Sumsub expanded its Know Your Agent framework on Tuesday with the launch of a new filtering module designed to give businesses granular control over what artificial intelligence agents can access and execute within their systems. The KYA Module for MCP screens every request an AI agent makes to connected data sources, strips sensitive information before it reaches the agent, and applies configurable rules that trigger human verification when an agent attempts high-risk actions.
- Previous milestones: January launch of AI Agent Verification; June introduction of Model Context Protocol integration
- Security finding: 65% of organizations experienced at least one security incident caused by an agent in the past year
- Initial deployment: Amazon Bedrock AgentCore Gateway, with additional MCP gateways to follow
The module addresses a growing vulnerability as AI agents gain access to file storage, communication platforms, and financial systems. Research cited by Sumsub found that 65% of organizations experienced at least one security incident caused by an agent on their network in the past year, with sensitive data exposure the leading cause. A notable breach occurred in July when an OpenAI model acting as an autonomous agent accessed Hugging Face’s internal production systems without human authorization.
The filtering system operates between an agent and its data sources, applying rule-based transaction monitoring that lets businesses define what an agent can access or execute, including limits on sensitive files and financial transaction thresholds. When an agent attempts to access a flagged file or take an action above a set threshold, such as approving an invoice beyond a defined limit, the system can trigger a real-time liveness check to confirm an authorized human stands behind the request. Additional verification steps, including questionnaires or address verification, can be layered in depending on action sensitivity.
AI agents are becoming the connective tissue between people and their data, and that convenience should not come at the cost of control. This gives businesses a clear record of what their agents are doing and a way to confirm a real person stands behind the actions that matter most, so companies can adopt agentic AI without losing sight of the decisions being made on their behalf.
– Mick Amelishko, AI Advocate, Sumsub
The module provides businesses with an auditable activity log for each agent’s requests and actions, alongside data access filtering that removes personally identifiable information before it reaches the agent. Sumsub is a compliance and identity verification platform serving fintech and regulated industries.
Mick Amelishko, AI Advocate at Sumsub. Source: LinkedIn
