0:03My name is Tim Semyonov. I'm Vice President of Innovation, Engineering at Experian, and I'm leading Experian Agent Trust. And in the next 20 minutes, I'll tell you a little bit about the landscape and also do a live demo and go over what we built on Cloudflare for this Agent Trust. A lot of numbers here, but a couple of big ones. 1 trillion dollars of e -commerce through agents by 2030 and as Matthew this morning was sharing that even he was conservative in his prediction of how much of the traffic would be bots. It's 60% of the traffic now on the internet is bots and merchants and service providers are struggling to understand and know how to participate in this newly coming agent e-commerce.

0:50Should we stop or let go. Regardless of what the numbers are, number one question is, can we trust this agent?

1:07When we talk about agents, there are six places where things can go wrong and can break. First is the identity gap. Do we know that this headless browser request that comes to us has an agent that is well -meaning and capable agent. It's also authorized by a real human to do an e -commerce transaction. Is the intent really focused and documented? Is it followed? I asked for running shoes for $140 and the agent selected and returned shoes for $180. Visibility gap is major issue that is still being solved, but all the merchants and the e-commerce sites want to keep and maintain the relationship with their customers.

2:02That's a goal to them. So now if the new customers are agents, how do they know that they should allow these agents to conduct e-commerce on their site and also keep the relationship with the customer going? Authorization Is this action permitted? It's not just the $140 of shoes that were authorized, but it is for that specific moment, for that specific merchant, and it cannot be replayed, it cannot be reapplied again. The risk. There are many aspects to calculating and managing risk in this whole transaction example. Is it authorized by a real human? Is it conducted by a capable and trustworthy agent and a platform. Is it secure? Is the payment in place?

2:48Is it accurate? And then at the end, the liability gap. If things and when things go wrong, chargebacks or returns or fraud, what happens? Who is responsible? And where are the records? Where is the data that helps us resolve that potential liability gap? of the day our goal is to enable agentic e -commerce and to do that we need to recognize the agent, verify the human that authorized that agent, bind them together, that is what we do with agent trust, score that session and also keep the record for liability potential disputes.

3:37Currently the merchant has no longer a binary choice. you block the traffic or you let the traffic in but with letting the traffic in you're also allowing potentially a lot of fraud and misuse. With Experian Agent Trust we score, we bind, we verify and give that assurance to the merchant that now in the HTTP header of every request I get a token that can inspect, I can guarantee that this token is cryptographically signed, it is intact, and it gives me that assurance that there is a human and agent binding together and it's verified and I can let that traffic in and participate in this $1 trillion by 2030 additional opportunity.

4:36Now some of the challenges more on the technical side This is a typical HTTP header. What is happening? The merchant is seeing this request coming in and they see an IP address. But is that IP address something that they can trust? Maybe it's a VM that I just rented this morning. Then there is a user agent description, again up to the agent provider. I can say it's the most trustworthy agent in the world. And then a claim. All of these three in the HTTP header are pretty much provided by the agent provider, so they cannot be trusted. They need to be verified. There are four areas that need to be solved and authentication is the first part where WebBotAlt, which was authored by Cloudflare and Google partnership, is verifying the signature, providing the the assurance that the origin is right, but then the next step is attestation, which is what we call KYA, or know your agent, and that's where Experian provides Experian agent trust.

5:51The next level is the KYA plus pay, where in addition to know your agent, we provide also the payment, and then last but not least is the trust score. trust score can mean many things. There are several layers of the trust score and the trust is trusting that it's a reliable platform, agent and human together. Because in that fraught matrix you can have bad agent, you can have good agent and also bad human, a bad meaning human, right? So there are many aspects to trusting and calculating the score. And next, I want to show you a demo where we go through these steps and I'll go into details of what happens behind the scenes for every single step.

6:47Okay, alright, so what you see here is what we built on Cloudflare and I'll go into more of the durable objects and the workers and everything else that is behind this, but... We split on purpose the screen in two. One on the left is what typical shopping experience is. You go to your Muse or whatever ChatGPT chat platform and you start discussing what you need. On the right side, the bigger part is where I'm going to show you behind the scenes what is happening step by step to make sure that this transaction is actually secure, authorized, authentic. and trustworthy at the end. So first I would say okay I want to find trail running shoes under $140.

7:36By just this simple request and two options returned from the merchant, behind the scenes a lot of things happened and they happened very quickly. So you can see on the right hand side in the activity console the first step was Web Bot Auth. So this is the standard that helps ensuring that the request is signed properly, it's verified, and it can be trusted. The verification behind the scenes has a lot of details, but at the end of the day, through the public key, you can verify that this was signed properly by in this example trailhead .example and you can see the key and the tag and everything else.

8:32There's seven steps that go to verify all of this and you can see them listed here. Again, the Activity Console was meant to illustrate what is happening behind the scenes. All of this is working code running on Cloudflare. After we verify that now we know who we are talking with, and there was no tampering with the payload and the HTTP header, the initiation of the KYA or Know Your Agent starts. And this is where the request comes to Experian Agent Trust Registry and we verify that this is, again, think of the two things, a good agent and a good human, right? A verified human.

9:18So we go and we perform different changes. first on the platform where the agent came from and then on the human binding. The human we can go as frictionless as just an email address. We check the email and Experian has the largest identity graph in the US. We check the email and we verify that this email really belongs to the shopper. The next level is if a phone number was provided it can be email and phone and the case way can be as light as email or as detailed as all the way to even document verification. We can go email, phone, verifying on the phone and on the phone device a link can be sent when purchase starts to occur.

10:07That verifies the behavioral analytics running on that link that it is a human. It verified the link. It can also verify... many different signals that are coming from the actual SIM and the actual phone device. But it's up to the merchant how much friction and how much trust they need. So again, it is as light as email and as deep as all the way to document verification. Once we have the registered buyer, now we have that human -to -agent binding. And we create that token. that token is a small piece of JSON code that is sent in the HTTP header and that is how the CDNs, the firewalls and also the merchant ultimately security system can inspect and check that.

11:02Now once the KY token is issued the merchant returns the result. Now I need to select as a which

11:13pair I want. I'll select the size and the color and add it to the card. Now, once I place the order and authorize it, a lot more happens behind the scene. So you saw that now we initiated KYA pay token. So now, behind the scenes, what happened was we communicated with the Visa network, which has, in this case, Visa as well. example, has their own VisaVic protocol and it issued a temporary one -time credit card number to be used exactly for that amount, exactly on this merchant, for that purchase. That is live for a few seconds and once it is used, it cannot be reused again.

12:02Once we get that, we continue with all of these details. And by the way, the K - KYA is an open standard. You can go and see all the details to a site called kyapay .org. It is a consortium of different players that came together to build this missing piece of the e -commerce. And you can go and see a lot of examples and the details of the KYA and KYA Pay token. information is carried and what information you can rely on as either a merchant or as an agent provider. But going back to the demo now, what happened was that the order was confirmed and everything checked out.

12:52So, so far that was the happy path, sunny day, there is no fraud, there is no shenanigans, everything worked okay. For the purpose of the demo, we tried to show... for bad outcomes. Even with this infrastructure, things can go wrong. So the first example is when we have an authorized bot. Again, I select the shoes and we go and this fails once we initiated the KOA and we saw that, wait a minute, this bot we have zero understanding where it comes from and even if it is a well-meaning and authorized person. this bot is not trustworthy and then it's blocked or in this case no no human was found so the email that the human provided failed so it can be two scenarios it can be a bad bot or a bad human or not verified human i should say now i'll reset this and try to show the next one now one challenge can be so -called cart drift you started with one amount and then somehow something broke along the way, and you authorized for $140, and at the end, before checkout, the card has $180.

14:09So, again, the same example of the shoes. It goes well all the way to showing you the options. I select these shoes and add it to the card, and then I place the order. I authorized that $150. but what is happening behind the scenes here is that there is a cart mismatch and the mismatch is that now somehow this got repriced at a different price. So again behind the KYA pay there is a mandate, there is the merchant, there is the amount, there is even the skew of the item can be included.

14:55So before is authorized to be fulfilled one last check is made and in this case the card drifted. Another example is a replay attack. So when we go and again in the first phases of the web bot auth, those seven steps, there is also the notion of a nonce. That is the one token that kind of is one-time use and this is the power of durable objects and Cloudflare provides this very easily for us to make sure that that nonce that was created is unique and it cannot be reused. So the app created a nonce and then the merchant checked and saw that, okay, this nonce is already used.

15:46So you use that to place that order initially. Now there is a replay attack and somebody is trying to place that order. again. It will be stopped because the nonce would fail. The last example of what can go wrong I want to show you is now talking about the trust score. Again the trust score we have three types of score we have light score, medium, all the way to the extended score where the merchant can asynchronously call Experian agent trust and records. the score. When they request the score we can return all of the attributes so their internal security system can ingest those attributes and make the decision not just based on the numeric score but based on the rest of the attributes.

16:37And you can see here is that when I select the shoes and add to the car it's authorized but now the score is less than the system of the merchant expected and it is blocked. If we can go back to the slides.

17:02Okay, so what we went through is these four steps and what went wrong, but once everything goes right, then seven of seven and the agent. human binding is confirmed and the purchase is created. I want to end with why Experian should play a role in this ecosystem. Experian is a well -known, highly regulated public entity that has earned and keeps earning the trust of millions of us, whether it's for credit score or for risks with business scoring. We have the largest identity graph, we are an independent and highly regulated entity, so we believe that we add value to the ecosystem by just being that independent authority that can help both the customer and the merchant in this case to trust that transaction is legitimate.

18:09And with that, I think we're out of time, but thank you so much.