One sentence from Komdigi that reaches your shop or cafe
This week Indonesia's Deputy Minister of Communication and Digital Affairs, Nezar Patria, said a line that is easy to remember: "No longer just KYC, Know Your Customer, there must be KYA, Know Your Agent." He spoke at the Hukum Online Executive Breakfast & Networking Session in Jakarta, and his message was aimed at companies starting to use agentic AI, meaning AI that does not just answer questions but can take actions inside your systems.
It sounds like a big-corporation issue. In practice, AI agents are already reaching small businesses: an assistant that replies to customer chats, one that totals daily sales, or one that drafts supplier orders. Once it gets access to your till, your stock, or your customer data, the question is the same as when you hire someone new. Who is it, what is it allowed to touch, and who answers for it when something goes wrong?
What was actually said
According to reports by JawaPos and ANTARA, he stressed several points.
- When machines can make decisions on their own, risk goes up.
- Agentic AI can sometimes bypass a company's rules or limits because it is able to act.
- Companies need to know who operates each AI agent, which systems it can access, and which actions it is permitted to take.
- Security by design and privacy by design should apply from the design stage, and data processing must comply with personal data protection rules.
One more remark is worth noting for business owners. Patria warned that, going forward, the parties dealing with a company will no longer be only people. In other words, one day your customer or supplier may well show up through their own AI agent. If you are not yet in the habit of asking "whose agent is this and what may it do", the gap opens from two sides: agents you run yourself, and agents run by others.
In both reports this reads as guidance rather than a new regulation with penalties. Still, the direction is clear, and it makes sense for anyone who has already given AI access to business data.
The three KYA questions, for a shop or cafe
The three things Patria listed translate into three plain questions. If you cannot answer even one, hold that agent's access until you can.
Say a cafe installs an AI assistant to answer order chats. Its owner is the cafe manager, not a vague "marketing team". It only needs to read the menu and opening hours, not the cash records. And it may answer questions, but it may not change prices or hand out discounts on its own. Those three answers take five minutes to write down, yet many businesses have never written them.
Do not hand over the full keys
The most common mistake is granting the widest access because it is convenient during setup. A safer approach is to climb gradually. This is our own rule of thumb, not part of the ministry's statement.
Start at the lowest level. Move up only after a few weeks of seeing correct results. Money, refunds, and data deletion should never sit at the "acts alone" level.
The reasoning is simple. An agent that can only view might, at worst, write a poor summary. An agent that can change prices or delete data can make a mistake you only discover at month end, when the cash figures do not match. The bigger the impact of an action, the closer a person should stand beside it.
Five steps you can take this week
You do not need an IT team. One person and one hour is enough for the first three steps.
The first step often surprises people. Many owners discover an AI tool that an employee installed on their own, with access to the shop's accounts, never discussed with anyone.
One more thing that is often forgotten: authority must be withdrawn, not just granted. When an employee resigns, you close their account. Treat an AI agent you no longer use the same way, and do not leave it installed with access still switched on.
Tidy records make limiting access easier
Limiting access is easy when data lives in one place. If sales sit in a notebook, stock in a spreadsheet, and cash in another record, an AI agent ends up with access to everything because there is no way to separate it. That is why we built XETPOS, a point of sale app that brings sales transactions, bookkeeping, cash flow, and stock management into one system for retail shops, cafes, and eateries. With data in one system, it is easier to decide which part each person can see, AI agents included.
Want to check your own setup?
If you already use an AI assistant, or plan to, tell us your situation on WhatsApp at +62 823 1499 5005. We will help map the three questions above for your business, with no commitment.
Sources: JawaPos, 17 October 2026 and ANTARA, 16 October 2026.