A vendor has shipped the check that KYA has been describing on paper. On 15 October 2026, Proof (formerly Notarize) launched x401, an open HTTP protocol that lets any website ask an AI agent to prove who it is acting for and what that person authorized — with verified legal identity and a signed transaction approval, not just a valid token.
What happened
Proof says it is “the first company to put verified legal identity and transaction authorization for AI agents into production”. The x401 launch has three pieces live today:
- An agent identity wallet that holds a person’s verified legal identity and shows the exact information and transaction terms being requested. The person approves on their own device; the wallet signs.
- x401, an open HTTP protocol for requesting and verifying that evidence — modelled on the HTTP `401 Unauthorized` response code, so a website can challenge an agent for proof of authority.
- A production Model Context Protocol (MCP) server that works with assistants that support MCP, which Proof names as Meta’s Muse, ChatGPT, Grok and Claude.
The company frames the gap it is targeting as the “Agent Evidentiary Gap”: the distance between what an agent can technically do (it may hold a valid password, OAuth token, API key or payment card) and what a business can verify the person behind it actually authorized.
The crypto is deliberately narrow. The agent carries the request; the person’s wallet signs it. The receiving business can independently confirm the consumer’s verified legal identity and check the signature on the transaction. If the agent changes the amount, recipient or other signed terms, the signature no longer validates — a changed instruction invalidates the approval rather than riding on it.
Proof ties the launch to two concrete events: Amazon blocking Meta’s Muse from its marketplace on 21 September 2026 (reportedly because the agent did not identify itself and moved through accounts without Amazon’s knowledge or consent), and September guidance from FinCEN and federal banking regulators recognizing digital certificates and verifiable credentials, under certain conditions, as a permissible way for banks to verify customer identity.
Developers can adopt x401 using the protocol specification, an identity scheme, implementation guides and a reference implementation at proof.com/x401. Websites can request verified identity claims without a sales process or negotiated agreement, with an option to pay per claim over x402 — the HTTP payment standard that has become the default noun for agent-paid APIs.
Why it matters for KYA
This is the “Know Your Agent” question, answered in a protocol. KYA’s central claim is that holding credentials is not the same as holding authority — and x401 makes that distinction executable: the merchant verifies a signature over the specific terms the human approved, not merely that the caller presented a token.
Three things a practitioner should take from it:
- Authority is bound to terms, not just to an identity. A signed approval that fails when the amount or recipient changes is materially stronger than a scoped token, because it constrains the transaction, not only the tool.
- The wallet separates principal from agent. The agent is a courier; the human’s wallet holds the identity and does the signing. That is the accountability model KYA prescribes — a named, verifiable principal behind every agent action.
- Interoperability is the open question, not capability. x401 is one vendor’s protocol, in production, with a reference implementation. Whether merchants adopt it, or the emerging AP2 / UCP agent-payment stacks, or a standards-body answer, is unresolved. Also note the identity scheme and x402-style per-claim pricing are Proof’s design; treating them as settled industry practice would be premature.
Read it as a live, adoptable implementation of agent authority verification — and as evidence that the phrase “the agent needs to prove who it is acting for” has moved from think-piece to shipped code.
Sources
- Proof, “Proof Launches x401, Giving AI Agents A Way to Prove Who They Represent — and What They’re Authorized To Do”, 15 October 2026 — proof.com/blog.
- Proof, “x401 Dev Guide” (protocol, identity scheme, implementation guides, reference implementation) — proof.com/x401.
- GlobeNewswire, “Proof launches x401, giving AI agents a way to prove who they represent—and what they’re authorized to do”, 15 October 2026 — globenewswire.com.
Note: the capability claims and figures here are Proof’s own, from its launch material and press release. The reference implementation and protocol are public; independent deployment results are not yet available.
Know Your Agent (KYA) explains agent identity, verification and accountability. This is an explainer, not legal or compliance advice — see our Sources & methodology. New to KYA? Start with What is Know Your Agent? and the glossary.