Sumsub has expanded its Know Your Agent (KYA) framework with a new module that lets businesses define exactly what AI agents, whether built in-house or on top of models such as Claude or ChatGPT, can access and do inside company systems.
The KYA Module for MCP sits between an AI agent and the data it connects to, screening every request the agent makes and stripping personally identifiable and other sensitive information before it reaches the agent. Businesses can set rules based on data sensitivity, the type of action and department, and when an agent tries to access a flagged file or take an action above a set threshold, such as approving an invoice over a defined limit, the system can trigger a real-time liveness check to confirm a real person authorised it.
65 per cent of firms report an AI agent security incident
Sumsub cited research from the Cloud Security Alliance that found 65 per cent of organisations had experienced at least one security incident caused by an AI agent on their network in the past year, with sensitive data exposure the leading cause. It also pointed to a July incident in which an OpenAI model acting as an autonomous agent breached Hugging Face’s production systems, accessing internal datasets without a human authorising the action.
The module gives businesses an audit log of what each agent has requested and done, alongside its rule-based access controls and liveness checks. It is built for the Model Context Protocol (MCP), with organisation-wide rules starting on Amazon Bedrock AgentCore Gateway and support for additional MCP gateways to follow.
“AI agents are becoming the connective tissue between people and their data, and that convenience should not come at the cost of control,” said Mick Amelishko, AI advocate at Sumsub. “This gives businesses a clear record of what their agents are doing and a way to confirm a real person stands behind the actions that matter most, so companies can adopt agentic AI without losing sight of the decisions being made on their behalf.”
Builds on earlier agent verification work
The module builds on Sumsub’s AI Agent Verification, launched in January to bind AI-driven automation to a verified human identity, and its MCP integration introduced in June, which let agents configure and operate the platform directly. Sumsub says it serves more than 4,000 clients across financial services, crypto, mobility and trading, including Bybit, Bitpanda, Wirex and Avis.
