--- title: "KYE Protocol™ — Certification program | Five-tier conformance ladder" description: "The KYE Protocol™ certification program. Five-tier ladder — Declared → KYE™ Self-Tested™ → KYE™ Self-Attested™ → KYE™ Conformant™ → KYE™ Certified™" url: https://kyeprotocol.com/certification/ lang: en source: "KYE Protocol" --- > The KYE Protocol™ certification program. Five-tier ladder — Declared → KYE™ Self-Tested™ → KYE™ Self-Attested™ → KYE™ Conformant™ → KYE™ Certified™ Certification program # Conformance you can replay with public keys alone. Five tiers, 133 black-box fixtures, 289 control mappings across 249 frameworks. Every claim at every tier is a signed artefact a regulator or auditor can verify offline. The protocol is Apache 2.0; certification is the only commercial layer. Why certify ## Three pressures, one artefact. ### Regulatory EU AI Act, DORA, PSD3, NIS2, FedRAMP and 9 more frameworks ask for evidence the protocol already produces. Certification is the bridge. ### Procurement Regulated buyers' procurement teams ask: "show us a signed conformance report you didn't write yourself." L3 / L4 are exactly that. ### Trust Public-key-verifiable claims defeat the "trust us" failure mode. Anyone can replay a certification artefact end-to-end. KYE™ Academy™ authority tracks ## Five tracks to make AI agents governable. The KYE™ Academy™ certifies the people who make AI agents governable. Each track targets one role on the path from a deployed agent to a replay-verifiable authority claim, and each ends at a credential the capstone exam recognises. Pick the track that matches what you ship. ### KYE™ for AI Builders Ship skills and agents bound to a Skill Authority Manifest — purpose, tool scope, finality, evidence, revocation — so the agent's authority is declared, not assumed. ### KYE™ for GRC / Risk Map agent authority to controls and verify a signed Evidence Pack™ offline with public keys alone. The audit becomes a replay, not a meeting. ### KYE™ for Sector Experts Productise your governance expertise into a KYE-Powered Pack™ through the [Sector Pack Foundry™](https://kyeprotocol.com/sector-pack-foundry/) — your framework, the protocol's authority spine. ### KYE™ for SIs / Consultants Deliver multi-week authority implementations with the [partner](https://kyeprotocol.com/partners/) playbook and earn a registry-listed implementer badge clients can verify. ### KYE™ Certified Agentic Governance Practitioner™ The capstone credential — proof you can take an agent from deployment to a defensible, replay-verifiable authority claim end-to-end. [Training paths per track →](https://kyeprotocol.com/training/#tracks) [KYE™ Learn™](https://kyeprotocol.com/academy/) The ladder ## Five tiers, each one a public claim. - L0 **Declared** — you publish a profile statement. No verification, no listing. The honest baseline; useful for early-stage integrations and roadmaps. - L1 **KYE™ Self-Tested™** — run the 129-fixture conformance pack locally and self-declare. _Available today._ - L2 **KYE™ Self-Attested™** — signed self-attestation (Ed25519, JWS) bundled with fixture results. _Available today; program verifies the signature._ - L3 **KYE™ Conformant™** — program review of schema + endpoint + behaviour + evidence shape + error codes + edge cases. _Program in development; opens with v1.1._ - L4 **KYE™ Certified™** — third-party-audited certification by an approved audit firm; annual revalidation. _Program in development; first audit firms onboarding with v1.1._ ### Capability-scoped Conformance badges Within each tier, an implementation can carry capability-scoped marks. Each badge attests to a defined slice of the conformance pack — not the whole thing — so an implementation can grow its claims one capability at a time. KYE™ Core Conformant™ Core authority, delegation, scope, state, audit, decision-code conformance against the Core fixture set. Program in development KYE™ Authority Conformant™ Authority Finality™ binding — actor · on-behalf-of · capability · scope · state · audit — tested end-to-end. Program in development KYE™ Capability Conformant™ Capability registry, grant, invocation, quarantine and cascade fixtures all pass. Program in development KYE™ Evidence Conformant™ Evidence Pack™ generation, signing, replay and OSCAL projection conformance. Program in development **Capability-scoped badges are still in development.** They become live once the public conformance program opens registration and the per-capability fixture pack is frozen. Until then, only the five tiers above are issued. Capability badges, when issued, will be versioned, time-limited, and link to a public verification record at `/badges/{badge_id}/verify` showing implementation, profile version, test-suite version, issued / expires dates, and revocation status. ### The badge artwork — embeddable shields These are the canonical badge templates. A per-customer badge is stamped from one of these shields plus a signed [Evidence Pack™](https://kyeprotocol.com/evidence-pack/) record, then served from `registry.kye.dev/badges/{badge_id}.svg` with a public verification link. The shields below are the templates those instances render from — one per level in the ladder. **Self-asserted** — free, run the open pack, no program review. **Program-verified conformance (L3)** — the umbrella mark plus capability- and profile-scoped variants. **Certified (L4)** — third-party-audited, listed in the public registry. Embed your earned badge once issued (replace the level + your verification URL): ``` KYE™ Conformant ``` 135 conformance fixtures ## Black-box, deterministic, replayable. The conformance pack is 133 black-box fixtures grouped into seven families. Each fixture takes a signed input, expects a deterministic output, and is replayable offline using the published key set. No fixture depends on hosted infrastructure; conformance is reproducible on a laptop. - **Identity & URN** — entity creation, URN parsing, class taxonomy, alias resolution, trust-domain assertions. - **Delegation chain** — chain construction, attenuation rules, parent ⊇ child enforcement, SCA-at-the-edge propagation. - **Authority grants** — capability binding, scope predicate evaluation, revocation, time-bound expiry. - **State & lifecycle** — state transitions, quarantine, suspension, replay, recovery. - **Decision & runtime** — `/v1/runtime/authorize` contract, decision codes, constraint emission, latency envelope. - **Evidence & audit** — append-only chain integrity, evidence-pack composition, OSCAL projection, public-key replay. - **Cascade & recovery** — cascade propagation properties (timing assertions only; mechanism is proprietary). 289 control mappings ## 249 frameworks, one rail. Conformance projects through the KYE™ Compliance Mapping Rail™ into 266 named controls across 249 frameworks. The same evidence pack satisfies multiple frameworks; you do not run separate audits for the same artefact. - SOC 2 (TSC 2017) · ISO 27001:2022 · ISO 42001 · PCI DSS 4.0 - PSD2 / PSD3 · DORA · NIS2 · EU AI Act - NIST AI RMF · NIST CSF 2.0 · NIST 800-207 (Zero Trust) - GDPR · FedRAMP Moderate / High · HIPAA · MiCA · IEC 62443 · 42 CFR Part 2 [Per-framework reference →](https://kyeprotocol.com/frameworks/) [OSCAL projection](https://kyeprotocol.com/oscal/) [AI System Compliance Card™](https://kyeprotocol.com/compliance-card/) Approved audit firms ## L4 audits, by firms a regulator already accepts. L4 audits are run by independent firms approved by the KYE Protocol™ program. Approval criteria: SOC 2 / ISO 27001 / EU AI Act-notified-body credentials, prior regulated-sector audit experience, and a signed audit-firm agreement that aligns scope, evidence handling, and report format. Audit firms do not pay to be listed; partners and end customers select from the published list. _The approved-audit-firm roster opens with the v1.1 release. Firms interested in joining should contact the program via the link below._ Audit firm enquiry → [Auditor view of the protocol](https://kyeprotocol.com/auditors/) Maintaining certification ## Cadence + change-notification. 1. M1 **L1 / L2 self-tiers.** Re-run fixtures whenever your integration changes; resubmit signed report. No fixed cadence. 2. M2 **L3 KYE™ Conformant™.** Notify the program on any breaking change. Program spot-checks 10% of L3 partners per quarter. Listing flagged if checks fail. 3. M3 **L4 KYE™ Certified™.** Annual revalidation by your audit firm. Listing carries the last-revalidation date. Lapsed certifications drop to L3 status until refreshed. 4. M4 **Spec version bumps.** Major-version bumps (v1 → v2) require re-certification within 12 months. Minor bumps are additive; no re-cert. Start ## Begin certification. For most teams, the path is L1 first (run fixtures, find gaps), then L2 (sign + submit), then L3 (program review). L4 is the destination, not the starting point. [Get the conformance pack →](https://github.com/KYE-Protocol) Talk to the program [Partner program](https://kyeprotocol.com/partners/) [Readiness self-test first](https://kyeprotocol.com/readiness/) Adjacent reading ## Where to go next. [Conformance & mappings →](https://kyeprotocol.com/compliance/) [Per-framework](https://kyeprotocol.com/frameworks/) [Training](https://kyeprotocol.com/training/) [Working groups](https://kyeprotocol.com/working-groups/) ## Ready to see your AI agents flagged? Start in shadow mode. We’ll deliver your first Evidence Pack™ in 4–8 weeks. [Apply for pilot →](https://kyeprotocol.com/pilot-apply/) [Try the sandbox →](https://kyeprotocol.com/sandbox/demos/) Canonical KYE™ surfaces referenced on this page: [KYE Protocol™](https://kyeprotocol.com/).