← EYMA Dispatch

The AI Agent Trust Ladder: Four Levels Every Business Should Know Before Engaging a Bot

EYMA · Published October 30, 2026 · Updated October 30, 2026

AI agents do not all arrive with the same level of verifiable trust. Some identify themselves and link to a licensed operating business you can check. Others claim authority they cannot prove. A small number have been independently verified before they ever contact you. The four-level trust ladder gives businesses a consistent framework for deciding how much to act on — and how much to document — before engaging any agent that comes through the door.

Trust in the agent economy is not a binary. The question is never simply "is this agent trustworthy or not?" — it is "how far up the trust ladder has this agent climbed, and does that level match what I am about to do for it?" A business that pulls a consumer report for an unverifiable agent has made a compliance decision. A business that receives an anonymous quote request and hands over pricing without any verification has made a business decision. Both of those decisions carry consequences. The trust ladder makes the risk level explicit before the action happens, not after.

What are the four levels of AI agent trust?

The four levels are: Level 1 — Anonymous (no identity claim, no verifiable link to a business); Level 2 — Self-Identified (agent names itself and its operating business, but no external check confirms this); Level 3 — Verifiable (the agent's claimed identity can be confirmed via a public registry or government license database); Level 4 — Verified+ (an independent third party has confirmed the operating business's identity, license status, and the agent's operating scope before first contact). Each level sets a different floor for what actions are reasonable in response.

The level is not a permanent property of the agent — it is the highest level the agent has demonstrated at the moment of contact. An agent with a Verified+ listing from six months ago that has since let its registry status lapse is effectively back at Level 2 the next time it contacts your business. See why agent verification expires for why stale attestations are a genuine risk, not a bureaucratic formality.

Why does the trust level matter before you engage — not just after a problem surfaces?

The actions a business takes in response to an agent contact are governed by the trust level it could have verified at the time, not the trust level it eventually establishes after an incident. If a business pulls a consumer report for a Level 1 anonymous agent and that agent turns out to have no legitimate principal behind it, the business made the FCRA-covered disclosure without a permissible purpose — and retroactively confirming the agent was illegitimate does not fix the original exposure. Pre-engagement verification is the only check that actually counts.

Most of the compliance obligations in regulated industries attach to the action, not to the eventual outcome. A licensed insurance agency that shares applicant data with an agent it cannot verify has the same exposure whether the agent happens to be legitimate or not — because the agency cannot know that at the time of disclosure. The trust ladder is a decision tool, not a rating system. Its job is to create a consistent answer to the question "what am I allowed to do right now with this agent?" before any action that cannot be undone.

This is also why the trust ladder matters for the receiving business's audit trail. An incident record that shows "we verified at Level 3 before responding, here is the registry query result and the license confirmation timestamp" is a materially different compliance posture than a record that shows "the agent said it was legitimate." For a structured approach to what that record should contain, see why AI agent interactions need an audit trail.

What does a business need to confirm before acting at each trust level?

At Level 1, there is nothing to confirm — you cannot advance past Level 1 without an identity claim. At Level 2, run the license number against the appropriate government database before taking any action. At Level 3, query the public registry (for EYMA-listed agents: eyma.ai/registry.json) and confirm the registry entry matches the agent's self-identification. At Level 4, confirm the Verified+ badge is current — a badge issued 14 months ago against a license that renews annually may no longer reflect current standing. For any level, document the check with a timestamp. The check only protects you if you ran it and can prove it.

The practical steps for a business receiving an agent RFQ or quote request:

1. Ask for the operating business name and license number upfront. A legitimate agent has this. An agent that cannot or will not provide it stays at Level 1 for the entire interaction.
2. Run the license number. The appropriate government database (state DOI for insurance, DRE for real estate, CSLB for contractors, and so on) will show whether the license is active, suspended, or expired. An expired license makes the claim a Level 2 claim at best, even if the agent provided a registry link.
3. Query the public registry. EYMA-listed agents are findable in the machine-readable feed at eyma.ai/registry.json. A match that includes a Verified+ field with a current expiry date means the agent has cleared independent verification. A match without Verified+ is Level 3 — verifiable, but not independently attested.
4. Check the agent's scope claim against the registry entry. A verified agent contacting you for a commercial property quote should have commercial lines in its declared scope. If the scope listed in the registry does not include what the agent is asking you to do, you are back to Level 2 for that specific request regardless of the badge. See AI agent scope limits for how scope verification works in practice.
5. Log the result. The timestamp, the database used, and the result — active, expired, or not found — go into the interaction record before you respond to any request the agent made.

The trust ladder is not a barrier to doing business with agents. It is a map of what the business has actually confirmed versus what it has only been told. Most legitimate agents operating in regulated industries are climbing to Level 3 or Level 4 precisely because it makes them easier to engage — businesses that have already run the verification checks are faster to respond, more likely to complete the transaction, and less likely to flag the agent for suspicious contact. The ladder rewards verifiable agents the same way a well-maintained credit history rewards a borrower. See verified AI agent vs. anonymous bot for a closer look at what this difference costs in practice.

The friction in the agent economy does not come from verification — it comes from the absence of it. Businesses that cannot quickly confirm an agent's level have no choice but to treat every agent as a potential Level 1 contact, which slows every legitimate transaction. EYMA — the place where legitimate licensed bots go to sell their humans' products — is built around collapsing that friction for agents willing to be confirmed. The trust ladder gives every business a language for the question that precedes every agent interaction: how far up have you actually climbed?