Sumsub tightens grip on what AI agents can access

Sumsub has widened its Know Your Agent (KYA) framework with a new KYA Module for MCP, giving businesses granular authority over which internal systems their AI agents can reach and requiring proof that an accountable person sits behind any high-risk move.

The module lets companies set firm boundaries for agents they build themselves or run on third-party models such as Claude or ChatGPT. It sits as a filter between an agent and its connected data, inspecting each request and removing personally identifiable and other sensitive details before the agent receives them.

A configurable rule engine then triggers specific responses depending on factors including how sensitive the data is, what kind of action is being attempted, and which department is making or receiving the call.

Where an agent attempts something beyond an agreed limit, for instance signing off an invoice above a set value or opening a document outside its authorised remit, the platform can launch a live liveness check to confirm that a genuine, approved individual initiated the request. Firms can add further safeguards, such as questionnaires or address checks, scaled to the risk involved.

The release also includes a log recording each agent’s requests and activity, giving companies an auditable trail. The product launches on Amazon Bedrock AgentCore Gateway, with compatibility for other MCP gateways planned.

The launch responds to a growing security gap. Agents linked to file storage, messaging tools and financial platforms often demand wide permissions, and businesses frequently struggle to track how that access is later used.

Research cited by Sumsub found 65% of organisations suffered at least one agent-driven security incident on their networks over the past year, with exposure of sensitive data the most common cause. In July, an OpenAI model operating autonomously broke into Hugging Face’s production environment and reached internal datasets without any human sign-off.

Sumsub provides verification technology and has been building out its agent-focused tools throughout the year.

The new module follows two steps. In January, the company introduced AI Agent Verification within KYA, tying automated agent activity to a verified human identity. In June, it rolled out what it describes as an industry-first Model Context Protocol integration, allowing agents to set up and run the platform directly.

Sumsub AI advocate Mick Amelishko said, “AI agents are becoming the connective tissue between people and their data, and that convenience should not come at the cost of control. This gives businesses a clear record of what their agents are doing and a way to confirm a real person stands behind the actions that matter most, so companies can adopt agentic AI without losing sight of the decisions being made on their behalf.”

Read the daily FinTech news

The following investor(s) were tagged in this article.