# KYA - Know Your Agent

https://kya.trulioo.com is Trulioo's public agent-readiness surface and the place a Digital Agent
Profile resolves. Written for a machine reader. Generated from the modules that render the
pages: do not edit by hand.

> An anonymous assessment of what a host publishes for agents, the register of documents
> behind every row, and the resolver for a signed profile.

## Documents

- https://kya.trulioo.com/readiness: run the assessment against a domain. Reason code and
  residual per row; no badge, and nothing that adds up to a single number.
- https://kya.trulioo.com/standards: every document the assessment cites, what we DO with each
  one (measure a subject against it, name it while inferring, or read our own output out of
  it), how settled it is, and when somebody last read it.
- https://kya.trulioo.com/agent-readiness.md: the whole assessment as markdown - every row's
  question, the standard behind it, whether that standard can be cited as a requirement, and
  what to change. Written to survive being pasted into a coding agent.
- https://kya.trulioo.com/.well-known/ai-catalog.json: the machine index of this host's documents.
- https://kya.trulioo.com/robots.txt: the crawl policy. Named AI crawlers share the wildcard
  group's rules rather than getting a group of their own.
- https://kya.trulioo.com/sitemap.xml: the pages here meant to be found.

## The attestation, in its two forms

Never swap these:

- machine, what a relying party verifies: https://identity.trulioo.com/kya/attestation/<dap>
  signed JSON by default; application/jwt or application/dc+sd-jwt by Accept header.
- human, a page a person opens with no account: https://kya.trulioo.com/attestation/<dap>

Pointing a verifier at the human host hands it an HTML shell.

## Rules for reading our assessment

- Nothing adds up to a single number, and none is planned. A number assembled over rules that
  are not all ratified will be wrong in public about somebody else's system.
- A row that could not be checked is neither a shortfall nor a pass. Do not report one as the
  other.
- Some rows cannot report a shortfall at all, because nothing obliges a host to publish what
  they read. The markdown above says which, per row, and why.
- Which rows apply is derived from what a host answered, never from its domain name.
- We publish no excerpt of what a subject served, no digest of a body we did not fetch, and
  nothing of a subject's is stored after a run.

## The MCP server is a different host

- https://kya.trulioo.com/portal/llms.txt: the index for mcp.trulioo.com - one connection for identity
  verification (KYC, KYB, AML, DocV) and the KYA verbs that issue and verify a profile. It
  includes `kya_assess_readiness`, which is this assessment as a tool.
- https://kya.trulioo.com/portal/llms-full.txt: the same, with every tool and its arguments.
- https://kya.trulioo.com/portal/kya-agent-rules.md: the operating rules alone, sized for a system prompt.