Question 1

Why are verifications not included in the subscription?

Accepted Answer

Every verification requires a real biometric + document check through a certified provider. We pass that cost through and charge a margin on top. Bundling verifications into subscriptions would mean either losing money or over-charging customers who don't use them.

Question 2

What triggers a re-verification?

Accepted Answer

Three things: (1) Document expiry — the user's ID expires and the credential needs refreshing. (2) Operator request — your platform explicitly requests a fresh check. (3) Fraud signal — a behavioral or risk signal triggers an automatic re-check. Re-verifications are priced the same as initial verifications — one price per check, always.

Question 3

How does the network dividend work?

Accepted Answer

When Platform A issues a credential and Platform B later uses it — either via the badge endpoint ($0.10) or a credential share ($0.75) — Platform A earns 20% of that fee. That's $0.02 per badge check and $0.15 per accepted share. The more platforms that join the network, the more passive revenue Platform A earns — creating a flywheel incentive for credential portability.

Question 4

Can I start on the Developer plan and upgrade later?

Accepted Answer

Yes. The Developer plan gives you full API access in sandbox mode — no real providers, no real billing. Upgrade to Starter when you're ready to go live.

Question 5

What does a KYA program actually give my compliance team?

Accepted Answer

A KYA program gives you: (1) a persistent identity for every agent, (2) cryptographic proof of where each agent runs via cloud attestation, (3) a human operator accountability chain — so if a rogue agent acts, you can trace it back to an authorized person, (4) BASIC/STRONG/ENHANCED trust tiers analogous to KYC, and (5) a real-time compliance score showing attestation coverage, operator linkage, and full declaration coverage across your fleet.

Question 6

What triggers a KYA agent re-verification?

Accepted Answer

Three things automatically trigger re-verification: (1) Model version change — when an agent re-registers with a different model_version, its existing credential is flagged and a new verification is required. (2) Operator revocation — if the human operator's KYC credential is revoked, all agents they authorized are cascade-suspended. (3) Manual request — your platform can trigger re-verification at any time via the API.

Question 7

How are team seats counted?

Accepted Answer

Every active dashboard user (admin, developer, or viewer) counts as one seat. Deactivated members are not counted. Each plan includes a quota of free seats; additional seats above the quota are billed automatically at $12/seat/month via your Stripe subscription — no manual upgrade required.

Question 8

What counts as an active seal?

Accepted Answer

An active seal is any consumer-facing agent that has completed the Eniyan review process and has a publicly live verification page. Agents in draft, under review, or whose seal has been deactivated do not count toward your quota. You can deactivate a seal at any time to free up the slot.

Question 9

What does "quantum-ready" mean, and why does it matter now?

Accepted Answer

Eniyan's credential format is built for the post-quantum transition. Alongside the standard ES256 (P-256 ECDSA) signature that classical verifiers use today, the platform supports a hybrid ML-DSA-65 signature (CRYSTALS-Dilithium, NIST FIPS 204) that is resistant to Shor's algorithm — the quantum attack that breaks all elliptic-curve cryptography. The reason to care now is 'harvest now, decrypt later': adversaries are already collecting signed credentials with the intent to forge them once quantum computers are powerful enough. Agent credentials can have up to 5-year validity, so a credential issued today without post-quantum signing would be vulnerable for its entire lifetime. When ML-DSA-65 hybrid signing is enabled, credentials issued under it will remain secure against quantum attacks in 2029, 2030, and beyond. Classical verifiers are completely unaffected — the ES256 signature is unchanged, and the post-quantum signature is silently ignored by anything that doesn't understand it.

Question 10

What is JIT (Just-In-Time) credential activation?

Accepted Answer

JIT activation is a no-standing-privileges model for AI agents. Instead of a credential that stays permanently ACTIVE, a JIT-enrolled agent's credential is SUSPENDED by default — the agent has zero access between tasks. An operator opens a named, time-bounded task window (e.g. 'process_refund_order_8821' for 15 minutes) via one API call, the credential activates, and when the task completes or times out, the credential automatically re-suspends. This is the AI-agent equivalent of just-in-time privileged access management (JIT PAM) applied to autonomous agents in production.

Question 11

How does scope violation detection work?

Accepted Answer

Each just-in-time task window is opened with a defined set of permitted scopes — a subset of the agent's registered capabilities. When a downstream system checks a scope that wasn't authorized for the active task, Eniyan flags it: a scope-violation event is written to the audit trail immediately and a real-time webhook fires to the operator. The credential stays valid — enforcement is downstream — but the operator gets alerted the moment an agent reaches beyond its task, so they can respond before damage is done.

Question 12

Does JIT mode affect agent billing?

Accepted Answer

No. JIT-idle agents (suspended between task windows by design) are still billed at the same flat per-agent monthly rate as always-active agents. JIT task activations are not separately metered — activating and completing a thousand task windows per day costs the same as activating none. JIT is a security posture, not a usage billing axis.

Event	Fee	Notes
Badge-only verification	$0.10	Read a user's trust level — no-auth public check
Credential share accepted	$0.75	Cross-org sharing with user consent
Network dividend — badge	+$0.02 per badge	20% of badge fee — paid to the org that originally issued the credential
Network dividend — share	+$0.15 per share	20% of share fee — paid to the issuing org when their credential is accepted cross-platform

Simple, transparent pricing.

Re-Verifications

Portability & Network Fees

Frequently asked questions

Ready to get started?