Everyone Is Building Machine Identity. The Chain Back to the Person Sits Empty.

By the APAC Compliance Lead, UWAY Innovation. Program-level guidance; operational, not legal advice.

Know Your Agent (KYA) is already on sale under two conflicting definitions. ERC-8004, NIST and the EU AI Act each pin down the machine. The only logging provision naming a natural person names the person who checks the results.

Vendors are shipping "Know Your Agent". Skyfire poses the question as "Which agent, acting on whose behalf, is authorized to do what, right now?" That phrase is the closest any of these products gets to a human being. It's inside one vendor's token design. No regulator has defined that field as a legal record.

The prior piece asked who's liable when an agent-initiated payment goes wrong. That question is downstream. Accountability starts with a file naming the person. Almost everything now being built answers a different question: what the machine is and what it's allowed to do.

Know Your Agent Is Already a Product

Two camps sell the term. The enterprise and payments line (Skyfire, AsterPay, Sumsub, Trulioo) reads it as agent identity with delegated authority and transaction-level permissions. The crypto line reads it as cryptographic proof of model integrity, usually zkML or TEE attestation. Both camps argue KYA matters. Their definitions conflict, and no regulator backs either.

AsterPay's own site says "KYA is not yet a single codified law." Skyfire says "KYA is not itself a universal regulatory requirement." Vendors undercutting their own pitch deserve a hearing. The term is occupied. Neither camp has solved the problem behind it.

The Standards Answer a Different Question

Three artifacts look like progress. The specs say otherwise.

ERC-8004 reached Ethereum mainnet in January 2026 with three registries: identity, reputation, validation (only the first two were live). Its identity is an owner-controlled ERC-721 token. In the project's own words, "Transfer the token, transfer ownership." "Trustless" in the title carries its technical sense: you don't need to know the counterparty. Its self-reported testnet count: 10,000+ agents and 20,000+ feedback over three months (ERC-8004).

NIST's NCCoE concept paper, Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization, covers identification, authorization, access delegation and logging. The stack it proposes to adapt is OAuth 2.0, OpenID Connect, SPIFFE/SPIRE and Zero-Trust (NIST, concept paper). Enterprise access-control vocabulary, naming workloads and services.

The EU AI Act's logging article is where the drafting turns. Article 12(3)(d) requires "the identification of the natural persons involved in the verification of the results, as referred to in Article 14(5)" (EU AI Act, Article 12). The only natural persons it names check the output. The principal sits outside the record. The same gap surfaces as personal AML liability across APAC.

E-Commerce: The Agent Became the Shelf

OpenAI's Instant Checkout launched with Etsy in September 2025 and claimed over a million Shopify merchants were coming. By February 2026 roughly 30 stores were actually live, a figure Shopify confirmed to Forrester. In March 2026 OpenAI pulled in-chat checkout and moved toward product discovery. Walmart gave one industry newsletter its own numbers, reported by March 2026: in-chat completion ran about a third of the rate a redirect to walmart.com produced, with new customers at twice the rate of search. By agentmarketcap.ai's account, Amazon sued Perplexity over a shopping bot in early 2026 and a federal judge barred the bot from shopping on Amazon.

Adobe's April 2026 benchmark found 66% of US retail product pages machine-readable. Comparison already happens at the crawl layer. The terms of service decide who gets the cart. The person behind the agent plays no part in that decision.

Travel: The GDS Became the AI Layer

Sabre opened its MCP server in September 2025. By 21 September 2026 Sabre's own count put close to 80 travel companies in pilot or production inside ChatGPT and Claude, including Virgin Australia, Flight Centre and Internova. Travelport repositioned in March 2026 as "the intelligence layer powering AI-driven travel commerce." Amadeus's 2026 report on 756 agencies found 43% using GDS more than they did in 2024.

Skift Global Forum 2026 opened on "who owns the traveler relationship when an AI agent does the booking." Coverage said the industry doesn't have a legal answer. Inventory ownership is settled. The traveler relationship hasn't. Nothing names the person behind the booking agent.

Finance: The Licence Sets the Perimeter

Hong Kong's stablecoin regime under Cap. 656 has produced two licences out of 36 applications since April 2026, and the HKMA has said the total "will remain very limited." GENIUS, Public Law 119-27, takes effect 18 January 2027 or 120 days after final federal implementing rules, whichever lands first; those rules were still proposals as of October 2026. The US joint CIP proposal of 22 June 2026 excludes from "customer" anyone "acquiring or redeeming a payment stablecoin from a means other than directly from or directly to the permitted payment stablecoin issuer."

AP2 v0.2 signs the closed mandate with an agent key. x402 opens with "No accounts or personal information needed." If issuance, redemption timing and capital all sit on one licensed entity, what an agent can reach is bounded by that licence. Where each APAC regulator draws that line is the map teams need.

What the Three Verticals Share

Each layer now has a working identity story for the machine. In commerce the agent holds shelf space inside someone else's app. Travel agents carry a booking pipe into a GDS; payment agents hold a key on a mandate. A token here, a workload ID there. Payments run on a signed mandate.

The chain running from that machine back to a named human is the part nobody's shipped. EU logging rules point at the reviewer of results. Terms of service point at whoever signed the merchant agreement. A licence names only the licensed entity. Merchants, acquirers and supervisors keep asking the same question in their own vocabularies. No file yet answers it. The move from licensing to evidence is where the series goes next.