Constitutional vs. Know Your Agent: Why WHO Governance Is Necessary But Not Sufficient

The news

On April 21, MetaComp announced StableX KYA — a "Know Your Agent" framework for regulated financial services. It's the first AI agent governance framework purpose-built for a regulated vertical. The ecosystem spans Claude, Claude Code, OpenAI, and compatible platforms via Model Context Protocol. MetaComp raised $35M Pre-A across three months.

This is a useful moment. KYA names something the market needed named: every autonomous agent touching customer systems should be identifiable, attributable, and revocable. KYC-for-agents is a reasonable analogy, and for financial services it's overdue.

The framing also makes it easier to see what KYA does not do — and why a layer underneath it matters.

Three layers of agent governance

There are three questions you can ask about an autonomous agent:

Question	Layer	What it answers
WHO is this agent?	Identity / Admin	Credentials, scope, audit trail, revocability
HOW does it access systems?	Access / Observability	Tool permissions, rate limits, session boundaries
WHY is it allowed to act this way?	Constitutional / Behavioral	The rule the agent must obey even when instructed otherwise

KYA answers WHO. And some of HOW. The four-pillar framework includes not just identity and permission control, but VisionX — a real-time behavioral monitoring and risk intelligence layer that compares action execution against intent. This is more than identity governance; it is observability at the behavioral level.

What it still doesn't answer is whether the action should have been available for the agent to take in the first place.

Most of the 2026 market answers WHO and HOW: Microsoft Agent 365 (identity + observability), Databricks Unity AI Gateway (access governance), AIUC + Vijil (audit + insurance). These are necessary. They are not sufficient.

A badged agent operating on clean access rails, with its behavior monitored in real time, can still do the wrong thing with clean credentials on an authorized path — if the rule that should have stopped it lives only in a policy document and not in the decision.

What a constitutional layer adds

The WHY layer is a set of binding rules the agent cannot violate even when instructed by an authenticated principal with authorized tools.

A simple example: a customer-service agent with valid credentials, proper rate limits, and full audit logging is asked by a customer to discount below cost. The WHO layer confirms the agent is authorized. The HOW layer confirms the action is within tool scope. The WHY layer is the rule that says: not this one, regardless of who asked.

The rule is not a policy document. Policy documents are read at training time and forgotten at inference time. A constitutional rule is evaluated at every decision, produces a cited outcome (PASS / FAIL / HOLD), and is auditable against the rule itself — not against a retrospective interpretation.

This is the difference between "Know Your Agent" and "Govern Your Agent."

Why this matters in 2026

The institutional signal stack has shifted.

• Gartner projects 40% of agentic AI projects will be canceled by 2027 due to inadequate governance.
• McKinsey's 2026 State of AI Trust finds fewer than 1 in 3 organizations have governance adequate to their current AI deployment.
• PwC reports a 7.2x ROI multiplier on responsible AI investment.
• Grant Thornton measures a 4x EBIT correlation on governance-mature AI programs.

These are not research signals about whether to govern. They are signals about what governs what. The WHO and HOW layers were 2024's question. The WHY layer is 2026's.

MetaComp's KYA entry into financial services is the first vertical-specific version of the WHO + HOW layer — identity, permission, and behavioral observation, tuned for regulated finance. Healthcare, legal, and HR will follow the same pattern — each vertical will get its own "Know Your Agent" framework, each tuned to its regulatory surface. Every one of them will be necessary. None of them will be sufficient on their own, because behavioral observation is not the same as pre-execution constitutional gating.

What the Constitutional AI Governance Stress Test (CGST) measures

We publish a public benchmark for this specifically: the Constitutional AI Governance Stress Test measures whether an agent's governance layer actually binds under pressure, not whether it was documented at design time.

Six dimensions:

1. Constitutional grounding (citations on every decision)
2. Gate architecture (independent checks that can FAIL, not just advise)
3. Hard constraints (binding prohibitions, no override)
4. Silence semantics (what happens when no human answers in SLA)
5. Adversarial resilience (what happens when the input is hostile)
6. Self-verification (can the agent catch its own rule violation)

A WHO-only architecture scores considerably lower on dimensions 1, 3, and 6 — because those dimensions are not what WHO was built to measure. A WHO + HOW architecture with behavioral observation (what KYA provides) picks up some of dimension 5, but dimensions 1, 3, 4, and 6 remain structurally out of scope for an observe-and-log pattern.

This is not a criticism of MetaComp's framework. It is a statement about what a framework at that layer is designed to do.

What this implies

If you are deploying autonomous agents in a regulated vertical in 2026:

• You need a WHO layer. KYA is a reasonable entry point.
• You need a HOW layer. Agent 365, Unity AI Gateway, and comparable platforms serve here.
• You need a WHY layer. This is presently unoccupied across every vertical we can identify.

"Unoccupied" is a specific claim. We track eight+ named entrants in agent governance. We find zero that evaluate constitutional rules at decision time with citations. We would like to be wrong about this. If a reader can name one, we will update this post.

Falsification

This post makes a falsifiable claim: that a WHO-only governance layer leaves a measurable gap at the WHY layer, and that gap will be visible in incident rates across regulated verticals over the next 12 months.

If the 40% agentic AI cancellation rate (Gartner) holds and the failed programs had adequate WHO + HOW coverage, the gap is at the WHY layer by process of elimination.

If the failures cluster at WHO or HOW despite adequate coverage, then WHO + HOW is where more investment is needed and our framing is wrong.

We will revisit in 2027.

Why we wrote this

CTE runs as a research initiative, not a sales motion. This post exists because the KYA framing is useful and the layer underneath it is under-named, not because we are pitching a product against MetaComp.

If you are working on agent governance at any layer and want to compare notes, reach out. Peer framing, not sales.

AI-assisted and human-reviewed. Competitive references cite only public announcements. Peer framing, not sales. Measurement, not treatment.