Descope targets AI agent sprawl with identity governance platform

Descope's Agentic Identity Hub 3.0 brings audit trails and policy controls to the enterprise AI agents most firms cannot yet inventory.

By Disrupts Editorial Team Wed, 21 October 2026 AI level 2 of 5

AI level 2 of 5: drafted by our AI editorial assistant from the company's announcement; fact-checked, edited and signed off by Mark Walker, Editorial Director. What the levels mean

A brightly lit, modern control room features a long, curved desk with multiple monitors displaying blue-green digital data, several office chairs, illuminated floor lines, and a large world map on a screen at the back.

Descope, a California-based identity platform, has launched Agentic Identity Hub 3.0, extending its governance and authentication tooling from customer-facing AI agents to the internal agents and Model Context Protocol (MCP) servers that enterprise employees are spinning up at pace. The release lands as organisations wrestle with a structural gap: AI adoption inside the enterprise is accelerating far faster than the security and IT functions charged with governing it.

The numbers illustrate the scale of the problem. Gartner forecasts that the average Fortune 500 company will be running more than 150,000 AI agents by 2028, up from fewer than 15 in 2025. Yet only 13% of organisations currently believe their AI governance frameworks are adequate. A separate EY survey found that 47% of organisations bypass formal AI governance processes for urgent deployments, even though 98% have such policies on paper. The gap between policy and practice is, in effect, the market Descope is targeting.

The governance gap in agentic AI

The core problem Descope identifies is one of identity debt. Internal agents proliferate without documented owners, authenticate using static secrets and long-lived API keys that are rarely rotated, and frequently rely on third-party tools such as Claude, Cursor, or ChatGPT that the organisation itself cannot instrument. When something goes wrong, there is no audit trail and no accountable owner.

Agentic Identity Hub 3.0 attempts to close that gap through three principal mechanisms. The Agentic Governance Suite introduces a structured approval workflow: employees request a new agent alongside the resources it needs to access, the request goes through review, and every approved agent receives a documented purpose, a named owner, and least-privilege access. MCP gateway integrations apply a single authentication, authorisation, and logging layer across both internally built agents and third-party tools. Advanced client authentication replaces shared secrets with cryptographic alternatives including mutual TLS, SPIFFE workload identities, and private-key JWT assertions, so agents prove identity through keys and certificates rather than static credentials.

"Internal or external-facing AI systems have the same critical need for delegated access to resources," said Slavik Markovich, co-founder and CEO of Descope. "Agentic Identity Hub 3.0 puts an owner, scoped access, policy controls, and audit trail behind every agent, so organisations can continue adopting AI at the pace they have been without any identity bottlenecks or blindspots."

Cross-sector implications for cybersecurity and enterprise AI strategy

The launch sits at the intersection of two converging pressures on enterprise leadership. On one side, AI adoption timelines are being set by business units and developers, not by CISOs. On the other, regulators in both the EU and the UK are tightening requirements around auditability and accountability for automated decision-making systems, with the EU AI Act's provisions on high-risk AI deployments already in force for some categories.

For cross-sector strategists, the Descope release signals a maturing of the agentic AI stack. The first wave of enterprise AI investment focused on capability: foundation models, fine-tuning pipelines, and retrieval-augmented generation. The second wave, now underway, focuses on control: who owns the agent, what can it access, and what happened during its last ten thousand interactions. Identity governance is becoming infrastructure, not an afterthought.

The capital landscape reflects this shift. Non-human identity and machine identity management have drawn increasing investor attention across sectors, with vendors including CyberArk, SailPoint, and a range of earlier-stage challengers competing for the governance layer of the agentic enterprise. Descope's positioning as a developer-friendly platform, with support for open standards such as SPIFFE and integration with the Agentic AI Foundation's open-source agentgateway project, is a deliberate play for the bottoms-up adoption patterns that have historically driven identity platform consolidation.