KYE Protocol™ — the Entity Trust Control Plane for AI-native systems.

KYE™ adds a delegated-authority, evidence, and runtime-decision layer on top of the stack you already run.

2026-05-15 · v3.1 · KYE Protocol™ Ltd

From KYX to KYE™

Categories verify. Protocols govern.

KYC verifies the customer. KYB verifies the business. KYA verifies the agent. The natural next step was KYX — know your X. But KYX is still verification at onboarding. Once every component of a digital system — human, agent, model, dataset, tool, downstream API — can act under delegated authority, governance has to be a protocol, not a stitched-together report.

• KYC / KYB / KYA — verify a category of actor once, at onboarding.
• KYX — the generalisation. Works for new categories, still a verification step.
• KYE™ — runtime governance. Every action governed, every inference evidenced, every delegation replayable.

AI agents don’t just identify. They act. Existing systems verify who logged in. They cannot prove what was invoked, on whose behalf, against what dataset, under what policy, at what risk class, and whether the call is auditable. Read the full thesis →

Why existing tools are not enough

IAM controls access. KYE™ governs every inference.

KYE™ does not replace existing infrastructure. It adds the missing per-inference accountability layer.

The KYE™ answer

Seven questions every AI-native call must answer.

The KYE™ Runtime Gateway™ resolves each one before the inference reaches downstream systems.

The wedge

Start with evidence. Move to enforcement when ready.

KYE™ ships in four Edge Governance modes (Shadow · Advisory · Guarded · Strict). You pick which.

First use case

Per-inference accountability for enterprise AI.

Enterprise AI copilots Agentic payments Procurement agents Customer-support agents Compliance investigation agents Third-party AI workflows Open-finance workflows Clinical decision support

First commercial wedge: regulated AI workflows in financial services under EU AI Act, DORA, and the FCA Operational Resilience regime.

How it works

Every inference resolves to a canonical entity chain.

Entity hierarchy v3.1 (constitution §1a, locked 2026-05-15). The Runtime Gateway answers the seven questions against the leaf kye:endpoint:….

Tenant kye:tenant:…

Workspace kye:wsp:…

Model Endpoint kye:endpoint:… · policy_set + evaluation_profile + audit_stream

Runtime Gateway™ seven-question decision

Evidence Pack™ → Audit Stream kye:audstream:… → SIEM / GRC / Cold storage

A kye:model:… is the artefact. A kye:endpoint:… is the bound URL with its own governance — that is what gets verified.

The control plane

KYE™ Runtime Gateway™ — the canonical answerer.

If a single question is unresolved at the edge, the Runtime Gateway never silently allows — it falls back to the declared mode and writes an Offline Evidence Log entry that reconciles on next sync.

Constitutional locks

The protocol governs itself.

Constitution §0.3 (adopted 2026-05-15). Every CI run, deploy, schema migration, secret rotation, and domain binding is governed by the same engines that govern customer inferences.

Customers do not have to trust our claims. They can replay them — against the same Evidence Pack™ format the Runtime Gateway emits for their own inferences.

The platform

Ten engines × eight rails — one protocol.

Engines are the computation primitives. Rails are the user-facing surfaces that orchestrate them. Locked by constitution §14.

Evidence Pack™ example

Every inference produces replayable evidence.

• Actor — kye:prin:… that initiated the call
• Endpoint — kye:endpoint:… resolved at decision time
• Principal chain — delegated-authority path
• Policy set — active Operating Model™ hash
• Dataset reference — approved-purpose binding
• Jurisdiction — caller + datapath
• Risk score — signed kye.risk.score.v1
• Runtime decision — allow / deny / approval / shadow
• Payload hash — tamper-evident
• Replay seal — kye.replay.context_seal.v1

{
  "evidence_pack_id": "kye:evp:acme.example:01JYEVP0...",
  "issued_at":        "2026-05-15T13:31:00Z",
  "endpoint_id":      "kye:endpoint:acme.example:claude-sonnet-eu-2",
  "actor_principal":  "kye:prin:acme.example:agent:ops-copilot",
  "runtime_gateway": {
    "mode":        "strict",
    "q1_verified":  "true",
    "q2_allowed":   "true",
    "q3_dataset":   "approved",
    "q4_jurisdiction": "eu-west",
    "q5_policy":    "compliant",
    "q6_risk_class": "high-suitable",
    "q7_auditable": "sealed"
  },
  "control_refs": [
    "EU_AI_ACT.AIA_HIGH_RISK_LOGGING",
    "EU_AI_ACT.AIA_HUMAN_OVERSIGHT",
    "DORA.ICT_RISK_REGISTER",
    "ISO_42001.AIMS_8_2"
  ],
  "risk_score": {
    "value":        12,
    "out_of":       100,
    "signature_suite": "ed25519-2025"
  },
  "replay_context_seal": "sha256:9c8a..."
}

Every Evidence Pack™ is replayable offline — auditors verify against the canonical format, not your screenshots.

Advanced assurance

Beyond local validity.

KYE™ can simulate what could happen, brief approvers before action, and detect when a locally valid system has become decoupled from current reality.

Enterprise value

What each audience gets.

Pilot offerings

Six productised pilots. Fixed scope. Closed registration.

Every pilot has its own onboarding agent, demo seed pack, dashboard preset, Evidence Pack™ sample, and signed final report. The commercial menu is sent to qualified applicants by email — not published.

Pilot fees credit 100% against the first-year annual licence when signed within 60 days — the commercial menu and conversion terms are shared after qualification.

Call to action

Start with one workflow.

1. Pick a pilot. Define one AI workflow and the model endpoint that backs it.
2. Bind the Runtime Gateway™ in Shadow mode — no production block.
3. Generate Evidence Packs™ on every inference. Receive the signed final report.
4. Surface authority gaps, jurisdiction drift, risk-class violations.
5. Convert pilot → annual at the right tier. Pilot fee credited at signature.

After you apply, the qualification team responds within 2 business days with the full commercial menu, conversion terms, and pilot scope draft.

Start with evidence. Move to enforcement when ready.

Canonical KYE™ surfaces referenced on this page: Audit Pilot · Delegated Auditability · Evidence Pack™ · KYE™ Cloud™ · KYE™ Directory™ · KYE™ Edge Governance™ · KYE™ MCP Server · KYE™ Onboarding Agent · KYE Protocol™ · Purpose Permission · Resilience Loop.