Conformance you can replay with public keys alone.
Five tiers, 133 black-box fixtures, 289 control mappings across 249 frameworks. Every claim at every tier is a signed artefact a regulator or auditor can verify offline. The protocol is Apache 2.0; certification is the only commercial layer.
Three pressures, one artefact.
Five tracks to make AI agents governable.
The KYE Academy™ certifies the people who make AI agents governable. Each track targets one role on the path from a deployed agent to a replay-verifiable authority claim, and each ends at a credential the capstone exam recognises. Pick the track that matches what you ship.
Five tiers, each one a public claim.
- L0Declared — you publish a profile statement. No verification, no listing. The honest baseline; useful for early-stage integrations and roadmaps.
- L1KYE Self-Tested™ — run the 129-fixture conformance pack locally and self-declare. Available today.
- L2KYE Self-Attested™ — signed self-attestation (Ed25519, JWS) bundled with fixture results. Available today; program verifies the signature.
- L3KYE Conformant™ — program review of schema + endpoint + behaviour + evidence shape + error codes + edge cases. Program in development; opens with v1.1.
- L4KYE Certified™ — third-party-audited certification by an approved audit firm; annual revalidation. Program in development; first audit firms onboarding with v1.1.
Capability-scoped Conformance badges
Within each tier, an implementation can carry capability-scoped marks. Each badge attests to a defined slice of the conformance pack — not the whole thing — so an implementation can grow its claims one capability at a time.
/badges/{badge_id}/verify showing implementation, profile version, test-suite version, issued / expires dates, and revocation status.
The badge artwork — embeddable shields
These are the canonical badge templates. A per-customer badge is stamped from one of these shields plus a signed Evidence Pack™ record, then served from registry.kye.dev/badges/{badge_id}.svg with a public verification link. The shields below are the templates those instances render from — one per level in the ladder.
Self-asserted — free, run the open pack, no program review.
Program-verified conformance (L3) — the umbrella mark plus capability- and profile-scoped variants.
Certified (L4) — third-party-audited, listed in the public registry.
Embed your earned badge once issued (replace the level + your verification URL):
<a href="https://registry.kye.dev/badges/{badge_id}/verify">
<img src="https://registry.kye.dev/badges/{badge_id}.svg" alt="KYE Conformant" height="24" />
</a>Black-box, deterministic, replayable.
The conformance pack is 133 black-box fixtures grouped into seven families. Each fixture takes a signed input, expects a deterministic output, and is replayable offline using the published key set. No fixture depends on hosted infrastructure; conformance is reproducible on a laptop.
- Identity & URN — entity creation, URN parsing, class taxonomy, alias resolution, trust-domain assertions.
- Delegation chain — chain construction, attenuation rules, parent ⊇ child enforcement, SCA-at-the-edge propagation.
- Authority grants — capability binding, scope predicate evaluation, revocation, time-bound expiry.
- State & lifecycle — state transitions, quarantine, suspension, replay, recovery.
- Decision & runtime —
/v1/runtime/authorizecontract, decision codes, constraint emission, latency envelope. - Evidence & audit — append-only chain integrity, evidence-pack composition, OSCAL projection, public-key replay.
- Cascade & recovery — cascade propagation properties (timing assertions only; mechanism is proprietary).
249 frameworks, one rail.
Conformance projects through the KYE Compliance Mapping Rail™ into 266 named controls across 249 frameworks. The same evidence pack satisfies multiple frameworks; you do not run separate audits for the same artefact.
- SOC 2 (TSC 2017) · ISO 27001:2022 · ISO 42001 · PCI DSS 4.0
- PSD2 / PSD3 · DORA · NIS2 · EU AI Act
- NIST AI RMF · NIST CSF 2.0 · NIST 800-207 (Zero Trust)
- GDPR · FedRAMP Moderate / High · HIPAA · MiCA · IEC 62443 · 42 CFR Part 2
L4 audits, by firms a regulator already accepts.
L4 audits are run by independent firms approved by the KYE Protocol™ program. Approval criteria: SOC 2 / ISO 27001 / EU AI Act-notified-body credentials, prior regulated-sector audit experience, and a signed audit-firm agreement that aligns scope, evidence handling, and report format. Audit firms do not pay to be listed; partners and end customers select from the published list.
The approved-audit-firm roster opens with the v1.1 release. Firms interested in joining should contact the program via the link below.
Cadence + change-notification.
- M1L1 / L2 self-tiers. Re-run fixtures whenever your integration changes; resubmit signed report. No fixed cadence.
- M2L3 KYE Conformant™. Notify the program on any breaking change. Program spot-checks 10% of L3 partners per quarter. Listing flagged if checks fail.
- M3L4 KYE Certified™. Annual revalidation by your audit firm. Listing carries the last-revalidation date. Lapsed certifications drop to L3 status until refreshed.
- M4Spec version bumps. Major-version bumps (v1 → v2) require re-certification within 12 months. Minor bumps are additive; no re-cert.
Begin certification.
For most teams, the path is L1 first (run fixtures, find gaps), then L2 (sign + submit), then L3 (program review). L4 is the destination, not the starting point.
Where to go next.
Ready to see your AI agents flagged?
Start in shadow mode. We’ll deliver your first Evidence Pack™ in 4–8 weeks.