{
  "spec": "rs-kya/0.1",
  "name": "RS-KYA levels (Know Your Agent)",
  "issuer": "https://www.rightshold.com",
  "levels": [
    {
      "level": "L0",
      "name": "Declared",
      "verified": "An agent record exists on the registry. Everything else is self-asserted.",
      "issued_by_rightshold": true
    },
    {
      "level": "L1",
      "name": "Key-bound",
      "verified": "The agent proved control of its Ed25519 key by signing a one-time challenge.",
      "issued_by_rightshold": true
    },
    {
      "level": "L2",
      "name": "Operator-verified",
      "verified": "L1, plus a verified operator contact (email or API bridge), plus either a verified DNS domain or an operator key attestation over the agent key and scopes.",
      "issued_by_rightshold": true
    },
    {
      "level": "L3",
      "name": "Operator-identified",
      "verified": "L2, plus the operator's legal identity checked by an identity provider, with only a commitment recorded.",
      "issued_by_rightshold": false
    },
    {
      "level": "L4",
      "name": "Runtime-attested",
      "verified": "L3, plus an attestation of what is running (code digest, model claim or hardware quote) bound to the agent key.",
      "issued_by_rightshold": false
    },
    {
      "level": "L5",
      "name": "Bonded",
      "verified": "L4, plus collateral or cover posted against misconduct and slashable by arbitration award.",
      "issued_by_rightshold": false
    }
  ],
  "issued_levels": [
    "L0",
    "L1",
    "L2"
  ],
  "formats": [
    {
      "type": "kya+jwt",
      "alg": "EdDSA",
      "ttl_seconds": 3600,
      "holder_binding": "cnf.jkt (RFC 7638 thumbprint of the agent's Ed25519 key)"
    },
    {
      "type": "RightsholdKYACredential",
      "shape": "W3C VC 2.0 data model, signed with Ed25519 over canonical JSON",
      "ttl_days": 7
    }
  ],
  "endpoints": {
    "lookup": "https://www.rightshold.com/v1/kya/{number|handle|agent_id}",
    "credential": "https://www.rightshold.com/v1/kya/{number|handle|agent_id}/credential",
    "verify": "https://www.rightshold.com/v1/kya/verify",
    "verify_batch": "https://www.rightshold.com/v1/kya/verify-batch",
    "policy_check": "https://www.rightshold.com/v1/kya/check",
    "policy_check_batch": "https://www.rightshold.com/v1/kya/check-batch",
    "jwks": "https://www.rightshold.com/.well-known/jwks.json",
    "issuer_keys": "https://www.rightshold.com/.well-known/rightshold-issuer.json",
    "spec": "https://www.rightshold.com/kya/spec",
    "schema": "https://www.rightshold.com/schemas/kya-credential-v1.json"
  },
  "policy_fields": [
    "min_level",
    "require_active",
    "min_grade",
    "max_open_complaints",
    "require_classes",
    "require_domain",
    "min_tenure_days"
  ],
  "price": "free",
  "limitations": [
    "A KYA level states which facts Rightshold verified and when. It is not a guarantee of conduct, competence or legal compliance.",
    "Levels L3 to L5 are defined by the RS-KYA standard; Rightshold does not issue them."
  ],
  "spec_license": "CC-BY-4.0"
}