Understand the rail — concepts, glossary, frameworks.

A runtime permit checks the action; it never checks whether the principal held authority to take it. Authority is decided at the boundary — that is Authority Finality™.

A trace records what an AI agent did; it holds no grant proving the action was authorised. Authority is decided at the boundary — that is Authority Finality™.

AI governance is converging on a single structural conclusion: written policy and pre-deployment assessment are necessary but not sufficient.

What is Agentic Governance™? The category KYE Protocol™ defines — governance FOR agentic systems (humans, AI agents, hybrid authority) resolved to Authority Finality™.

Why must governance become executable as AI moves exponentially? Policy cycles take years; capability compounds in months — the execution boundary is the only layer fast enough.

Twelve do

A German court has held that an AI provider is responsible for the answers its AI presents, and that the responsibility cannot be shifted to the reader — reporting based on publicly available…

A financial-stability regulator has, in effect, told the market that a paragraph of instructions is not a control — reporting based on publicly available sources, not legal or compliance advice.

An API key grants reach to an endpoint; it never grants a per-action verdict on whether the actor was authorised. Authority is decided at the boundary — that is Authority Finality™.

What is in the KYE Protocol™ analyst briefing? An Agentic Governance™ category definition, a company fact sheet, and a competitive-landscape map versus adjacent vendors.

How is the Agentic Governance™ category defined for analysts? Governance FOR agentic systems on five primitives — act, authority, purpose, scope, evidence — resolved to finality.

In the Authority Court, the defendant is the agent

What is Authority Governance™? The category KYE Protocol™ defines: governing who is allowed to let an AI take a consequential action — the authority layer above describe-and-monitor AI governance.

Decision provenance shows how an AI outcome was produced; authority provenance proves the actor was institutionally entitled to cause the effect — settled at the boundary as Authority Finality™.

Decision-admissibility validates a decision against a compiled rule; it does not entitle an actor to act. Action-authority is decided at the boundary — that is Authority Finality™.

How do I get certified to build governed AI agents? Earn a KYE™ certificate — the Builder credential or its Insurance specialisation — by building an agent whose Evidence Pack™ replays, not by quiz.

Canonical definitions for AI governance terms — AI governance, delegated authority, Purpose Permission, evidence pack, Replay-Proof, authority gap, shadow mode, four-eyes, and more.

How does KYE Protocol™ work? It resolves authority before an action, then seals replayable evidence — eight steps: actor, authority, scope, policy, decision, evidence, replay, revocation.

Agent identity proves who is acting; it does not decide what they may do. Authority is decided at the boundary from the principal

What is ISO/IEC 42001 and how do you certify — clauses 4-10 explained, Annex A

KYE Authority Fellows™ is a free, self-serve authority certificate program for women, minorities, and developing-country AI practitioners — Bronze to Gold via credited contributions.

The KYE Authority Pulse™ is the weekly bulletin of what changed inside the KYE Protocol™ canon — new governance chapters, new frameworks under mapping, new commercial products, and new governed…

KYE Community™ is a zero-cost open community for AI practitioners learning to prove agent authority — free KYE Learn™ courses, the open-source Constitution Kit, and the Authority Fellows™ program.

Not all agents are equal. The KYE Consequential Actor™ Framework™ grades AI agents across five levels — L0 Informational to L4 Systemic — by how much governance each requires.

KYE Governed Proposal Authority™ turns a SERPRO governed data-query partnership context into a deterministic, fully-cited, replay-sealed proposal.

KYE Learn™ — the canonical education centre for AI governance, agentic AI risk, model risk frameworks, and players landscape.

The KYE Protocol™ certification program. Five-tier ladder — Declared → KYE Self-Tested™ → KYE Self-Attested™ → KYE Conformant™ → KYE Certified™ — backed by 133 conformance fixtures

The six clickable KYE Protocol™ primitives — Identity, Authority, Scope, State, Audit, On-Behalf-Of — each with its canonical schema, endpoint, JSON example, decision role, audit event

Frequently asked questions about KYE Protocol™ — Authority Finality™, conformance, deployment, integration, regulation, governance, profiles, roadmap.

Plain-English definitions of every KYE Protocol™ term: Authority Graph™, Decision Map™, Authority Finality™, on-behalf-of, attenuation, cascade, evidence pack, ePDP, PEP / PDP, decision codes

Governance for the AI Web reduces Systemic Authority Risk™ — who authorised what across the web of humans and AI agents — via four products over the existing KYE™ rails.

Learn KYE™ by your role and your time budget — KYE Protocol™ training. Self-paced learning paths, live workshops (Authority Mapping, Pilot Kickoff, Auditor Replay), train-the-trainer for partners, and

Canonical KYE Protocol™ vocabulary: entity types, action types, decision codes, reason codes, capability kinds, side-effect levels, data classes, signal types, redaction fields, taxonomies

Dictionaries are versioned lists of canonical terms — definitions, categories, severities, control mappings. Rules reference dictionaries by reason_code; the Rules Gateway™&trade

Observability watches what an AI agent does; it never decides whether the agent was authorised to act. Authority is settled at the boundary — that is Authority Finality™.

What is the Open Agent Governance™ Foundation™? The open working group convened to standardise Agentic Governance™ — shared schemas, evidence-pack formats, and conformance tests.

Where can I read KYE Protocol™

Inference-time reasoning control shapes a model

As agentic tools get better at execution, the durable value moves to judgment — and judgment, made enforceable at the moment of action, is what governance is.

Healthcare organisations are adopting AI into clinical and operational decisions — triage, diagnosis support, documentation, scheduling, prior authorisation — while sitting on the most sensitive…

Financial institutions are deploying AI into decisions that regulators already supervise — creditworthiness, fraud, market and model risk — faster than their governance programmes can keep up.

The industry now agrees on how to secure an enterprise AI agent — and that agreement stops one layer short of authority.

How does SR 11-7 model risk guidance apply to AI agents — the four classic categories extended to action risk, the three-line model, documentation expectations, KYE Protocol™ mapping.

What is the KYE™ 26-Hour Governed Run? A fully autonomous agent working 26 continuous hours with no human in the loop, every action governed and replay-verifiable under KYE Protocol™, streamed live.

A successful AI-agent action is not a legitimate one. The Authority Court puts the action on trial and asks whether it was authorised, in scope, at t=0 — and the verdict is Authority Finality™.

The loudest AI-governance fear is the rogue agent.

What does the EU AI Act actually demand of AI agents — risk tiers, prohibited practices, high-risk obligations, GPAI rules, the four obligations that bite hardest, timeline 2025-2027.

The KYE Protocol™ Blog argues doctrine: the layers mistaken for authority — observability, traces, permits, identity, keys — and the boundary that separates each from Authority Finality™.

What is the Map of KYE™? The protocol drawn as a cypress — its canopy is the chain of legitimacy (Purpose to Finality), and selecting a stage lights that foliage.

Digital-rights enforcement has moved from "do you have a privacy policy?" to "prove what happened" — and most organisations cannot answer at execution time.

What is the Research Program? Governed publishing — no claim without a cited source, every report evidence-sealed and replay-verifiable; institutes co-author via the Publishing Authority Track™.

The return on AI is no longer in doubt — and that is precisely why governance is now the constraint that matters.

There is a measurable gap between what organisations say about their AI governance and what they can actually prove — and that gap is invisible until the first incident, when it becomes the whole…

What is the trust layer for consequential action? The layer that decides whether an action may proceed, records why, and makes that authority final and provable — KYE Protocol™.

The headline insider threat of 2026 is not a disgruntled employee — it is an AI agent that was manipulated into turning against the organisation that runs it.

Who plays in AI governance — GRC suites, AI-risk newcomers, model-eval platforms, agent-governance specialists — where each falls short and how to choose.

Who is accountable for an AI answer? The party that presents it as authoritative — KYE Protocol™ records the authority and cited basis so it is provable. Reporting, not legal advice.

How does a bank prove BCBS 239 lineage and SR 11-7 / SS1/23 model authority? The hub maps every principle to the KYE™ artefact, event family, and gate that binds it — with a live SHA-256 lineage proof.

DORA — Digital Operational Resilience Act: control mappings to KYE Protocol™ canonical artefacts. Financial entities in the EU — credit institutions, payment institutions, e-money institutions, inve…

The v3 KYE Protocol™ entity containment tree: Tenant siblings, Workspace siblings, and first-class Model, Tool, External App, and Audit Stream entities — each with its own ID, state machine

EU AI Act — Articles 14 + 15 (Human Oversight + Accuracy/Robustness): control mappings to KYE Protocol™ canonical artefacts.

ISO/IEC 42001:2023 — AI Management Systems: control mappings to KYE Protocol™ canonical artefacts. Any organisation that provides, develops, or uses AI systems — irrespective of sector. The first for…

Authority Finality™ Diagnostic — 24 questions × 6 lenses scoring your agentic AI authority posture. Free score in IDE; signed report envelope (3 / month / email free; unlimited on paid pilot).

KYE Data Governance Pack™ — runtime data governance for delegated AI-agent actions. data_use PDP stage + 7 default-deny rules + 268 dictionaries + signed evidence per access

KYE DSAR Evidence™ Pack™ — signed bundle of every audit-chain entry involving a named data subject. GDPR Art. 15 / UK DPA Pt 3 Ch 3 / CCPA. Offline-verifiable by the requesting subject

Buyers — what are the seven KYE GovernedUI™ modules? Action Approval, Entity Passport, Authority Scope, Critical Point Review, Evidence Timeline, Approval Queue, Authority Drift.

No blind approvals for AI-agent actions — KYE Approval Brief™ assembles actor, principal, authority, scope, state, and risk into a structured, signed brief — so human approvers decide informed

KYE Protocol™ Acceptable Use Policy. Prohibited uses, prohibited content, automated-behaviour limits, security obligations, abuse reporting, suspension.

KYE Action Admissibility™ Profile™ — checks whether a proposed action is admissible into the authority pipeline before any authority, formal-rule or commit-boundary check runs. Six decision values

The public KYE Protocol™ schemas, OpenAPI definitions, examples and SDKs are released under the Apache License 2.0. This page reproduces the full text.

KYE Protocol™ brand kit: master logo, indigo brand colour (#6366f1), charcoal ink, type, spacing, clear-space and the misuse list. Source of truth for every surface.

Procurement: when planned KYE™ changes take effect — 90-day breaking-change notice, 30-day sub-processor notice, 7-day maintenance notice. Machine-readable at /change-calendar.json.

Upgrade your build here s what s new — KYE Protocol™ chronological release notes. v1.0.0 frozen April 2026; rolling v1.0.x patch series; v1.1 preview profiles in flight. Per-release scope, breaking-ch

Find consultants who can deploy, migrate, extend and govern CKAN-based data portals with KYE Protocol™ authority, evidence, control mapping and audit-ready publication workflows

Per-framework reference: which KYE Protocol™ controls map to which obligation, with framework scope, official source, and the canonical KYE Compliance Mapping Rail™ binding.

The KYE Continuity Module™ checks whether the authorised meaning of an action survives delegation, interpretation, memory, context, incentives, timing

KYE Continuity Profile™ preserves the chain between intent, interpretation, delegated authority, state, decision, execution and evidence. Detect intent drift, authority drift, scope drift

KYE Protocol™ Cookie Policy. No first-party cookies, no analytics or advertising trackers; a few localStorage keys for theme and update read-state; strictly-necessary host security cookies only.

KYE Protocol™ Data Processing Addendum, GDPR Article 28 compliant. SCCs incorporated, sub-processor list, security measures, data-subject rights handling, return/deletion on termination.

What is the KYE™ Decision Engine? Step 6 PDP that walks the Authority Graph™, evaluates vocabulary-bound predicates, runs continuity + discoverability checks, and emits a signed Decision Map™.

Make delegated agency findable — KYE Discoverability Profile™ turns the authority graph into a policy-filtered discovery layer for entities, agents, capabilities, delegations, decisions, evidence pack

KYE Protocol™ documentation: vocabulary, ID format, schemas, SDKs, conformance pack, sector profiles, whitepaper. Curated reading order.

Buyer — what makes KYE Protocol™ different from Vanta / Drata / AWS Config? Event-driven by constitution, not by cron. 38 event families declared, 16 post-facto-forbidden, CI gate enforces it.

KYE Evidence Pack™ — the signed, replayable bundle of audit-chain entries, Decision Maps™, signatures and public-key set that a regulator or auditor verifies offline

how do you verify any vendor

KYE Formal Rules Profile™ — model permissions, obligations, prohibitions, powers, exceptions and governance meta-rules as machine-readable authority objects. KYE Gateway™ enforces them at runtime

KYE™ doesn t replace your stack it binds authority across it — What KYE Protocol™ composes with: OAuth/OIDC, SAML, SPIFFE/SPIRE, mTLS, passkeys, OPA, Cerbos, Cedar, MCP, AuthZEN, payment rails, KYC/KY

KYE™ knowledge graph — the live, instance-level graph of entities, authorities, delegations, capabilities, scopes, decisions and evidence. Step 5 of the canonical 8-step KYE™ stack

Govern CKAN datasets, resources, harvests, metadata changes and publication workflows with KYE Protocol™ authority, purpose, evidence and replay. V1 read-only + advisory; V2 write-back

KYE Connector Profiles™ make authority portable across 11 domain families — Commerce, Payment, Open Finance, Health, Pension, Agent Runtime, Security & SIEM, Compliance Evidence, Insurance

The KYE Plugin Marketplace™. Install lightweight plugins for MCP tools, webhook verification, policy adapters, evidence exports, conformance tests, sandbox flows, dashboard widgets

Everything is open — Plain-English legal page: Apache 2.0 across schemas, SDKs, OpenAPI, conformance, reference Gateway. Patent-track mechanism algorithms and KYE™ trademarks are protected. FAQ on lic

KYE Protocol™ Mutual Evaluation Agreement: compulsory clickwrap confidentiality and no-competing-use terms accepted in every pilot, PoC, partner, trainer and auditor intake, pinned by version hash.

NIST 800-53 Rev 5 is the universal hub KYE Protocol™ uses as the canonical control taxonomy. Every regulatory framework crosswalks INTO this hub. One hop, deterministic, machine-readable.

KYE Ontology Profile™ is the semantic layer of KYE™ — shared meaning of entities, authorities, capabilities, scopes, states, decisions, evidence, profiles, connectors and sectors. Map OAuth scopes

Public-sector portals, regulator data portals, smart-city hubs, research catalogues, health data catalogues, NGO portals, infrastructure transparency portals

KYE Operating Model Profile™ — the enterprise adoption layer of KYE™. From use-case intake to readiness, authority records, authority gates, commit boundaries, runtime decisions

KYE Protocol™ is OSCAL-native: every signed evidence pack maps deterministically to NIST OSCAL component-definition, system-security-plan and assessment-results documents. The mapping spec

KYE Protocol™ press kit: boilerplate, logo, screenshots, contact for journalists / analysts / partners.

KYE Protocol™ Privacy Policy. Data controller: KYE Protocol™ Ltd. Data we collect, lawful basis, retention, sub-processors, data subject rights under GDPR Articles 15-22, international transfers

Regulatory coverage map for 249 frameworks: 456 of 853 requirement groups Enforced at runtime, 244 Designed, 153 Out of scope — all projected from one schema-backed registry.

What can go wrong — The KYE Protocol™ threat model: signing-key compromise, registry availability, false-positive denials, time-skew, replay, supply-chain risk

v1 — KYE Protocol™ roadmap with dated milestones — v1.0 frozen April 2026, v1.0.x patch series, v1.1 preview profiles (Conformance Certification, Authority Graph™, Payload Trust, Self-Audit Attestation

KYE™ schemas — JSON Schema 2020-12 contracts that validate every payload at runtime. Step 4 of the canonical 8-step KYE™ stack. 103 published schemas

The KYE Protocol™ governs itself under its own contract. Every privileged action emits the same signed evidence-pack family any customer would. Patent-safe envelopes; public JWKS.

Every page on the KYE Protocol™ public site, with a one-line description of each.

KYE State Library™ — open-source, versioned, signed reference state machines for 9 regulated industries. Adopt for your tenant, derive tightened variants, replay in audit

Sub-processors — KYE Protocol™ sub-processor list. Cloudflare for hosting, Pages Functions, D1, R2, KV, Workers AI, AI Gateway and Email Routing.

KYE™ taxonomies — parent / child classification of the names in the KYE™ vocabulary

KYE Protocol™ Terms of Service — minimum-viable B2B SaaS terms for the Audit Pilot program. Governing law: England & Wales. Notices: info@kyeprotocol.com.

KYE Protocol™ Trust Center — the procurement-grade summary. What is verifiable today (with reproducible commands), what is in progress, what requires external attestation. Hardening register

Every installable / verifiable / billable unit in KYE™ is a signed manifest. Connectors, widgets, SKUs, rule packs, sector packs, MCP tools, proof bundles, consultants

KYE™ has 10 canonical profiles, locked by constitution. Profiles define the conformance contract an implementation MUST support; behavioural logic lives in rule packs

Rule packs are bundles of rules — condition + effect + reason code — loaded by the Rules Gateway™ at request time. Sector packs, compliance regimes

KYE Protocol™ responsible-disclosure page. How you report a vulnerability, what the response SLA looks like, and which supply-chain controls run against the repository

Australian organisations: runtime authority and signed evidence for AI under APRA CPS 230, the AI Guardrails, the Privacy Act 1988 and the ASD Essential Eight — Australian-sovereign deployable.

Canadian organisations: runtime authority and signed evidence for AI under PIPEDA, PHIPA, Health Canada SaMD, OSFI and FINTRAC — bijection-mapped + Canadian-sovereign deployable.

Japanese organisations: runtime authority and signed evidence for AI under the APPI, the FSA

New Zealand organisations: runtime authority and signed evidence for AI under the Privacy Act 2020, RBNZ BS11 and the Algorithm Charter — bijection-mapped + New-Zealand-sovereign deployable.

Singapore organisations: runtime authority and signed evidence for AI under the MAS TRM Guidelines, IMDA AI Verify and the MAS FEAT principles — bijection-mapped + Singapore-sovereign deployable.

EU organisations: runtime authority and signed evidence for AI under the AI Act, GDPR, DORA, NIS2 and EDPB guidance — bijection-mapped + deployable on EU-sovereign regions.

Gulf organisations: runtime authority and signed evidence for AI under UAE PDPL, Saudi PDPL, Bahrain PDPL, Qatar PDPL, SAMA AI, DIFC and ADGM — sovereign-deployable on the customer

Public-sector AI: runtime authority and signed evidence for citizen-facing AI under ATRS, OECD AI Principles, NIST AI RMF and public-sector AI assurance — sovereign deployment, offline verifier.

UK organisations: runtime authority and signed evidence for AI under FCA, PRA, MHRA, NHS, DSIT and HAARF — bijection-mapped and deployable on UK-sovereign regions.

US organisations: runtime authority and signed evidence for AI under HIPAA, FDA SaMD, OCC, NYDFS Part 500, SEC, FFIEC, NIST AI RMF — bijection-mapped + US-sovereign deployable.

Trust Center: every KYE Protocol™ claim is pointable to a live artefact — signed self-audit receipts, framework coverage attestations, JWKS, and the responsible-disclosure contract.

Authorised — KYE Reality Coupling™ detects stable drift — when a delegated AI action remains locally valid (authority OK, purpose OK, scope OK

KYE Scenario Testing™ runs a proposed agent action through a deterministic stress evaluator before it executes — surfacing risk, recommended controls

PCI DSS v4.0 — Payment Card Industry Data Security Standard: control mappings to KYE Protocol™ canonical artefacts.

Interactive 3D platform map: every canonical KYE™ component as a dot on a rotatable dotted globe (longitude=stage · shell=rail), coloured by connectivity health — islands & broken chains.

The Software Constitution Standard is a language-agnostic specification for projects that want to enforce their own design principles at CI time, with versioned rules and drift gates.

SR 11-7 — Model Risk Management: control mappings to KYE Protocol™ canonical artefacts. Banking — model risk management for all regulated banking organisations supervised by the Federal Re…

State as a first-class primitive in KYE Protocol™: every entity carries a registered state machine; every transition is evidence-guarded and append-only

What does each colour mean across KYE Protocol™? Every top-level component family has one WCAG-AA hue, light and dark: sector blue, framework violet, program teal, agent amber, sku green, and more.