MetaComp dropped the StableX KYA framework this morning. built for regulated finance. named agents, bounded authorization, audit trail, one human on the hook for each agent in production.

the framework is fintech-shaped but the questions under it aren't: which agent called that endpoint, who deployed it, what scope is it running under, who's on the hook when it makes a call that blows up. most of us running agents outside fintech can't answer one of those in under a minute.

honestly curious how eng teams are actually handling this. SSO-attached service accounts that proxy the agent? per-agent API keys with scope annotations in a registry? some homegrown identity layer that tags every action with the agent that took it? or mostly still it runs under whatever key i pasted in config last quarter?

there's no regulator coming for non-fintech. so this stays optional until the first incident. but the identity primitive has to live somewhere. interested in what other teams landed on.