation.
Cross Border Pilot to Test AI Identity Verification
Beyond the initial launch, Zetrix AI and CAICT plan to conduct a cross border pilot involving participating organizations from the Middle East, Africa, China, and ASEAN. The project will examine whether AI agent identities and permissions can be recognized across different legal and technological environments.
This is an important part of the initiative because autonomous AI systems are unlikely to remain restricted to individual companies or national markets. A business in Malaysia could eventually use an AI agent to communicate with a supplier in China, arrange payments through an international financial platform, or exchange information with a government service in another country.
For these activities to operate safely, organizations need reliable ways to establish whether an agent is legitimate and whether its permissions are recognized by the receiving platform.
The planned pilot will examine several practical areas, including:
- Verification of AI agent identities across different jurisdictions.
- Recognition and enforcement of delegated permissions.
- Revocation of authorization when access is no longer required.
- Privacy safeguards for individuals and organizations.
- Accountability records for automated transactions and interactions.
Potential applications include international trade, digital payments, government services, and communication between autonomous AI systems. These tests could provide useful evidence about the technical and regulatory requirements for trusted AI interactions across national borders.
How KYA Could Help Limit AI Driven Misinformation
The growing use of automated accounts on social networks has created new challenges for online information platforms. AI powered bots can generate comments, publish content, interact with users, and distribute information at a scale that would be difficult for individual operators to achieve manually.
Not every automated account is harmful. Businesses use bots for customer support, news organizations distribute automated updates, and developers create digital assistants that help users find information. The difficulty arises when automated accounts conceal their ownership, impersonate legitimate individuals, or distribute misleading content without clear accountability.
A reliable agent identity framework could help platforms distinguish between verified automated systems and agents whose ownership or authority cannot be established. If an AI agent is connected to an identifiable individual or organization, its activities may become easier to investigate when suspicious behavior occurs.
Permission controls could also help limit what verified agents are allowed to do. For example, an organization could authorize an automated account to publish approved customer service updates without giving it permission to access unrelated information or conduct other activities.
However, KYA should not be considered a complete solution to online misinformation. Identity verification does not establish whether a statement is factually accurate, and a verified agent could still distribute misleading material. Content moderation, fact checking, platform security, and appropriate human oversight will remain necessary.
International Standards Bodies Could Shape the Future of KYA
One of the most significant aspects of the partnership is its intention to contribute findings from the pilot to international standards development discussions.
Zetrix AI and CAICT plan to submit their findings to the International Telecommunication Union, particularly its Telecommunication Standardization Sector Study Group 17, through the Focus Group on Trust and Identity for Humans and Agentic AI. The initiative also identifies the Institute of Electrical and Electronics Engineers and other standards development organizations as potential recipients of technical contributions.
The objective is to support broader discussions about AI identity verification, delegated authority, and accountability. These contributions could help international organizations evaluate common technical approaches for identifying and supervising autonomous agents.
The International Telecommunication Union plays an important role in developing international telecommunications standards and supporting cooperation between countries. Its work could provide a useful environment for examining how AI identity systems might operate across different national infrastructures.
Nevertheless, submitting pilot findings does not automatically make the KYA service an internationally approved standard. Formal standards development requires technical evaluation, consultation, and established approval procedures.
The Importance of Digital Credentials and Cryptographic Verification
Verifiable digital credentials are an important part of the emerging AI identity ecosystem. They allow information about an identity or authorization to be presented and checked without requiring every participating organization to maintain an entirely separate identity database.
The KYA service is designed around verifiable identity credentials, permission checks, and cryptographic evidence. The announcement also identifies AvatarLabs’ Agentic Wallet technology as part of the system’s technical foundation.
These mechanisms could help organizations confirm that an AI agent possesses valid credentials and that its actions are connected to an authorized owner. Cryptographic signatures can provide evidence that records or permissions have not been altered without detection.
Such systems may become particularly useful when agents interact with financial services. A payment provider, for example, could verify whether an automated purchasing assistant has authorization to pay a particular supplier and whether the requested amount falls within its approved spending limit.
More information about the technology initiative and its development is available through the official Zetrix AI website.
Challenges Facing the Adoption of AI Agent Identity Systems
Despite the potential benefits, introducing a common identity framework for autonomous AI systems will involve considerable technical and regulatory challenges.
Different countries maintain different approaches to digital identity, data protection, financial regulation, and cybersecurity. An identity credential accepted in one jurisdiction may not automatically receive recognition in another. International interoperability will therefore require cooperation between technology providers, regulators, governments, and standards organizations.
Privacy is another major consideration. Linking an AI agent to a real person or business can improve accountability, but excessive collection or disclosure of personal information could create additional risks. Identity verification systems must provide sufficient evidence of legitimacy without exposing unnecessary sensitive information.
Organizations must also consider compromised credentials, stolen access keys, fraudulent registrations, and unauthorized delegation. A verified identity is useful only when the underlying authentication and permission management systems remain secure.
Finally, human oversight will continue to matter. Automated systems can make mistakes, misunderstand instructions, or behave in unexpected ways. Organizations should establish clear procedures for reviewing high risk decisions, investigating suspicious activities, and withdrawing authorization when necessary.
What the Development Means for Businesses and Internet Users
The introduction of KYA reflects a broader change in how organizations may approach artificial intelligence security. Businesses are moving beyond simply asking whether an AI system can perform a task. They increasingly need to establish who controls that system, what authority it possesses, and how its activities can be reviewed.
For companies, this could create more confidence when deploying AI assistants for payments, customer services, supply chain management, and administrative operations. Clear authorization records may also help cybersecurity teams investigate incidents and identify weaknesses in automated workflows.
For ordinary internet users, stronger agent identification could eventually provide better transparency when interacting with automated accounts. People may have more information about whether they are communicating with a human representative, an officially authorized business assistant, or an independently operated AI system.
However, the benefits will depend on how widely these verification practices are adopted. A system that works only within one company’s platform may have limited value when agents interact with services operated by different organizations.
Conclusion: KYA Could Become an Important Foundation for Accountable AI
The November 5 partnership between Zetrix AI and China’s CAICT represents an important development in efforts to establish trust and accountability in autonomous artificial intelligence. By introducing verifiable digital identities, permission management, revocable authorization, and signed activity records, the KYA service aims to address security challenges associated with increasingly independent AI agents.
The planned pilot across the Middle East, Africa, China, and ASEAN will provide an opportunity to examine how these systems perform in international environments. Its findings could also contribute to wider discussions involving the International Telecommunication Union and other standards organizations.
Although identity verification alone cannot eliminate automated misinformation, fraud, or cybersecurity threats, it can provide an important foundation for determining who is responsible for an AI agent and what activities it is permitted to perform.
As autonomous systems become more involved in financial transactions, business operations, and online communication, accountability will become just as important as technical capability. The success of KYA will ultimately depend on whether organizations can establish secure, interoperable, and privacy conscious identity systems that make AI agents more trustworthy without limiting responsible innovation.
