Know Your Agent (KYA) for business
Know Your Business Agent (KYBA)
Know Your Business Agent (KYBA) means verifying the legal entity behind an AI agent and the authority that agent claims to act under. Apier provides the company-authority layer of KYBA for Norway: whether the company exists and is active, and the register's coded signing rules for it, with signed evidence you can keep. Apier does not verify the agent itself.
What is KYBA?
KYBA is Know Your Agent (KYA) applied to business. When an AI agent acts for a company, the other party needs to verify two things: the legal entity behind the agent, and the authority the agent claims to act under. KYBA is an emerging term. Others in the industry use it too, and Apier did not coin it. No single standard defines it yet, so this page states which layers Apier covers and which it leaves to others.
KYC, KYB, KYA and KYBA compared
| Term | Who is verified | The question answered | Typical evidence |
|---|---|---|---|
| KYC (Know Your Customer) | A natural person | Is this person who they say they are? | Identity document, electronic ID, proof of address |
| KYB (Know Your Business) | A legal entity | Does this company exist, and who stands behind it? | Register extract, registered roles, ownership records |
| KYA (Know Your Agent) | An AI agent | Which agent is this, and who operates it? | Agent credentials from the agent platform or an identity provider, signed requests |
| KYBA (Know Your Business Agent) | An AI agent that acts for a company | Which company is behind this agent, and does the authority it claims match the register? | Agent identity, company facts from the register, the register's coded signing rules, evidence that can be kept |
The layers of KYBA
KYBA is several checks, not one. The table states what Apier provides for each layer today.
| Layer | Apier today | Status |
|---|---|---|
| Agent identity | Apier does not provide this. Agent identity comes from the agent platform or an identity provider. | NOT PROVIDED |
| Binding of the agent to a responsible company | Apier does not verify that an agent belongs to a company. The claim check compares what an agent states about a company (name, status, a person's role, a signing rule) with the register, claim by claim. | PARTLY |
| The company exists and is active | Registration status, organisational form and the bankruptcy, liquidation and dissolution flags from Brønnøysundregistrene, each with its source and the time it was read. | LIVE |
| Authority to sign or act for the company | The register's coded signing rules: signaturrett and prokura as coded combinations, with the verbatim clause. Never a verdict on whether a person may sign a given document. | LIVE |
| Delegated authority (fullmakt) | Withdrawn on 2026-10-21. Apier reads no delegation or fullmakt state, and the former routes answer 410 CAPABILITY_WITHDRAWN. | WITHDRAWN |
| Evidence that can be kept | Signed receipts, signed evidence packs, a public receipt log and daily anchors with an external timestamp. Anyone can verify them without an account. | LIVE |
How it works with Apier
Four steps. Apier answers steps two to four, over MCP or REST.
- Establish which agent you are dealing with. Use the agent platform or your identity provider. Apier is not part of this step.
- Ask the agent for the organisation number of the Norwegian company it acts for. Confirm that the company is registered and active with
get_company_verification(REST:GET /api/v1/company/{org}/verify). - Read the register's coded signing rules for the company with
get_company_authority(REST:GET /api/v1/company/{org}/authority). Your own process applies the rules to the action at hand. - Keep a signed record of what was observed with
get_company_evidence_pack(REST:GET /api/v1/company/{org}/evidence-pack). It verifies offline against the public key and the daily anchors.
curl -sS 'https://www.apier.no/api/v1/sandbox/public/company/999999999/authority' | jq .The sandbox answers for the test company 999999999 with the same response shape as production.
What Apier does not do
- Apier does not verify the AI agent itself and issues no agent identity.
- Apier does not decide whether a person may sign. It returns the register's coded signing rules, and your process applies them.
- Apier does not read or serve delegated authority (fullmakt). That capability was withdrawn on 2026-10-21.
- Apier submits nothing to government and brokers no government access.
- Apier is not an identity check of people and not a screening service.
- Apier covers companies in the Norwegian registers.
Questions about KYBA
- What is the difference between KYA and KYBA?
- KYA verifies the AI agent: which agent it is and who operates it. KYBA adds the business side: which legal entity the agent acts for, and the register's coded signing rules for that company.
- Is KYBA a regulation?
- No. KYBA is an industry term, not a law and not a formal standard. It describes checks a business may choose to run before it lets an AI agent act for a company or accepts an agent that does.
- Does Apier verify the AI agent itself?
- No. Agent identity comes from the agent platform or an identity provider. Apier provides company facts and the register's coded signing rules for Norwegian companies.
- How does KYBA relate to KYB?
- KYB verifies a company. KYBA uses the same company facts and adds the agent: the company is checked because an agent claims to act for it.
- Which part of KYBA does Apier provide?
- The company-authority layer for Norway: whether the company exists and is active, the register's coded signing rules for it, and signed evidence of what was read and when.
- Can Apier confirm that an agent may sign for a company?
- No. Apier returns the register's coded signing rules: signaturrett and prokura as Brønnøysundregistrene hold them. Whether a given action falls within them is for your process to decide. Apier does not read delegated authority (fullmakt).
- Can the result be kept as evidence?
- Yes. A signed evidence pack records what Apier observed and when. Anyone can verify it offline against the public key and the daily anchors. It is a record of an observation, not a verdict.
Related pages
- Norwegian company authority for AI agents: what an agent needs before it acts.
- Signature and authority: the register's coded signing rules for a company.
- Company verification: whether the company is registered and active.
- KYB API for Norwegian companies: the layer of KYB that Apier covers, and its limits.
- MCP server for Norwegian company data: how an agent connects and which tools it gets.
- Brreg signing authority API: the signing rules as JSON, with request and response.
- Guides: How does an AI agent verify a Norwegian company?
- Guides: Who can sign for a Norwegian company?
- Guides: How do I give my AI agent its own scoped API key?
- Guides: What is KYB and how does it work in Norway?
- Claude checks Telenor ASA through apier.no: a public run of steps two to four.