Most of the current conversation around agentic AI trust stops at authentication: verifying that a given agent instance is legitimate, not spoofed, tied to a real deploying entity. That matters, but it answers the wrong question for anyone who has to let an agent transact, move funds, or act on their behalf. The question that actually creates liability is authorization — the specific, scoped set of actions this agent was granted, by whom, and for how long.
Why authorization is the harder engineering problem
Authentication is a one-time check: is this the agent it claims to be. Authorization has to be continuous and auditable: does this action, right now, fall inside the scope it was granted — and can that scope, and any changes to it, be proven after the fact, not just asserted by the agent itself or its operator.
That's the distinction Know Your Agent is built around: not just verifying an agent's identity at the door, but maintaining a verifiable record of its authorized scope and actions over time, on the same kind of neutral, tamper-evident rail KC already uses for credentials and trade documents — so a counterparty can check what an agent was allowed to do, not just who it claims to be.
The takeaway
The institutions that get burned by agentic AI in the next few years won't be the ones that skipped authentication. They'll be the ones that authenticated an agent correctly and then had no way to prove, later, what it was actually authorized to do.