Summary
- Sumsub launched its KYA Module for MCP on 19 October, describing policy checks between AI agents and connected enterprise data or tools.
- Promised controls include sensitive-data filtering, activity logs, rules for financial or document access, and liveness checks for selected actions.
- Initial support targets Amazon Bedrock AgentCore Gateway; customer adoption, independent effectiveness testing, and deployment dates for other gateways are unconfirmed.
Sumsub has introduced a module intended to control which data artificial intelligence agents can access and which actions they can execute through Model Context Protocol connections. Announced on 19 October, the KYA Module for MCP combines configurable request filtering, activity records, transaction limits, and human verification for selected sensitive operations.
The module is part of Sumsub’s Know Your Agent framework, which links automated activity to verified human identities. Sumsub says it operates between an agent and the data sources or tools the agent calls, applying business-defined rules before a request is completed. Amazon Bedrock AgentCore Gateway is the first supported gateway named by the company, with other MCP gateways planned but no published rollout dates.
Model Context Protocol, or MCP, allows an AI application to interact with external software through a common interface. Tools exposed through that interface may retrieve documents, search a database, or initiate transactions. Authentication can establish that an agent is allowed to connect, but it does not necessarily settle whether a particular request is appropriate for the employee, department, document, or financial value involved.
Sumsub says the module can inspect each agent request and remove personal or other sensitive information before the response reaches the agent. Its policy settings can take account of the sensitivity of the requested data, the type of action, and the department associated with the request. The company also describes an audit trail recording agent requests and actions within the controlled connection.
Human checks for selected decisions
Where a request exceeds a configured threshold, Sumsub says its system can require a real-time liveness check linked to an authorised person. The company gives examples including approval of an invoice above a set limit and access to a document outside a defined scope. Businesses may also set additional checks, such as questionnaires or address verification, depending on the operation.
Filtering and approval serve different purposes. A policy could permit a document to be retrieved after personal details are removed, while another policy could block access altogether or delay a financial action pending confirmation. Both rely on the permissions and conditions configured by the organisation using the service; the company has not released results showing how reliably the module makes those decisions in production.
Sumsub introduced its AI Agent Verification capability in January, describing a way to bind automated actions to a verified human identity. A June integration added MCP access to the company’s verification services. The October release extends the announced approach to decisions made when an agent requests data or tries to carry out work in another system.
Verifying that a person is present is not identical to verifying that the person is entitled to approve a transaction. A successful liveness check confirms something about the individual completing the check; authorisation also depends on their organisational role, the rights attached to that role, and the scope of the requested action. The product description includes configurable policies, but no independent assessment of how those relationships are enforced.
Amazon’s AgentCore Gateway documentation describes its existing mechanisms for connecting tools and authenticating callers. Sumsub’s announced controls are additional to that gateway infrastructure, not evidence that the supplier has replaced its underlying identity and access features.
Controlling the route from agent to data
The effectiveness of a policy applied at a gateway depends partly on whether relevant requests pass through it. An organisation may expose the same service to different clients, allow an agent to use another connection, or rely on separate permissions in a destination application. A control applied at one gateway would not automatically govern a second path unless the wider deployment also brought that path under the same policy.
Logs raise a related question of coverage. Recording agent requests can make it easier to reconstruct which data was sought and which approval was given, provided the system captures the relevant traffic and retains a useful record. Sumsub has not specified a uniform retention period, published a customer deployment count, or supplied an independent evaluation of its logging completeness.
The product addresses an emerging distinction in enterprise identity systems between recognising an agent, associating it with an accountable person, and limiting what it can do on that person’s behalf. Access to a finance or document service can be necessary for an automated task without entitling the agent to every operation available through the connection.
Sumsub’s release establishes the intended controls and its first supported gateway, but it does not establish tested resistance to bypass, a measured reduction in incidents, or availability across all MCP implementations. The company says support for additional gateways will follow, without identifying dates or customers for those deployments.
