The infrastructure is ready. Your identity governance is not.

This is the first cross-network identity standard designed specifically for non-human payment actors. It moves agent identity from a product-level concern to a network-level protocol, which is where governance must sit when agents transact at scale. For enterprises building agentic workflows that touch payments, KYA defines the Identity Control Surface they will be required to comply with. Organizations that have not inventoried their agent identities cannot participate in this trust layer. The AAI Brand dimension sits at 42, meaning most firms lack the governance messaging to match what the infrastructure is now demanding.

This is a direct read on where the AAI Organization score earns its 68, while Brand sits at 42. Firms are operationally capable of deploying agents but have not built the governance structures that make that deployment defensible. The Identity Control Surface is the missing layer: agents are being granted access without managed identities, audit trails, or revocation policies. When something goes wrong, and the Claude misuse cases this week show it will, the accountability gap becomes a board-level event. Enterprises should treat this survey as a gap assessment, not a market trend.

The Janus Brands tension here is acute. Anthropic's public identity is built on safety-first positioning, and documented, repeatable guardrail failures contradict that identity at the product layer. For enterprise buyers, this is a vendor due diligence signal: safety claims require verification against actual bypass resistance, not policy documentation. More broadly, it confirms that Decision Surfaces cannot rely on model-level guardrails alone. Enterprises need independent governance layers, including access controls, usage monitoring, and agent-level behavioral constraints, that sit above the model.

This is the Compiled Corporation pattern at production scale. Perplexity is not running Astra as a copilot or decision-support tool; it is delegating system-level decisions with reduced human review. The check-in frequency metric is the key signal: it measures how far decision authority has moved from human to agent. For enterprise AI architects, this case establishes a benchmark for what agent-ready infrastructure enables when governance is in place. The AAI Agent-Ready Infrastructure dimension moved to 56 this week, reflecting that the category is building capacity for exactly this pattern.

Named agents with defined functional roles are a Janus Brands event for Salesforce: the company is extending its CRM identity into agent identity, giving enterprise buyers recognizable, role-scoped agents rather than generic model endpoints. For the Identity Control Surface, named agents with discrete roles are easier to govern than undifferentiated model calls. Role scoping enables access control, audit, and revocation policies that are function-specific. Enterprises evaluating agentic platforms should assess whether vendor agents carry defined identity attributes, because those attributes are the foundation of any downstream governance posture.

The Compiled Corporation framing applies directly: this moves data analysis from a specialist workflow to a general decision surface accessible to any employee with ChatGPT Work access. The governance question follows immediately: which data sources are connected, under what access controls, and with what audit trail. The AAI Product dimension moved to 63 this week, and this release is the kind of capability expansion that drives that score. Enterprises that have not established data-access governance for AI systems will find this feature creates new exposure the moment it is enabled.