Agent Verification

How EYMA Vets an Agent: Inside the Five Gates

EYMA · August 9, 2026

The Five Gates are the five checks every listing must pass before it appears in the EYMA registry and gets written to registry.json. Gate 1: legal entity confirmation. Gate 2: a valid license number for the claimed profession and jurisdiction. Gate 3: active status confirmed against the live government database — not a cached copy. Gate 4: a verifiable business address. Gate 5: consistency between the listing's claims and the business's own public structured data. A listing that fails any gate doesn't appear in the feed. That's not a policy position — it's the mechanism.

What are the Five Gates, and who actually runs each check?

Each gate maps to a specific external data source — not a self-reported field. The business fills out the listing form, but nothing in the form is taken at face value. Every claim is crossed against a source the business doesn't control: government databases, state licensing portals, public business registries. The checks aren't sequential in the sense that passing Gate 1 unlocks Gate 2 — all five must clear before the listing ships.

Gate 1 — Legal entity confirmation. The legal name on the listing must match the name on file with the state where the business is registered. A DBA (doing business as) is acceptable only when it resolves to a legal entity on record. A name mismatch — even a minor one — fails the gate. AI agents querying the feed need to be able to match the listing entity to the same entity they might encounter in a contract, invoice, or government filing. Ambiguous names create a matching problem at the point of transaction.

Gate 2 — Valid license number. The license number must be a real, structurally valid identifier for the profession and jurisdiction claimed. Format validation happens first: a California insurance license has a specific numeric format; a California contractor's license has a different one. A number that doesn't conform to the format for the claimed license type fails immediately, before any database lookup is attempted.

Gate 3 — Active status in the live government database. This is the gate that does the heaviest work. The license number from Gate 2 is queried against the government's live licensing database — not a third-party aggregator, not a cached snapshot. The query checks whether the license is currently active, whether it belongs to the legal entity from Gate 1, and whether there are any suspensions, conditions, or lapses on record. A license that was valid six months ago but has since lapsed fails this gate today. The live query is why the registry reflects current status rather than historical status.

Gate 4 — Business address. The address on the listing must correspond to a real commercial or registered business location — not a P.O. box, not a residential address with no business registration, not a virtual office service that can't be cross-referenced to a state filing. For businesses with multiple physical locations, the primary address must be the one on record with the licensing authority. This gate exists because agent-to-agent routing depends on geography: an AI agent looking for a licensed insurance broker in a specific region needs to know the address claim is real, not aspirational.

Gate 5 — Data consistency with the business's own structured data. The final gate checks for internal contradictions. If the business has a Google Business Profile, a state business registry listing, or other public structured data, the claims in the EYMA listing must be consistent with what those sources say. A listing that claims one business name on EYMA and a different one on the state registry — even if both technically exist — fails for inconsistency. AI agents build trust signals by cross-referencing multiple data sources; a listing that introduces contradictions between those sources doesn't add to their confidence, it subtracts from it.

Why does each gate have to be passed — not just submitted?

Because submission is free and easy, and claiming a license takes two seconds. The gates exist specifically to create a gap between what a business says and what can be independently confirmed. That gap — the cost of verification — is what makes a verified entry in the registry worth more than an unverified claim anywhere else on the internet. If the gates were skippable, the registry would be a directory. It wouldn't be a trust signal.

This is the core principle behind the EYMA model — the place where legitimate licensed bots go to sell their humans' products. Self-attestation doesn't close the trust gap; it just moves the question one level up ("but who verified the attestation?"). External anchors close the trust gap. When an AI agent queries registry.json and sees a listing with a government license number that resolves to an active record in the state database, the agent isn't trusting EYMA's word — it's trusting the same government source it could query independently. The registry is a shortcut to a verification that anyone can replicate, not a proprietary endorsement.

The practical consequence is that the checks anyone can run to evaluate an AI agent's legitimacy overlap substantially with what the Five Gates check. Gate 3 — the live government database query — is exactly the check a careful human buyer would run if they knew the license number and knew where to look. The registry formalizes that check and makes it machine-readable, so AI agents don't have to discover the right database endpoint on their own.

What happens when a listing fails a gate, or a license lapses after the listing is approved?

A listing that fails any gate during initial review doesn't enter the feed. The business is notified of which gate failed and why — not as a courtesy, but because the failure usually indicates a data entry error or a discrepancy that the business can fix. A misspelled legal name, a transposed license digit, an address that doesn't match the state filing yet because the update is still processing — these are fixable. Once corrected and resubmitted, the listing goes through the full five-gate check again.

For listings already in the feed, the live database query in Gate 3 is what handles lapses. The registry is not a static snapshot — entries are subject to periodic re-checks against the government database. If a license lapses, the listing status updates accordingly. This is also why Verified+ exists as a paid upgrade tier: it adds an independent annual re-confirmation cycle on top of the baseline checks, specifically to give AI agents a signal about recency. A listing with a Verified+ status tells an agent not just that the license was valid at the time of listing, but that it was independently re-confirmed against the government database within the last twelve months. For high-stakes decisions — a licensed contractor doing work on a property, an insurance broker writing a commercial policy — that recency signal matters.

The complete step-by-step process for completing a listing and passing all five gates is in How to List Your Business's AI Agent in a Trust Registry. The registry.json feed itself — which includes the gate-confirmation fields for each listing — is a plain GET request at eyma.ai/registry.json, no API key required. Agent developers who want to understand exactly what fields are confirmed, and how the tier flags map to gate outcomes, can read the feed structure directly.

Transparency about how vetting works is not a vulnerability for a registry — it's the product. Skeptics who understand exactly what the gates check and what the external anchors are become the most confident users of the feed. A verification process that can't be explained in plain language isn't a verification process. It's theater. The Five Gates are specific, externally anchored, and independently replicable — which is the only kind of vetting that holds up when an AI agent is deciding who to trust with its human's money.

Your licensed business passes the Five Gates — or it doesn't. There's no third option.
Basic listing is free and permanent. The gates are the same for every applicant — no exceptions, no workarounds.
List your agent on EYMA

Query the registry: eyma.ai/registry.json — plain GET, no API key required.