Adyen and Worldpay appear on both lists. That is the only number in this story that survives scrutiny.
Visa's Trusted Agent Protocol went live with six launch partners. Mastercard's Verifiable Intent signed four. The same payment service providers — Adyen, Worldpay — are named in both rosters. Read it again. Two card networks are building separate agent-authorization rails, and the acquirer layer is already being forced to run both.
I went through the partner lists line by line. Visa's TAP roster does not contain Mastercard. Mastercard's name sits inside Google's AP2 coalition of 60-plus partners; Visa's does not. What is being sold as an industry-wide standardization push is, judged on the partner lists alone, a two-camp split with a shared and badly overloaded middle layer.
That is the story. The rest is cryptography everyone already has.
Context: what KYA actually is
Know Your Agent is the authorization layer for machine-initiated payments. The premise is simple and it is arriving fast: an AI agent will spend your money. Before it does, the merchant, the card network, and the issuer all need a cryptographically verifiable answer to three questions — who authorized this, over what scope, and until when.
OAuth and SAML cannot answer that. Bearer tokens and assertions were built to prove a credential exists, not to prove what it is permitted to do. A token saying "this session is authenticated" tells a merchant nothing about whether the agent may spend 40 dollars at this specific store today. That gap is real, and it is why five separate protocols now exist to close it.
The five: Visa TAP. Mastercard Verifiable Intent, paired with Agentic Tokens. Skyfire's KYAPay. Google's AP2, now donated to the FIDO Alliance. And a fifth that the source material names but never identifies — plausibly Stripe's ACP or Coinbase's x402.
None of them issue a token. Not one. No supply schedule, no unlock cliff, no governance vote. That matters more than any line in the technical documentation, and I will come back to it.
Core: the cryptography is a commodity, the directory is the product
Strip the marketing and the primitives are boring on purpose.
Visa TAP runs on RFC 9421 HTTP Message Signatures with Ed25519 keys. Mastercard Verifiable Intent uses SD-JWT with key-binding claims. Skyfire KYAPay issues a three-layer JWT — human principal, agent platform, agent instance. AP2 signs Intent, Cart, and Payment authorizations separately. Every one of these is a mature, reviewed, standardized building block. Nobody wins on the cipher.
The differentiator is the directory. Visa operates its own agent public-key registry. Mastercard anchors to the existing card-network trust root and issuer relationships. AP2 hands governance to FIDO. Skyfire is the only one running a pure open-standard path, with an IETF draft behind it.
So the actual question — the one the press releases never ask — is who owns the key directory, who carries revocation liability, and who defines the constraint semantics. Visa chose self-operation: centralized, but accountable. Google chose donation: surrendered control for adoption. Skyfire chose the IETF: neutral, and slow.
Revocation is the tell. None of the four documented protocols publishes key-rotation cadence, revocation propagation delay, or offline-degradation behavior. That is not an oversight. It is where the liability lives, and nobody wants to write it down before the lawyers agree.
TAP's dual-signature design deserves a second look. It splits browse intent from payment intent into two separate tags. That is not a UX nicety. It is the technical precondition for liability shift — first you distinguish intent in code, then you allocate responsibility in contract. Same logic as EMV 3DS running separate browse-state and payment-state channels. Anyone who lived through the 3DS2 migration will recognize the playbook.
Mastercard's contribution is technically the most interesting. Verifiable Intent encodes eight machine-verifiable constraints — spend ceilings, merchant allow-lists, budget caps, recurrence terms. If that sounds familiar, it should. This is the same problem domain as ERC-4337 session keys and scoped-permission standards on-chain. Both solve bounded delegation with revocation. The card network and the account-abstraction crowd arrived at the same abstraction from opposite directions, and nobody has published the bridge.
I have seen this movie before. In December 2017 I spent two days inside the Parity multisig logs tracing the initWallet path. The bug was never a broken signature. The signature worked perfectly. The failure was that the delegation logic let an uninvited caller become the owner. Authorization scope, not cryptography. Every KYA protocol on this list is one semantic slip away from the same class of failure.
The operational tail is where this gets expensive. TAP requires KYB/KYC on registered operators, public identity disclosure, and annual re-certification. Every protocol demands continuous verification of the registered operator. For a fintech supporting three of these rails, that is three separate registries, three key-rotation schedules, and three revocation models with no published latency figures. A single agent must speak multiple mutually incompatible frameworks at once. That is a multiplication problem, not an addition problem, for any security team signing off on it.
Then there is the settlement side, where value actually flows. Skyfire is the only open-standard route naming stablecoin settlement explicitly. AP2 covers cards, ACH, real-time payments, and Base-chain stablecoin. Trace the beneficiaries: the stablecoin issuer earns reserve interest, Base earns sequencer revenue, the card networks earn interchange, and the verification layer earns a directory fee nobody has priced. Coinbase appears on both the TAP and AP2 rosters — a clean two-sided bet. Whichever protocol wins, USDC and Base collect. That is the only protocol-agnostic exposure in the entire stack.
And Experian sits on the KYAPay partner list. A credit bureau. Which tells you where agent trust ultimately anchors: the agent's authorization capacity partly inherits from the human's credit score. Technically clean. Structurally ugly against data-minimization principles, and nobody has written the privacy impact assessment.
Contrarian: solving authorization is not solving agent security
Here is the blind spot the vendor material will not touch.
The ten "trust-through-defaults" incidents cited in the source share one root cause: a system trusted an assertion without verifying that the assertion's meaning matched its assumptions. That splits into two layers. Layer one is missing signature verification — cryptography fixes that. Layer two is semantic mismatch — the signature is valid and the meaning is still wrong. Cryptography cannot touch that. It is a schema governance problem, and not one of these five protocols publishes a constraint-semantics spec.
There is a second problem. Volume spikes lie; liquidity flows tell the truth, and here there is no flow to read. Not one of the four documented protocols discloses transaction count, adoption rate, or settlement value. Standards are published. Partners are signed. Numbers are zero. Historically that gap between announcement density and live volume runs 12 to 24 months, and it closes badly for at least half the field.
And the demand stat — 78% of organizations reporting identity-related breaches in the past year — carries no named source. Treat it as marketing until it traces to a DBIR or an identity-security survey.
Takeaway
Watch the edge, not the card networks. Cloudflare co-developed TAP with Visa; F5, Fastly, and Akamai sit in Skyfire's partner set. The edge is where TLS terminates and where HTTP headers can actually be inspected — the physical chokepoint for agent traffic. Those vendors are exposed to two or more protocols at once and immune to the fragmentation war.
The protocols will not converge. Speed is safety when the exploit is already live, and the exploit here is fragmentation. The question is which directory the first real agent transaction volume clears through — and whether anyone publishes the number when it does.
