Know Your Agent exposes the human verification gap in payments

At a glance

What this is: This is Incode’s analysis of the IMF’s Know Your Agent framing for payments, arguing that current verification layers confirm the bot and mandate but leave the human behind delegated authority insufficiently proven.

Why it matters: For IAM, fraud, and identity teams, the issue is how to govern delegated authority when the execution path involves both agent identity and human verification at the point of action.

Context

Know Your Agent in payments sits at the intersection of delegated authority, verification, and transaction governance. The article argues that the IMF’s framework is directionally right, but that proving the agent and the mandate is not the same as proving the human who originally authorised the action.

The core gap appears when an agent operates within a mandate at low risk, then crosses into high-stakes execution where the original human intention is no longer sufficient evidence. Incode frames this as a payments control problem, but the governance lesson extends to any system that treats delegation as a one-time event instead of a living trust decision.

Key questions

Q: What breaks when a payment agent acts beyond its original mandate?

A: The control that breaks is the assumption that one signed mandate stays valid for every later action. When an agent crosses into higher-risk execution, the system may still authenticate the bot and recognise the permission scope, but it no longer has enough evidence that the human behind the action would still authorise it.

Q: Why do delegated payment controls need more than agent identity verification?

A: Because agent identity only proves who or what is acting, not whether the human authority behind the mandate still matches the transaction being attempted. In payments, that distinction matters when risk, amount, or context changes after the original authorisation. A valid bot can still carry invalid intent.

Q: How should teams decide when to re-verify a human behind delegated authority?

A: Teams should re-verify when the action exceeds the mandate’s original assumptions, such as a larger amount, a different payee, a new claim type, or a materially different risk profile. The trigger should be based on scope change, not just session age or bot authentication status.

Q: What is the difference between mandate verification and execution verification?

A: Mandate verification checks that permission was granted for a class of actions. Execution verification checks that the specific action now being attempted still fits the original human intent and risk boundary. In agentic payments, both are needed because a mandate can be valid while a specific execution is not.

Technical breakdown

Why agent registries are not enough for high-stakes payments

Agent registries, OAuth, OpenID Connect, and verifiable credentials can establish that a software actor exists, is enrolled, and is carrying a scoped permission set. That is useful, but it only answers identity and mandate provenance. In payments, the failure mode is not usually that the bot is unknown. It is that the system cannot tell whether the invoked human remains the correct authority for a materially different action than the one originally signed. The registry solves admission, not semantic intent. Practical implication: treat registry-backed agent identity as a prerequisite, not a complete verification outcome.

Practical implication: require a second control path for authority renewal when transaction context materially changes.

How delegated authority breaks at the mandate boundary

A mandate is a pre-authorised scope that works only while the action stays inside its original assumptions. Once an agent attempts an action that exceeds size, sensitivity, or context limits, the control question changes from allowed or not allowed to whether the delegated authority is still valid for this exact execution. That is why low-risk recurring activity can remain fully automated while high-stakes claims, transfers, or approvals should re-enter a stronger verification state. Practical implication: define explicit mandate boundaries that trigger renewed proof of authority, not just policy checks.

Practical implication: map mandate thresholds to step-up controls and escalation rules before automation goes live.

Why deterministic payment rails expose probabilistic AI assumptions

Payment systems depend on finality, traceability, and deterministic authorization, while AI agents can plan and act probabilistically. The technical mismatch matters because the agent may reason flexibly while the settlement layer expects stable, auditable control decisions. That means identity governance cannot stop at the model layer or the app layer. It has to preserve a clean handoff from probabilistic orchestration to deterministic authorization, or the audit trail will show a valid bot action but not a trustworthy human decision. Practical implication: separate agent reasoning from settlement authority in the control architecture.

Practical implication: keep decision-making and funds movement on distinct control planes with explicit authorization handoffs.

Threat narrative

Attacker objective: The objective is to complete a materially sensitive transaction under apparently valid delegated authority without forcing a fresh human verification event.

1. Entry occurs when a delegated agent is permitted to act under an existing mandate that was not designed for the later, higher-risk transaction context.
2. Credential or authority use follows through registry checks, OAuth, or verifiable credentials that validate the agent and the scope but do not re-prove the human behind the delegation.
3. Impact emerges when the agent executes a high-stakes payment or claim that falls outside the original assumptions, creating fraud exposure and weakened authorization traceability.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Know Your Agent is really a delegated-authority problem, not an agent-identity problem. The IMF framing is useful because it recognises that software actors now participate in payments as first-class participants. But the decisive control question is whether the human behind the mandate can still be proven at the moment the action changes character. That is a governance problem, not a registry problem. Practitioners should read KYA as a delegation model that must survive execution drift, not as a bot-enrolment exercise.

The human verification gap appears at the mandate boundary, where old fraud assumptions break. The paper’s endorsement stack verifies the agent and the mandate, but fraud cases arise when an action exceeds what the user actually intended or would re-authorise now. This is a specific control gap: the governance model assumes a mandate remains sufficient evidence across all later executions. It does not. The implication is that authority renewal must be treated as a distinct control state, not as an edge case.

Delegation renewal gap: the current model assumes a mandate once signed remains adequate until expiry. That assumption fails when the actor is an agent because the action can drift beyond the original human intent while still remaining technically authenticated. The implication is that payment governance has to distinguish between valid delegation and valid execution, or the trust model collapses at the exact point where fraud is most costly.

Payments governance now has to separate identity proof from authority proof. KYC answered who the customer is, then liveness and continuous verification answered whether the person was present and legitimate. KYA is beginning the same maturity curve, but for delegated actions. The field will need to stop treating identity verification, mandate verification, and execution verification as one step. Practitioners should design controls that preserve this separation across the full transaction chain.

Cross-actor governance is now the real control surface. The important relationship is no longer just bot to system. It is human to mandate to agent to transaction, with each layer able to invalidate the one below it. That means IAM, fraud, and payments teams need a shared model of authority renewal and exception handling. The practitioner takeaway is simple: if the human cannot be re-established at the point of high-stakes execution, the control stack is incomplete.

From our research library:

• Only about one-third of approximately 500 organizations surveyed by McKinsey in 2026 report maturity level three or higher across agentic AI governance controls.
• Read next: Agentic AI Identity Maturity Model

What this signals

Authority renewal becomes the control point when agentic payments move beyond low-risk automation. A mandate that is sufficient for routine billing or scheduling is not sufficient once the agent attempts a materially different transaction. Security and fraud teams should model the boundary where delegated authority needs to be re-proved rather than simply trusted.

Delegated trust is now a lifecycle issue. The important programme question is not whether an agent can be enrolled, but whether the human authority behind that agent can be re-established when execution context changes. That pushes IAM, fraud, and payments governance toward shared escalation logic instead of isolated controls.

Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption. That gap matters because payments are a high-consequence test case where weak authority proof turns a technical automation success into a governance failure.

For practitioners

• Define mandate renewal thresholds Set explicit transaction size, risk, and context thresholds that force renewed human verification before an agent can proceed outside its original scope.
• Separate agent identity from authority proof Keep registry-backed agent authentication, delegated mandate proof, and high-risk execution approval as distinct checkpoints in the flow.
• Require step-up checks at scope expansion Trigger stronger assurance when an agent moves from routine actions into materially different payment or claims behaviour, even if the session is already authenticated.
• Log delegation lineage end to end Record who authorised the mandate, what the agent was allowed to do, and what changed at execution time so investigators can reconstruct authority drift.

Key takeaways

• The article’s core warning is that Know Your Agent does not solve the human verification problem on its own.
• The important control gap appears when delegated authority is stretched beyond the original mandate and still looks technically valid.
• Practitioners need separate controls for agent identity, mandate scope, and renewed human authority at high-stakes execution.

Key terms

• Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
• Mandate: A mandate is the specific instruction a principal gives an agent, including what action is allowed, for how long, and under what limits. In delegated environments, the mandate should be cryptographically signed, auditable, and revocable. It is the control artifact that proves the agent is acting within authorized bounds.
• Authority Renewal: Authority renewal is the act of re-establishing that a delegated actor still has valid permission for a specific high-risk action. It matters when context changes, because the original approval may no longer be sufficient evidence for the transaction now being attempted.
• Execution boundary: The point at which an authorised task turns into a real system change, such as writing data, deleting records, spending money, or invoking a downstream tool. In AI governance, controlling the execution boundary matters more than simply approving access, because harm occurs when actions are allowed to complete unchecked.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.