Descope Agentic Identity Hub 3.0 Targets Shadow AI Inside Enterprises

Descope is expanding its identity platform to govern the AI agents and Model Context Protocol (MCP) servers that employees use inside an organization, an area where adoption has often moved faster than security teams can inventory or control it.

Agentic Identity Hub 3.0, scheduled to launch on October 15, adds an Agent Onboarding Portal, native integrations with MCP gateways, stronger workload-authentication options, and ID-JAG issuance for agents accessing internal tools. The objective is to give every agent a documented purpose, an accountable owner, scoped permissions, and an audit trail without requiring companies to replace the identity systems already used by employees.

The release pushes Descope beyond protecting customer-facing agents and MCP servers into the more difficult problem of “shadow AI” inside enterprises. Employees can connect Claude, Cursor, ChatGPT, or an internally built agent to business systems, sometimes with static API keys or personal accounts that security teams cannot centrally revoke. Descope cited the 2026 Verizon Data Breach Investigations Report in saying that 45% of employees regularly use AI on corporate devices and that 67% of this activity flows through personal, non-corporate accounts.

Giving Internal Agents an Owner and an Identity

The new Agent Onboarding Portal is designed to turn agent deployment into a governed request process. An employee specifies the agent’s purpose and the applications, APIs, data sources, or MCP servers it needs. Reviewers can approve the request before access is provisioned, creating an inventory that identifies who requested the agent and who remains accountable for it.

This addresses a basic weakness in conventional identity and access management. Human accounts normally have an employee record, role, manager, and offboarding process. Agents are often treated more like scripts or service accounts, even though they can select tools dynamically and act across several systems. That makes ownership and runtime authorization as important as the initial login. It also echoes a point raised in Securities.io’s recent discussion with Q2 on agent identity: an agent should have a distinct, limited role rather than inherit all the authority of an account owner.

Descope says its existing Agentic Identity Hub already handles authentication and access control for more than one million agent identities and hundreds of MCP servers. Customers named in the announcement include You.com, WisdomAI, Cequence Security, Token Security, and Daylight Security.

How the Identity Control Plane Works

The company’s technical documentation separates two concepts that are frequently combined in agent platforms. A Resource is an API or MCP server that an agent wants to reach, identified by an audience and protected with scopes. A Connection is a vault entry holding an OAuth token or API key needed by a downstream tool.

In Descope’s recommended architecture, the agent receives a short-lived token scoped to a Resource. The protected server or gateway then retrieves any required downstream credential from the Connections vault at runtime. The agent does not hold the long-lived third-party secret. Policies can evaluate the agent, originating user, tenant, requested tool, and runtime context when tokens are issued or exchanged, while the platform records the chain of activity for auditing.

That model matters because MCP standardizes how agents discover and call tools, but it does not eliminate the need for enterprise authorization. Agentic Identity Hub 3.0 can serve as the identity provider for an existing gateway or work with Descope’s own early-access Agent Gateway. The release names agentgateway, an open-source Agentic AI Foundation project, as a native integration. Descope’s gateway documentation also describes compatibility with products such as Kong AI Gateway, Azure AI Gateway, Portkey, and Golf.dev.

Placing policy enforcement at the gateway creates one place to authenticate agents, authorize tool calls, and capture logs across internal and third-party MCP servers. It can also become a critical enforcement point: availability, policy quality, and accurate scope design determine whether it reduces risk or simply centralizes it.

Moving Agents Away From Shared Secrets

Descope is also adding several ways for agents and workloads to authenticate without static client secrets. These include private-key JWT assertions, mutual TLS, SPIFFE workload identities, and workload identity federation.

With workload identity federation, an agent running on AWS, Google Cloud, Microsoft Azure, Kubernetes, or GitHub Actions can present the identity already issued by that environment. Descope validates the signed token, creates an identity record for the workload, and returns a scoped access token. Different deployments can remain separately identifiable even when they share a client configuration, allowing one instance to be revoked without disabling every copy of the agent.

ID-JAG issuance is intended to extend a similar model across MCP servers. An internal agent authenticates through the organization’s existing identity provider and receives access appropriate to each server. Policies are evaluated on requests rather than embedded in a long-lived credential, allowing access to be narrowed or revoked centrally. Descope describes this as an SSO-like experience for agents, but its effectiveness will depend on gateway and client support for the underlying standards and on administrators defining scopes that reflect real business boundaries.

Descope’s Shift From Customer Identity to Agent Security

Descope was founded in 2022 by a team that previously built security orchestration company Demisto, which Palo Alto Networks (PANW ) acquired in 2019. The company emerged from stealth in 2023 with $53 million in seed funding and says it extended that round to reach $88 million in total funding in 2025.

Its original focus was customer identity and access management, including passwordless authentication, visual identity workflows, SDKs, and APIs. Agentic Identity Hub extends that identity infrastructure to non-human actors. The shared foundation is strategically important: employee identities, agent identities, policy evaluation, credential brokering, and audit records can be managed without building a separate identity silo for each AI product.

For buyers, the practical question is whether Descope can make agent governance easy enough that development teams use it instead of bypassing it. The onboarding workflow must remain faster than informal credential sharing, and its gateway integrations must cover the clients and servers employees actually adopt. Security teams will also need to distinguish between an agent being authenticated and the agent’s actions being safe; identity narrows and attributes access, but it does not prevent prompt injection, flawed tool selection, or harmful actions that remain within an approved scope.

Agentic Identity Hub 3.0 is therefore best understood as an attempt to establish the identity perimeter for enterprise AI. It gives organizations a way to answer who owns an agent, which user or workload it represents, what it can reach, and how its access can be revoked. As agents move from experimentation into production workflows, those questions are becoming part of core cybersecurity infrastructure rather than an optional layer around the model.