Learn → Review → Build → Pilot → Conform → Certify.

You are: open-banking architect, payments specialist, identity / IAM lead, OAuth/OIDC committee member, AI-governance researcher, audit / cybersecurity / regulated-finance expert, legal-tech reviewer.

You want: the protocol primitives surfaced clearly enough that you can critique the model end-to-end — and tell us where it breaks.

What we ask: not “what do you think?” — specific questions, against specific artefacts.

• Does the chain actor → principal → capability → scope → state → decision → evidence map cleanly to your domain?
• Is on-behalf-of modelled correctly — particularly for delegated authority, consent, payment initiation, agent operations?
• What breaks in open banking, payments, regulated finance, healthcare, critical infrastructure?
• What should be mandatory in the spec vs. optional in a profile overlay?
• What would make this credible to banks, auditors, regulators, infrastructure providers in your jurisdiction?

You are: board / CIO / CISO / risk / compliance / legal / finance lead. AI agents already touch your business; nobody has shown you the chain of authority behind their actions.

You want: to know what KYE™ reduces — liability, audit cost, incident-response time, regulatory ambiguity — before any procurement conversation.

What we run: the KYE™ Authority Mapping Workshop. 60–90 minutes. We work through one of your real agent flows live.

You walk away with: an authority map, a delegation map, a capability map, the risk areas, the evidence gaps, and a written pilot recommendation. No slides; the artefact is the deliverable.

You are: supervisor / examiner at a financial-services authority, data-protection authority, AI Act notified body, NIS2 CSIRT, sector regulator.

You want: to know exactly which obligations the protocol claims to evidence — and which it does not.

What we publish: 266 control mappings across 13 horizontal frameworks (SOC 2 · ISO 27001:2022 · PCI DSS 4.0 · PSD2/PSD3 · DORA · NIS2 · EU AI Act · ISO 42001 · NIST AI RMF · NIST 800-207 · NIST CSF · GDPR · FedRAMP) plus sector overlays. Honest non-goals are documented in the threat-model page. We deliberately do not say “KYE™ makes you compliant”; we say KYE™ produces evidence; certifications remain the customer’s.

You are: a regulated enterprise — bank, insurer, asset manager, custody desk, hospital network, telecom, energy operator, federal agency — with at least one AI agent in production or imminent.

You want: a 2–4 week proof that KYE™ answers who acted, on whose behalf, with what authority, in what state, with what evidence for a real flow.

The pilot scope — pick one:

• AI payment agent (open-banking / payment-initiation)
• Open-banking consent + delegation
• MCP tool governance
• Internal service-account authority
• Healthcare data-access agent
• Critical-infrastructure operator action

Deliverables — produced live, not slides:

• Authority model · entity graph · delegation chain · capability registry
• Live /v1/runtime/authorize decision endpoint
• Per-decision Decision Map™
• Audit-event stream into your SIEM
• Signed evidence pack (replayable)
• Conformance report against the 41-fixture pack
• Gap report · sector-overlay recommendation

Outcome: a single-paragraph artefact you can put in front of your regulator, board, or external auditor — “Here is exactly how KYE™ proves who or what acted, on behalf of whom, using which capability, under what authority, in what state, and with what evidence.”