KYE™ Agent Library™ · v1
Every regulated operation — monitoring for BSA/AML, enforcing SCA on payments, tracing DSCSA drug lots, filing DORA incident reports — is a well-specified agentic workflow. The KYE™ Agent Library™ publishes those workflows as signed, versioned, adoptable agents. Adopt one as a platform-managed subscription, or derive a tenant-tightened variant. The Agent Library™ is a companion primitive to the KYE™ State Library™.
You learn: How it works, one stage at a time. You can: Run it end to end.
Integrity-locked
KYE Protocol™
machine_seal is sha256 of canonical sorted JSON; seal is recomputed and verified at adoption time.
Derivation-safe
KYE Protocol™
The schema has no removed_* keys. Deriving agents can only add or tighten — never weaken.
Regulation-cited
KYE Protocol™
Each sector agent cites the specific regulation clause it enforces — 31 C.F.R. § 1020.320 (SAR), PSD2 Art 97 RTS (SCA), 45 C.F.R. § 164.528 (HIPAA), DORA Art 19(4)(a), EU AI Act Art 73, and more.
Companion to the State Library
KYE Protocol™
Sector agents reference the compatible State Library entries they consume, creating a coherent lifecycle + agent graph for each regulated entity class.
1 · What it is
Each entry is a JSON document conforming to kye.agent.library_entry.v1 — triggers (cron, queue, HTTP, signal), typed inputs and outputs, required Cloudflare bindings, declared capabilities, constitutional obligations, platform_locked_capabilities that tenants cannot remove, a machine_seal sha256 over canonical content, and a detached Ed25519 signature. Tenants adopt by reference and may add triggers, add inputs, add outputs, add obligations, or tighten capabilities. They cannot remove anything present in the base entry, and locked capabilities cannot be denied.
removed_* keys. Deriving agents can only add or tighten — never weaken.2 · The catalog
Core state-machine infrastructure: state transition validator enforcing guard predicates and actor-role requirements; derivation conformance checker auditing every derivation against platform_locked_obligations; relationship orphan sweeper; signal replayer for incident reconstruction; ClickHouse backfiller; native FTS5 search reindexer; cross-region state-event replicator.
Library lifecycle management: library curator validating and publishing new Agent Library entries from CI; library signer computing canonical machine_seal and attaching Ed25519 signatures; tenant archiver producing signed NDJSON cold-storage bundles per data-retention schedules.
Platform-wide security: policy compiler producing deterministic sealed bundles (rules / purpose / gates / evidence-trigger / webhook); policy binding evaluator refusing to evaluate any bundle whose seal does not resolve to a deployed Operating Model; grant cascade auditor tracing revocation propagation within 15 minutes; cron watchdog detecting missed scheduled runs within one 5-minute cycle.
Banking BSA/AML Monitor enforces Bank Secrecy Act obligations under 31 U.S.C. § 5318(g) and 31 C.F.R. § 1020.320. Monitors entity state transitions and transaction events for suspicious-activity patterns, generates SAR candidates with a 30-day filing deadline, and raises CTR obligations for cash transactions ≥ $10,000 per 31 C.F.R. § 1010.311. Compatible with the banking.kyc_check, loan_application, and credit_facility State Library entries.
Payments SCA Enforcer evaluates transaction risk and applies Strong Customer Authentication under PSD2 Art 97, Commission Delegated Regulation 2018/389 (RTS on SCA), and UK PSRs. Manages TRA, low-value, and recurring exemptions per EBA fraud-rate thresholds. All SCA decisions are signed and retained for 5 years per PSD2 Art 248. Compatible with the payments.payment_intent and banking.merchant_onboarding State Library entries.
Insurance Claim Orchestrator manages FNOL-to-settlement lifecycle, enforcing 24-hour acknowledgement under FCA ICOBS 8.1, best-estimate reserving per Solvency II Art 77, and mandatory fraud-indicator checks before settlement authority under the Insurance Act 2015. Emits signed reserve-calculation records and claim-action audit logs throughout the claim lifecycle.
Healthcare HIPAA Guard enforces minimum-necessary access under 45 C.F.R. § 164.502(b), maintains 6-year disclosure accounting records per 45 C.F.R. § 164.528, and emits breach-candidate signals triggering the 60-day HHS notification window per 45 C.F.R. § 164.412. Every PHI access is evaluated in real time against healthcare entity authority grants.
Pharma DSCSA Tracer enforces Drug Supply Chain Security Act obligations under 21 U.S.C. § 360eee-1: verifying Transaction Information and Transaction Statements at each change of ownership, detecting suspect and illegitimate product within 24 hours, and retaining all transaction records for 6 years. Integrates with EPCIS serialisation data and the authorised trading-partner registry.
Logistics Customs Bridge files Automated Export System (AES) declarations per 15 C.F.R. § 30.4 before export, and bridges shipment state-machine events with customs authority gateways (AES/ACI/CHIEF). Notifies shipment owners within 2 hours of a customs hold per WCO SAFE Framework Standard 1 and EU Union Customs Code Art 55.
Energy REMIT Reporter monitors wholesale market transactions and inside information under EU REMIT Regulation 1227/2011 and REMIT II (Regulation 2024/1106). Generates ACER-format transaction reports within T+1 per REMIT Art 8 and enforces immediate public disclosure of inside information per REMIT Art 4 through the registered reporting mechanism API.
RegTech DORA Incident Manager classifies ICT-related incidents per EU DORA Regulation 2022/2554 RTS thresholds and manages the full reporting timeline: initial notification within 4 hours (Art 19(4)(a)), intermediate report within 72 hours (Art 19(4)(b)), and final report within 1 month of resolution (Art 19(4)(c)). Maintains the DORA incident register and submits reports to competent authorities via the regulator gateway.
AI Act Conformance Agent classifies AI system entities by risk tier, verifies conformity assessment completeness per EU AI Act Regulation 2024/1689 Art 43, monitors high-risk system obligations (automatic logging Art 12, human oversight Art 14), and triggers serious incident reports to the market surveillance authority within 15 days per Art 73. Compatible with the ai_governance.ai_inference_run State Library entry.
Companion family
The Agent Library™ above lists reference workflows you run. The KYE™ Governed Agents™ family is different: these are the bounded agents KYE Protocol™ runs as products. Each one is a first-class principal — authority-bound, evidence-sealed, metered, and kill-switched. This list is derived from the product registry, so a new agent shows up here on its own.
3 · Adopt + derive
The KYE™ Agent Library™ adoption flow has two modes, both enforced by the platform through the same seal-verification step.
kye.agent.derivation.v1 document listing additions only: extra triggers, extra inputs, extra outputs, extra obligations, tightened capabilities. The platform merges the derivation on top of the base entry at runtime. The base-entry seal is always re-verified first. Forbidden derivation keys (removed_triggers, removed_inputs, removed_outputs, removed_obligations, removed_capabilities) are rejected at write time by the adoption API — the schema does not define them.In both modes, platform_locked_capabilities cannot be removed or denied. The Policy Decision Point verifies this at every evaluation cycle.
4 · Open source
The 23 starter Agent Library entries are published under Apache-2.0 in the KYE Protocol™ GitHub organisation. The schemas (kye.agent.library_entry.v1, kye.agent.derivation.v1) are published under MIT. The adoption API, seal-verification logic, and Policy Decision Point integration are part of the KYE Protocol™ platform.
5 · Get started
Early access to the KYE™ Agent Library™, KYE™ State Library™, and the full KYE Protocol™ platform is available to regulated financial institutions, healthcare providers, logistics operators, and energy market participants under the pilot program.
Canonical KYE™ surfaces referenced on this page: KYE Protocol™.