Descope launches Envoy to manage personal AI agent identities

The problem of agent identity

Consumer businesses are currently facing a dilemma as artificial intelligence agents begin to perform tasks like shopping and paying for items. When an agent acts on behalf of a person, many companies struggle to determine if the software is a legitimate tool or a malicious actor. This ambiguity creates significant security risks for online platforms.

Some major companies have already taken action to block these agents from their systems. For example, Amazon blocked a Meta agent from its store because it did not identify itself as an agent when placing orders. Similarly, JPMorgan Chase moved to keep outside agents away from customer bank accounts to prevent unauthorized access.

Descope argues that blocking these agents will become increasingly difficult as more people adopt them for daily tasks. The current alternative is for an agent to use a human's actual password and one-time code, which makes it impossible for a business to tell if a human or a bot is interacting with the account. This lack of clarity often leads to higher costs for businesses due to disputed orders and returns.

How Envoy handles authentication

Descope launched Envoy to provide a third option that allows agents to sign in without posing as the human user. The service is built around a draft called the Personal Agent Protocol, which was published by Meta and Sierra Technologies. This protocol establishes rules for how an agent can authenticate while maintaining a separate identity from the customer.

Under this framework, a business publishes specific endpoints that agents are allowed to use and verifies which agent is making the call. Envoy then issues a session token that is cryptographically bound to that specific agent until the interaction is finished. This ensures that the agent's actions are tied to its own unique credentials rather than the user's private login details.

Developers using Envoy do not have to build the underlying protocol themselves or keep up with its revisions. Descope handles the discovery of agents and the identification process, requiring no advance registration. Instead, each agent presents a published client metadata document to prove its identity during the connection process.

Granular permissions and security

One of the primary benefits of Envoy is the ability for businesses to define exactly what an agent is allowed to do. It uses an extension to OAuth called Rich Authorization Requests to specify these permissions. For instance, a retailer could allow a shopping agent to place an order while strictly preventing it from accessing the customer's saved payment methods.

The system also allows for flexible control over how long an agent's access lasts. For sensitive actions, the platform can use Client-Initiated Backchannel Authentication to send a request to the human user for approval. This allows the customer to review and authorize a specific action on a separate channel, such as a mobile phone, before the agent proceeds.

Because every token and log entry records both the customer and the agent as separate parties, businesses gain better visibility. A company can revoke an agent's access at any time without needing to sign the human customer out of their own account. This separation is critical for maintaining security in a world where many different agents might interact with a single user's data.

Industry adoption and tools

Descope is working with several design partners to test Envoy in real-world scenarios. GoFundMe plans to use the service to ensure that donations remain distinct from the agents performing them, while GoodRx expects to use it for agents that compare pharmacy prices. At GoodRx, agents will be granted limited permissions to view pricing information before a customer reaches the counter.

To support the ecosystem, Descope also released a software development kit for the Personal Agent Protocol. This kit allows any agent to work with the protocol while Descope manages the complex tasks of discovery and session management. The kit is written in TypeScript and was designed to have no external dependencies for easier integration.

Envoy sits on top of Descope's Agentic Identity Hub, which already handles authentication for over 1,000 servers. The company has raised $88 million in funding to date to support these efforts. Descope co-founder and CEO Slavik Markovich noted that the assumption that every login page is for a person no longer holds true.

The future of agentic identity

The launch of Envoy represents a shift toward a standardized way of handling non-human identities in consumer software. By providing a clear distinction between humans and agents, Descope aims to make it easier for companies to embrace AI tools without sacrificing security. This infrastructure is intended to mirror how the Model Context Protocol handled enterprise tools.

As more consumers begin to delegate tasks like travel booking and shopping to personal AI, the demand for these identity standards will likely increase. Businesses will need to decide which permissions to grant to these agents and how to manage the lifecycle of those permissions. Envoy provides the technical foundation for these decisions to be made safely and at scale.

Moving forward, the success of this approach will depend on wide adoption by both agent builders and consumer platforms. As more companies join the Personal Agent Protocol, it may become the standard for how AI interacts with the web. This transition will allow for a more seamless experience where users can deploy agents to handle routine tasks while retaining full control over their sensitive data.

Try it today

You can research the Personal Agent Protocol draft published by Meta and Sierra Technologies to see the proposed rules for agent authentication.

Watch

How quickly will major retailers adopt the Personal Agent Protocol to manage AI shopping?

What specific permissions will be standard for agents in the travel and healthcare industries?