Sumsub today expanded its Know Your Agent (KYA) framework with the launch of the KYA Module for MCP.

The module enables businesses to define exactly what the AI agents they build or deploy — whether in-house or on top of models such as Claude or ChatGPT — are allowed to access inside company systems.

Sumsub will ensure clients can confirm a real, accountable human stands behind any action that crosses a sensitive threshold. This builds on two earlier milestones. In January, Sumsub launched AI Agent Verification within its Know Your Agent (KYA) framework, binding AI-driven automation to a verified human identity. In June, it introduced its industry-first Model Context Protocol (MCP) integration, letting agents configure and operate the platform directly.

The KYA Module for MCP screens every agent request, strips personally identifiable and other sensitive information before it reaches the agent, and applies a fully configurable rule engine enabling a business to have precise control, triggering defined actions based on data sensitivity, the type of action, the requesting department, the calling department, and other parameters set.

When an agent tries to access a flagged file or take an action above a set threshold, such as approving an invoice above a defined limit or accessing a document outside its permitted scope, the system can trigger a real-time liveness check to confirm a real, authorized human is behind the request. Businesses can also layer in additional verification steps, such as questionnaires or address verification, depending on the sensitivity of the action.

Key capabilities include:

• Data access filtering: Screens every request an agent sends to connected data sources and removes sensitive or personally identifiable information before it reaches the agent.
• Agent activity log: Gives businesses a clear, auditable record of what each agent has requested and done.
• Rule-based transaction monitoring: Allows businesses to define what an agent can access or execute, including limits on sensitive files and financial thresholds.
• On-demand liveness verification: Triggers a liveness check when an agent attempts a flagged or high-value action, confirming a verified human authorized it.
• Built for MCP: Businesses set organization-wide rules for their agents – starting with Amazon Bedrock AgentCore Gateway, with support for additional MCP gateways to follow.

“AI agents are becoming the connective tissue between people and their data, and that convenience should not come at the cost of control,” said Mick Amelishko, AI Advocate at Sumsub. “This gives businesses a clear record of what their agents are doing and a way to confirm a real person stands behind the actions that matter most, so companies can adopt agentic AI without losing sight of the decisions being made on their behalf.”