# KYA: A Framework-Agnostic Trust Layer for Autonomous Systems with Verifiable Provenance and Hierarchical Policy Composition

arXiv: https://arxiv.org/abs/2605.25376 · HTML: https://mlsanity.com/paper/2605.25376/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 23 of its 90 references that are in the map.
- First posted on arXiv 25 May 2026.

## Builds on (most cited first, 23 of 23)

- [Survey on Evaluation of LLM-based Agents](https://mlsanity.com/paper/2503.16416/) (2025)
- [AgenTracer: Who Is Inducing Failure in the LLM Agentic Systems?](https://mlsanity.com/paper/2509.03312/) (2025)
- [Lynx: An Open Source Hallucination Evaluation Model](https://mlsanity.com/paper/2407.08488/) (2024)
- [garak: A Framework for Security Probing Large Language Models](https://mlsanity.com/paper/2406.11036/) (2024)
- [Cedar: A New Language for Expressive, Fast, Safe, and Analyzable Authorization (Extended Version)](https://mlsanity.com/paper/2403.04651/) (2024)
- [PROV-AGENT: Unified Provenance for Tracking AI Agent Interactions in Agentic Workflows](https://mlsanity.com/paper/2508.02866/) (2025)
- [Runtime Governance for AI Agents: Policies on Paths](https://mlsanity.com/paper/2603.16586/) (2026)
- [Governance-as-a-Service: A Multi-Agent Framework for AI System Compliance and Policy Enforcement](https://mlsanity.com/paper/2508.18765/) (2025)
- [Inherent and emergent liability issues in LLM-based agentic systems: a principal-agent perspective](https://mlsanity.com/paper/2504.03255/) (2025)
- [Extending MAPE-K to support Human-Machine Teaming](https://mlsanity.com/paper/2203.13036/) (2022)
- [Core Safety Values for Provably Corrigible Agents](https://mlsanity.com/paper/2507.20964/) (2025)
- [Don't Trust Your Upstream: Exploiting LLM Multi-Agent System via Topology-Guided Adversarial Propagation](https://mlsanity.com/paper/2512.04129/) (2025)
- [Cryptographic Runtime Governance for Autonomous AI Systems: The Aegis Architecture for Verifiable Policy Enforcement](https://mlsanity.com/paper/2603.16938/) (2026)
- [Agent Control Protocol: Admission Control for Agent Actions](https://mlsanity.com/paper/2603.18829/) (2026)
- [AURA: An Agent Autonomy Risk Assessment Framework](https://mlsanity.com/paper/2510.15739/) (2025)
- [Securing Multi-Agent Systems Against Corruptions via Node Contribution Backpropagation](https://mlsanity.com/paper/2510.19420/) (2025)
- [The Log is the Agent: Event-Sourced Reactive Graphs for Auditable, Forkable Agentic Systems](https://mlsanity.com/paper/2605.21997/) (2026)
- [Deep Active Learning with Noisy Oracle in Object Detection](https://mlsanity.com/paper/2310.00372/) (2023)
- [AAGATE: A NIST AI RMF-Aligned Governance Platform for Agentic AI](https://mlsanity.com/paper/2510.25863/) (2025)
- [Sealing the Audit-Runtime Gap for LLM Skills](https://mlsanity.com/paper/2605.05274/) (2026)
- [The Human-Machine Identity Blur: A Unified Framework for Cybersecurity Risk Management in 2025](https://mlsanity.com/paper/2503.18255/) (2025)
- [It's a Feature, Not a Bug: Secure and Auditable State Rollback for Confidential Cloud Applications](https://mlsanity.com/paper/2511.13641/) (2025)
- [Attesting LLM Pipelines: Enforcing Verifiable Training and Release Claims](https://mlsanity.com/paper/2603.28988/) (2026)

## Abstract (arXiv)

KYA (Know Your Agents) is an open-source, framework-agnostic trust and governance layer for autonomous systems, composed of five primitives: (1) a four-gate inbound apply pipeline; (2) an only-tighten composition algebra over a three-channel multi-tenant hierarchy; (3) KYP (Know Your Principal), a schema-level unification of trust scoring across human users, AI agents, and service accounts; (4) auditable interaction-multiplier amplification over an AIVSS-shaped additive baseline; and (5) two-axis delegation attribution: a static premium for risky delegates and a runtime debit for actual delegate misbehavior in multi-agent fan-out. Together these span three pillars (trust, governance, and evidentiary assurance), making an autonomous system's actions authorized, policy-conforming, and post-hoc verifiable: where observability answers how long, how much, and what path, KYA answers was it authorized, did it conform, and can it be verified; it composes with observability rather than replacing it. It ships native adapters for 15+ agent frameworks. On a 4 by 9 cross-backend matrix all 36 cells pass; the pure-function scorer runs sub-millisecond at p99 and the system sustains ~ 1,800 ops/sec at 20 concurrent workers with HMAC chain integrity preserved end-to-end. KYA detects 89% of 1,200 adversarial probes from PyRIT and Garak, including the recently-published topology-guided multi-agent attack. The system is available under Apache 2.0 as the veldt-kya package on PyPI.