Agent identity & access
An identity provider for AI agents and MCP servers that registers OAuth clients (including dynamic client registration), records agentic identities created by user consent or tenant grants, and issues short-lived scoped credentials with policy-based access to protected APIs and MCP resources. Aimed at application builders rather than workforce IT.
commercial · generally available · Research snapshot 2026-09-06
Visit the official product source ↗Agent identity & access · Runtime authorization & controls
Useful conversation with: Application security engineer, Identity architect, Platform engineer.
Show me an autonomous agent registering via DCR, receiving a short-lived scoped token, and being denied an MCP tool call by an access policy — with the audit record.
Support labels reflect the supplied research. Documentation and vendor claims are not independent product tests. “Not established” means the researcher did not find support; it does not prove a capability is absent.
Documented by provider
The Hub registers and manages OAuth clients for agents via pre-registration, DCR, CIMD or JWT bearer for cloud workloads, and creates agentic identity records on consent or tenant grant.
Limit: Docs do not state throughput limits or supported cloud providers beyond AWS and GCP OIDC.
Documented by provider
Descope issues short-lived, scope-limited credentials at the moment an agent needs them.
Limit: Token lifetimes and revocation guarantees are not quantified in the fetched documentation.
Vendor claim
Version 2.5 added granular access policies for least-privilege agent access to MCP servers and backend APIs, using OAuth token exchange for delegated access with attribution and audits.
Limit: Press release announces capabilities without stating GA status for each one.
Listing does not imply partnership, supplier status, a working DutyGraph integration, or a compliance certification.
Suggest a correction