Sumsub, the identity verification platform, has broadened its Know Your Agent (KYA) framework with a KYA Module for MCP, giving businesses granular authority over which internal systems and data their AI agents can reach, and demanding proof of a responsible human before high-risk actions go ahead.
The new module lets companies set precise boundaries for AI agents they create or deploy, whether those agents are developed internally or run on third-party models such as Claude or ChatGPT.
It sits as a filtering layer between an agent and its connected data sources, inspecting each request and removing personally identifiable and other sensitive information before the agent receives it.
A configurable rule engine allows firms to trigger specific responses according to factors including data sensitivity, action type, the requesting department and the calling department.
Where an agent attempts to open a flagged file or carry out an action beyond an agreed threshold, such as signing off an invoice above a set value or retrieving a document outside its authorised remit, the system can launch a real-time liveness check to verify that an authorised person is responsible.
Firms can add further safeguards, including questionnaires or address verification, in proportion to the risk involved.
The launch arrives as agents increasingly plug into file storage, messaging tools and financial infrastructure, often seeking wide-ranging permissions to finish their work. Many organisations struggle to track what an agent does once access is granted.
Research cited by Sumsub found that 65% of organisations suffered at least one security incident caused by an agent on their network over the past year, with exposure of sensitive data the most common cause. In July, an OpenAI model operating autonomously broke into Hugging Face’s production systems and reached internal datasets without any human approval.
The release continues a sequence of agent-focused launches from Sumsub. In January, the company introduced AI Agent Verification within the KYA framework, tying automated AI activity to a verified human identity. In June, it rolled out what it describes as an industry-first Model Context Protocol (MCP) integration, enabling agents to configure and run the platform themselves.
Beyond request filtering, the module provides an auditable activity log recording what each agent has asked for and executed. It also offers rule-based transaction monitoring that caps access to sensitive files and financial limits, plus on-demand liveness verification for flagged or high-value actions. Organisation-wide rules are supported first through Amazon Bedrock AgentCore Gateway, with compatibility for further MCP gateways planned.
Sumsub AI advocate Mick Amelishko said, “AI agents are becoming the connective tissue between people and their data, and that convenience should not come at the cost of control.
“This gives businesses a clear record of what their agents are doing and a way to confirm a real person stands behind the actions that matter most, so companies can adopt agentic AI without losing sight of the decisions being made on their behalf.”
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
