Summary

• Sumsub has introduced the KYA Module for MCP, enabling businesses to apply configurable access and transaction policies to connected AI agents.
• The module is designed to filter sensitive data, record agent activity, and trigger liveness verification when selected actions require human authorisation.
• Initial support centres on Amazon Bedrock AgentCore Gateway, with further MCP gateways planned; the controls do not automatically cover agents using other connections.

Sumsub has introduced an access-control module intended to stop AI agents retrieving sensitive business information or carrying out specified actions without the permissions required by the organisation deploying them.

The KYA Module for MCP allows businesses to establish rules governing the information agents can receive, the systems they may access and the circumstances in which an action requires verification by an authorised person.

Announced on 19 October, the product extends the Know Your Agent framework developed by Sumsub, a provider of identity verification, fraud prevention and compliance technology. Its initial integration is designed for Amazon Bedrock AgentCore Gateway, with support for additional Model Context Protocol gateways planned.

The launch addresses a problem arising as businesses give AI applications access to files, communication systems and operational software. An agent may need information from several sources to complete a legitimate task, but the permissions available through those connections can extend beyond what the requesting employee needs.

Agent access can exceed the original request

Traditional business applications normally operate within permissions assigned to employees, services or technical accounts. Although managing those arrangements can be complicated, the intended responsibilities of most applications are relatively well defined.

AI agents introduce another layer of decision-making because they can choose tools and initiate sequences of requests while pursuing a broader objective.

An employee preparing a financial report might ask an agent to collect information from several business systems. Depending on the connections available, the agent could attempt to retrieve confidential records, examine files outside the employee’s department or initiate actions that were not specifically considered when the original request was submitted.

The risk is not limited to deliberately malicious behaviour. An agent can misunderstand instructions, retrieve unnecessary information or act on misleading content encountered while examining a document.

Giving that system broad technical permissions could turn an ordinary error into an inappropriate disclosure or unauthorised transaction.

Restricting access at the connection between the agent and its tools provides one way to limit those consequences, regardless of whether the underlying model produces a convincing explanation of its intended action.

Sumsub’s module is designed to inspect requests passing through a supported MCP gateway and apply organisational rules before the requested information or operation becomes available.

Filtering takes place before data reaches the agent

Model Context Protocol provides a standard way for AI applications to interact with external tools and information sources. Through supported connections, an agent can request information or invoke functions made available by another system.

The capabilities exposed by those interfaces influence what the agent can accomplish, creating a need to define which requests are permissible.

Sumsub says its new module screens requests to connected resources and removes personally identifiable or otherwise sensitive information before that material reaches the agent.

Administrators can configure rules according to factors including the sensitivity of the information, the requested action and the organisational context surrounding the request.

For example, a system preparing a departmental report could be permitted to retrieve ordinary business records while being prevented from accessing documents assigned a more restrictive classification.

Filtering information before it enters an AI model may reduce unnecessary exposure, but effectiveness depends on how accurately sensitive material is identified and how completely the relevant applications are connected through the controlled gateway.

Personal information can appear in structured records, free-text documents and other formats, making reliable detection more complicated than removing a fixed list of fields.

The product announcement does not provide independent benchmarks measuring the proportion of sensitive information correctly identified or the frequency of inappropriate requests prevented.

Businesses would therefore need to test the module against their own information, policies and operating conditions before treating it as sufficient protection for sensitive workflows.

Human verification applies to selected actions

Beyond controlling access to information, Sumsub wants organisations to define when an automated action must be approved by a person.

The module includes rule-based transaction monitoring that can restrict operations according to thresholds established by the business. An attempt to approve an invoice above a specified value, for example, could trigger additional verification before the action proceeds.

Sumsub says the system can request a real-time liveness check to establish that a genuine person is involved in authorising the operation. Additional checks, including questionnaires or address verification, can be configured where appropriate.

These controls build on the company’s earlier identity verification work, which associates agents with verified human identities.

However, demonstrating that a real person has completed a verification step is not the same as establishing that the underlying business decision is appropriate.

A person authorised to approve a payment still needs to determine whether the invoice is legitimate, whether the goods or services were received and whether the amount is correct.

Organisations must also ensure that their policies identify the right approver. An identity check cannot compensate for an incorrectly configured spending limit or permissions that allow the wrong employee to authorise a transaction.

The module consequently provides a mechanism for enforcing defined controls rather than replacing the financial, operational or regulatory responsibilities that those controls are intended to support.

Activity records support investigation and review

Sumsub also includes logging intended to show what connected agents have requested and which actions they have taken.

Such records could help security and compliance teams investigate unusual activity, establish why a request was blocked or determine whether an operation exceeded the permissions assigned to an automated service.

For organisations working with financial information or regulated processes, the ability to reconstruct automated activity can be important when reviewing incidents and demonstrating that specified procedures were followed.

Logs themselves require appropriate protection. They may contain details of users, systems, business transactions or attempted access to confidential material, creating obligations concerning retention and who can examine the records.

The completeness of the audit trail also depends on where the module operates. A record of requests passing through one gateway does not necessarily describe actions taken by the model internally or through separate tools that bypass the connection.

The company has not established that the module provides universal visibility across every AI application within an organisation.

Businesses using multiple agent frameworks will therefore need to understand which activities are covered and whether additional controls are required elsewhere.

The October launch extends an existing framework

Sumsub introduced AI Agent Verification within Know Your Agent in January 2026, followed by an MCP integration in June that allowed agents to configure and operate parts of its compliance platform.

The new October module addresses a related but distinct requirement: restricting what connected agents can retrieve and execute when interacting with enterprise resources.

That progression reflects the difference between establishing an agent’s identity, enabling it to interact with software and enforcing limits on those interactions.

The initial focus on Amazon Bedrock AgentCore Gateway provides a defined integration point, but organisations using other MCP gateways or bespoke connections cannot assume that the same protection is already available.

Sumsub intends to support additional gateways. It has not disclosed a complete compatibility timetable, pricing structure or independently verified customer deployment results for the newly introduced module.

The company’s commercial proposition is that permission checks should operate within the infrastructure connecting AI agents to real business systems, rather than depend entirely on instructions given to the model.

For organisations considering agents capable of retrieving confidential information or initiating transactions, that approach offers a means of applying established access-control principles to a new type of application.

Its effectiveness will depend on accurate policy configuration, the connections supported and the evidence that blocked and authorised actions behave as expected in production environments.