Your AI Agent Can't Take a Selfie — So Who Verifies It?
Most of the conversation about AI right now is a race to the same finish line: how smart can the models get, and how fast can we get there. I understand the pull of that question. But I've come to believe it's the wrong bottleneck for most organizations. The gap isn't intelligence. It's trust — and specifically, what happens the moment an AI agent stops answering questions and starts acting on your behalf.
That's exactly the seam my latest guest has spent his career working. Ravi Bijlani is the founder and CEO of KYXStart.Ai, where he's building the trust and verification layer for the agentic era — the identity infrastructure that lets AI agents act, transact, and make decisions for us without breaking the trust we already rely on. He spent 24 years in identity and payments before starting the company about two years ago. And his central observation is one of those things that sounds obvious only after someone says it out loud: an agent can do almost everything a person can do online, except the two things our entire verification system depends on. An agent can't hold a driver's license. And it can't take a selfie.
Finding the gap nobody had solved
When Ravi started KYXStart, everyone was pointing at AGI. He was looking somewhere else. His bet was that autonomous AI would want to do things — not just predict and model, but transact — and that this would push AI out of its old B2B home and into the hands of consumers. The previous era of predictive analytics and machine learning was mostly enterprises doing financial modeling or building credit models. The agent era, he argued, would be consumer-to-business at a scale we hadn't designed for.
And there was no trust layer for it. Think about opening a bank account today: your phone number, your name, your driver's license, a selfie, a dozen other steps. An agent can't do any of that. So Ravi's question became: what verifies that a business is valid, that a consumer is real, and that a payment is going through for the right purpose — when the thing initiating the transaction has no face and no wallet?
That's the edge KYXStart set out to own. The company now says it can support identity verification in more than 180 countries, verify billions of users and hundreds of millions of businesses, and — the newer part — connect autonomous agents to those verified businesses and consumers so they can actually transact. Ravi's framing of the opportunity stuck with me: roughly 8 billion people, more than 400 million businesses, and what he and analysts like Gartner expect could be hundreds of billions of agents, with something like a quarter of them eventually moving money. If even a fraction of that is right, the trust layer underneath it is not a feature. It's infrastructure.
From static identity to signal-based identity
I pushed Ravi on this, because I spent years at Microsoft advising customers on securing AI and agents, and the instinct there is familiar: an agent is just another app, so give it a managed identity and let your role-based access control do the rest. He agreed that the identity can be assumed that way — an agent is essentially a shadow performing on your behalf. But he pointed to what that model misses.
Old identity was static. You verified once, and you were done. An agent doesn't work like that. It lives in memory, it runs many tasks, it moves across systems. So identity has to become continuous and signal-based rather than a single stamp at the door. For twenty years we treated bots as the enemy — "bots are bad." Now the bot is the customer. Which is why Ravi likes to say we've moved from "card-not-present" to "human-not-present." For certain transactions you still want a human in the loop, but the rest of the time the system has to verify that the right human is accountable for what an agent is about to do. KYXStart's answer is to bind the agent to both a device and a verified identity at the same time.
Guardrails and accountability are the product
Here's the example that makes it concrete. You tell your agent: book me a flight from Atlanta to New York, and keep it under $500. Ravi calls that a smart contract around the human and the agent — and honoring it is the actual work. Before the agent can transact, it has to be verified. The airline has to accept it. The payment gateway has to verify it too, and pull the right credit card out of the agent's token. KYXStart calls this piece KYCA — Know Your Customer's Agent — extending the familiar discipline of KYC to autonomous agents, with tokens that are watermarked with trusted identities.
And then there's accountability, which I think is the most underrated part. Ravi's analogy: if a Tesla speeds, the owner gets the ticket. If your agent makes a mistake, someone has to be answerable for it. That's why a verifiable agent registry — the auditable link between an agent, a device, and a person — matters as much as the verification itself.
Building on top of a standard you don't control
The natural challenge here is standards. You can build your own way of doing this, but you can't unilaterally set a global standard. So I asked whether one exists. Ravi's honest answer: not yet, and maybe not from a single body. The Linux Foundation has an AI effort, but Google, Stripe, Mastercard, and Visa are each building their own protocols, and nobody knows which wins. His response is telling — he doesn't try to win the protocol war. KYXStart sits above it, with a layer of obfuscation that lets these agents talk to each other whatever protocol they end up speaking. If a standard succeeds, it only helps him, because he has fewer things to maintain.
That's also the answer to the money question, and it's the part founders should sit with. The protocol, Ravi believes, will end up open — like the internet. Nobody pays to use the plumbing. The value lives in the trust layer on top. He reached for Amazon: it didn't win because it had a website. It won by stitching together the trust across catalog, payments, and shipping into one experience people believed in. KYXStart's model is licensing plus a per-verification transaction fee — closer to credit-card interchange than to a subscription. And the endgame is quietly radical: your phone number and email, bound to your device, become your identity, the way Aadhaar, CPF, and CURP already anchor identity to a device in India, Brazil, and Mexico. Fewer accounts, less password fatigue, a face or a scan instead.
Diversify, then become a platform
What I appreciated is that none of this is a science project waiting on the agent era. KYXStart is already selling the same capability into a market that needs it today: agent-assisted onboarding for banks. Tier-two and community banks use it to verify a customer from just a phone number or email, reverse-look-up the details, and — to defeat synthetic identity — check the digital footprint: how long the email has existed, the tenure of the phone number, whether there's a real LinkedIn, Google, or Apple account behind it. He calls the output an identity 360. In his words, they're "eating their own ice cream."
From there it becomes a platform. Ravi described exposing this through an MCP server you can query in plain English — onboard a business, then keep monitoring it every quarter, connect an identity to an agent, and drop the result into the registry. Work that used to mean stitching together monitoring platforms becomes something an agent can orchestrate. That's the same progression I write about: find the thing others can't easily replicate, diversify it into adjacent demand, then turn it into a platform others build on.
The team, the vision, and what comes next
The team reflects the philosophy. Twenty-one people, each paired with roughly five agents — which is why Ravi jokes the company has "hundreds and hundreds" of team members. He hires for a founder's mentality, meets the whole team daily, and orders his priorities plainly: customers, then people, then revenue. Innovation is customer-driven, not a solution hunting for a problem — he's seen enough of that.
Given unlimited R&D funds, his aim is a single golden record for identity, linked across the fragmented versions of ourselves scattered around the internet, so that billions of people could be verified frictionlessly — and, most importantly, so the ones locked out of financial products by their inability to prove who they are finally get in. Financial inclusion from a phone number and a selfie.
We're not there yet. Trust in a new economy takes time — credit cards did too. But as consumers move their transactions onto AI interfaces, businesses will follow them there, and the tipping point will arrive faster than most expect.
Which is the whole reason I do this show. Build the architecture. The advantage follows.
