KYA: A Framework-Agnostic Trust Layer for Autonomous Systems with Verifiable Provenance and Hierarchical Policy Composition¶

🕒 Published (v1): 2026-05-25 02:59 UTC · Source: Arxiv · link

Why this paper was selected

KYA: framework-agnostic trust layer with verifiable provenance and policy composition

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

KYA (Know Your Agents) is a framework-agnostic, open-source trust and governance layer for autonomous agent systems that fills the gap left by observability platforms: it produces agent-identity-bound, cryptographically verifiable governance artifacts rather than operational telemetry. Its five primitives collectively address authorization, policy conformance, and post-hoc verifiability across any agent framework via native adapters for 15+ runtimes. On a 4×9 cross-backend matrix all 36 cells pass; the system detects 89% of 1,200 adversarial probes from PyRIT and Garak.

Problem¶

Observability platforms (LangSmith, Phoenix, Langfuse, Braintrust, Weave) answer operational questions (latency, cost, trace paths) and emit operator-internal audit logs (SOC 2 RBAC, who-ran-which-eval). None produces agent-identity-bound, cryptographically verifiable, third-party-attestable governance artifacts — because that is a distinct layer. The gap is in agent identity, evidentiary provenance, and enforceable behavioral contracts, which are required by EU AI Act GPAI obligations (in force since August 2025), NIST AI RMF, ISO 42001, and SR-11/7.

Method¶

KYA composes five primitives into a four-piece deployable stack:

Four-gate inbound apply pipeline: Ed25519 signature verification → expiration check → only-tighten composition → operator-approval-as-default. Generalizes TUF/Uptane rollback prevention from a version counter to a policy-strength lattice.
Only-tighten composition algebra: Tenant-scoped policy overrides can restrict but never loosen platform-default weights. Formally a refinement-calculus result (Back & von Wright, 1998) applied to risk weights composed with cryptographically signed external recommendations; soundness established in Lemma 1. Effective permission = \(L1 \cap L2 \cap L3\) across three runtime enforcement layers.
KYP (Know Your Principal): Single-table schema with a principal_kind discriminator unifying trust scoring across human users, AI agents, and service accounts, sharing signal mechanics across all three.
Auditable interaction-multiplier amplification: A bounded asymmetric registry of named pairwise interactions (multipliers \(\geq 1.0\), product-capped at MAX_MULTIPLIER=2.0) over an AIVSS-shaped additive baseline. Each interaction carries a stable audit code; per-factor decomposition is preserved in the HMAC-chained evidence log.
Two-axis delegation attribution: Static axis adds an observation-gated delegation-trust premium (cap 25) for risky delegates, preventing EigenTrust cold-start false positives. Dynamic axis uses an actor_agent_key convention hard-wired at three SDK hook-layer entry points so that when orchestrator \(A\) triggers sub-agents \(B/C/D\) and any sub-agent fires a rogue signal, the signal is tagged actor_agent_key=A and \(A\)'s trust counter is debited at runtime.

The stack ships as veldt-kya on PyPI: a core SDK (kya), kya_hooks (per-framework thin shims), kya_otlp_bridge (OTLP sidecar translating OTel spans into KYA signals), and kya_redteam (PyRIT + Garak campaign runner). Raw prompt/completion payloads remain in the customer process; only aggregated telemetry crosses organizational boundaries.

Key Contributions¶

Four-gate inbound apply pipeline with Ed25519 verification and policy-strength lattice rollback prevention
Only-tighten composition algebra with formal soundness proof for multi-tenant hierarchical policy overrides
KYP unified principal taxonomy: single schema covering human users, AI agents, and service accounts
Bounded asymmetric interaction-multiplier amplification with per-interaction stable audit codes over an AIVSS-shaped additive baseline
Two-axis delegation attribution naming and defending against the "clean orchestrator delegates to risky downstream" topology attack
Framework-agnostic adapter layer: 15+ native framework integrations with no core dependency on any agent framework
Threat coverage across all 8 threat classes (T1–T8) including topology-guided multi-agent propagation (T7) and attribution evasion (T8), which no surveyed peer system covers fully

Results¶

Cross-backend portability: 4×9 phase matrix — all 36 cells pass across PostgreSQL, SQLite, DuckDB, and MySQL
Scoring latency: pure-function scorer runs sub-millisecond at p99
Throughput: sustains ≈1,800 ops/sec at 20 concurrent workers with HMAC chain integrity preserved end-to-end
Adversarial detection: 89% of 1,200 adversarial probes detected from PyRIT and Garak, including the topology-guided multi-agent attack
Threat coverage vs. baselines: KYA is the only system achieving full coverage (✓) across all 8 threat classes and federation; DeepEval, TrustEval, TrustPact, Microsoft AGT, and AURA each have partial or no coverage on T1, T2, T6, T7, T8, and federation

Limitations¶

Trust model assumes a trusted operator holding the per-(tenant, invocation) HMAC key; compromised-operator scenarios are deferred
Assumes a trusted central collector holding the Ed25519 inbound-signing key in KMS/HSM; compromised-collector handling is noted but not detailed in the provided text
Storage backends are assumed honest-but-curious — they are observed but not treated as tamper-proof
Third-party attestation (notarized-attestation) is described as a v1 upgrade path, not yet implemented in the released package
Adversarial detection rate of 89% implies an 11% miss rate against PyRIT/Garak probes; coverage against novel jailbreak families is not characterized
The full limitations section (Section 10) is not included in the provided text excerpt

Relevance to Harnesses / Meta-Harnesses¶

KYA is architecturally a meta-harness: it wraps any underlying agent framework through a thin adapter layer (kya_hooks, format_adapter.py) and applies cross-cutting governance primitives uniformly, which is precisely the meta-harness pattern of instrumenting diverse runtimes through a single interposition layer. The kya_otlp_bridge component demonstrates the standard harness composition idiom — consuming structured output from downstream observability harnesses (LangSmith, Langfuse, etc.) and lifting it into a higher-level governance plane. For researchers tracking harness design, KYA's five-primitive composition discipline — particularly the only-tighten algebra and the three-layer gate intersection \(L1 \cap L2 \cap L3\) — offers a formal model for how policy constraints should compose across a harness hierarchy without privilege escalation. The framework-agnostic adapter registry (15+ frameworks, one core) is a concrete existence proof that meta-harness governance can be decoupled from execution semantics.