The News
Descope has released Agentic Identity Hub 3.0, a platform update purpose-built to govern internal AI agents operating within enterprise environments. The release introduces an Agent Onboarding Portal with approval workflows, native MCP gateway integrations, advanced client authentication mechanisms including private_key_jwt, mTLS, SPIFFE, and workload identity federation, plus ID-JAG issuance that gives internal agents an SSO-like authentication experience across MCP servers. The announcement positions Descope as one of the first identity vendors to treat internal AI agents as first-class governed identities rather than IT edge cases, extending a platform that already manages authentication and access control for hundreds of MCP servers and more than one million agent identities.
Analyst Take
The shadow AI problem is now a shadow identity problem
The challenge Descope is addressing in this announcement isn’t AI adoption; it’s AI accountability. Employees are provisioning agents faster than IT can document them, authenticating those agents with shared secrets and long-lived API keys, and frequently running tools the organization never built and cannot instrument. That’s not a policy problem. It’s a structural identity gap, and it’s one that existing IAM and PAM platforms weren’t architected to close.
The data from ECI Research’s Google GovTech Survey makes the risk concrete: according to ECI Research, 26.0% of respondents identified “Securing machine-to-machine secrets management and API tokens” as their organization’s biggest hurdle when implementing a Zero Trust architecture at the application layer. Agents authenticating with static secrets, which Descope explicitly calls out as the dominant pattern today, sit directly in the center of that gap. Meanwhile, hardcoded secrets within repositories registered as the most common source of vulnerabilities escaping into staging and production environments, cited by 25.7% of respondents in the same ECI Research survey. Agentic Identity Hub 3.0 aims to address both of these failure modes simultaneously through certificate-based authentication and centralized policy enforcement at the MCP gateway layer.
What ITDMs should pay attention to
For IT and security leaders, the case for this type of platform isn’t primarily about AI governance as a compliance checkbox. It’s about the operational exposure created when AI agents operate outside your identity perimeter. An agent running with a long-lived API key that was provisioned informally, connects to GitHub, Notion, and Slack, and has no documented owner is a lateral movement risk, a data exfiltration risk, and an audit failure waiting to happen. The ID-JAG issuance model and the Agent Onboarding Portal together create something most organizations currently lack: a traceable chain of custody from agent request to provisioned access to revocation.
The MCP gateway integration with agentgateway, an open source project of the Agentic AI Foundation, is also worth noting. By enforcing authentication and logging at the gateway level, Descope can apply policy to agents the organization didn’t build, including commercial clients like Claude, Cursor, and ChatGPT. That’s the critical coverage gap most identity solutions leave open today.
What developers should pay attention to
For engineering teams, the authentication architecture in 3.0 reflects current best practices for non-human identity. The support for private_key_jwt, mTLS, SPIFFE, and workload identity federation means organizations can eliminate static secrets from agent authentication without building custom credential management infrastructure. Workload identity federation in particular is a strong addition: if an agent is already running in AWS, GCP, Azure, Kubernetes, or GitHub Actions, it can authenticate using the identity those platforms have already issued, no additional secrets required. This is how production-grade machine identity management works in modern cloud-native environments, and it’s good to see an identity-as-a-service vendor supporting the full stack rather than stopping at OAuth client credentials.
The Agent Onboarding Portal’s self-service catalog and approval workflow is also architecturally sensible. The design priority appears to be making the governed path fast enough that teams don’t route around it. That’s the right framing. Overly rigid approval gates produce shadow infrastructure; lightweight, documented approval processes produce auditable adoption.
Looking Ahead
The non-human identity market is moving quickly, and Descope’s positioning as an early mover treating AI agents as first-class identity types will matter more over the next 12 to 24 months as agentic workflows move from experimental to production. The MCP protocol is gaining adoption rapidly across the vendor ecosystem, and the organization that owns the authentication and policy layer for MCP servers across an enterprise will have significant architectural leverage. Descope’s integration with the Agentic AI Foundation’s agentgateway project is a smart way to stay close to where the protocol is being standardized.
The harder competitive question is how long it takes for established IAM vendors to build comparable agentic identity capabilities. Descope has a meaningful head start in architectural orientation, and 1M+ agent identities already under management is a real proof point. But enterprises with deep existing relationships with those incumbents will face procurement inertia. The vendors that close this capability gap fastest, and can demonstrate clean integration with existing PAM and IAM infrastructure rather than requiring a rip-and-replace, will capture the largest share of what is becoming a critical new control plane for enterprise AI.
Stay Ahead of Application Development Trends
Get weekly analyst insights, research notes, event coverage, and AppDevANGLE updates delivered directly to your inbox.
Subscribe for Weekly Insights
Join technology leaders, practitioners, and GTM teams following the trends shaping modern software delivery.
Looking for deeper research access?
Explore ECI Research reports, survey insights, and market analysis through the ECI Research Portal.
