Over the past seven days, three enterprise vendors — Descope, ServiceNow, and Postman — each shipped a product that does the same unglamorous thing: it sits between an autonomous AI agent and the resource that agent wants to touch, and it decides whether to say yes. There was no single launch event, no shared stage. The signal lived in the simultaneity. And while the trade press filed it under "enterprise software," the more accurate reading is that a governance layer is crystallizing around the same credentials that now move money across borders — which makes it a crypto story whether or not anyone chooses to label it one.
Here is the number worth sitting with: Gartner projects the average Fortune 500 company will be managing 150,000 autonomous agents by 2028. Against that scale, a second figure circulating in the same coverage — attributed to no named source, a detail I flag deliberately — claims that only 13% of organizations believe they can govern the non-human identities already running inside their walls. A 13% capability against a 150,000-per-enterprise mandate is not a gap. It is a void. And voids, in finance, are where both the most dangerous failures and the most extractive business models get built. I have spent the better part of eighteen years watching infrastructure promises arrive early and settle late. This one is arriving on schedule. The only open question is who ends up standing at the gate.
To see why this lands on crypto's doorstep, you have to understand what the Model Context Protocol quietly became. Anthropic released MCP in November 2024 as a standard way for language models to call external tools — a USB-C port for AI, in the marketing shorthand of the time. It defined an authorization framework built on OAuth 2.1, which was sensible and incomplete. MCP's security model carries two well-documented weaknesses: the confused deputy problem, where a privileged component is tricked into misusing its authority, and token passthrough, where credentials leak downstream in ways the protocol never intended. Those are not bugs awaiting a patch. They are architectural seams.
Descope's Agentic Identity Hub 3.0 is the latest attempt to stand on top of one of those seams. Its pitch is specific and, I should say, technically coherent: embed the policy enforcement point directly into the gateway layer, the same way API gateways like Kong, Apigee, and Envoy have routed and throttled traffic for a decade. The novelty is not the mechanism; it is the placement. Authorization moves from the MCP server — where every tool author was expected to implement their own checks — to the perimeter, where one gateway inspects every call. The product forces four attributes onto each agent request: owner, purpose, access, and audit. Descope does not invent a standard here; it adopts ID-JAG, the Identity Assertion Authorization Grant, still an IETF draft, which lets one domain assert a user's identity to an authorization server in another domain in exchange for a token.
Two further pieces complete the map. Descope integrated with agentgateway, an open-source project donated to the Linux Foundation by Solo.io — an open-core playbook, familiar and effective. And ServiceNow shipped its AI Passport in the same window while Postman shipped a Fabric Gateway. Three vendors, one week, one thesis. That convergence is the actual news, and it is the kind of convergence I have learned to read as demand rather than marketing. Vendors rarely sprint toward a market that does not exist.
There is a reason this trend finds crypto first, even if the vendors pretend otherwise. Non-human identities are not a new concept on-chain; they are the native population. MEV searchers, arbitrage bots, treasury rebalancers, and liquidation keepers have been autonomous, credential-bearing actors for years. Crypto has been running an ungoverned agent economy in production while enterprises were still writing policy documents. The NHI security market — Astrix, Oasis, Token Security, Entro — grew up around exactly this problem, and it is now being pulled into the agent conversation. So when a CIAM company like Descope, founded by Demisto's co-founder Slavik Markovich, extends from customer identity into agent identity, it is not entering virgin territory. It is entering a territory crypto already occupies, with better compliance paperwork and worse privacy guarantees. That inversion is worth holding onto: the enterprise gateway is not teaching crypto how to govern agents. It is arriving late to a problem crypto never solved and rarely admitted it had. The governance layer being built now is, in effect, a compliance retrofit over a population that has existed for years without passports.
Now the part that deserves real scrutiny, because the technical framing here is doing more work than the coverage admits. Start with what the gateway actually is. Embedding a policy enforcement point in the traffic path is a mature pattern. When you route every agent call through a single inspection layer, you gain something genuine: the ability to answer "who is this, on whose behalf, for what purpose, and can we prove it later?" for every request. For enterprises that today cannot even list their own agents, that is real value. The owner/purpose/access/audit quartet is essentially RBAC and ABAC fused with an audit trail and a purpose binding — not a new paradigm, but the mandatory purpose dimension matters in agent contexts, because an agent's legitimacy depends entirely on whether its intent matches its mandate.
But here is where the marketing and the mechanism diverge. Descope describes itself as "first" to embed authorization in the gateway. Read carefully: the "first" almost certainly means "first to do deep gateway integration as a non-human-identity vendor," not "first to implement MCP authorization." MCP already ships an authorization framework. This is a positioning claim, and positioning claims are where I start auditing, not where I stop.
From my own audit experience — I spent six months in 2017 manually reviewing more than forty ERC-20 contracts for a payment token and found a reentrancy flaw in the distribution logic that could have drained $2.5 million — I learned that the most dangerous vulnerabilities are never in the code shown to you. They live in the assumptions the code makes about what surrounds it. The same holds here. A gateway that authorizes every call assumes the call itself is trustworthy once authorized. It is not.
This is where the crypto parallel sharpens rather than softens the problem. Consider what is happening to agent-driven money on-chain. Account abstraction, session keys, and intent-based architectures are all pushing the same direction: a user signs an intent, a solver or agent executes it, and the user never touches the transaction. I have written before that intent-based architectures do not eliminate maximal extractable value; they relocate it, from the public mempool to a private solver network where it becomes harder to see and harder to audit. The Descope gateway is the enterprise cousin of exactly that relocation. Authorization does not disappear when you centralize it. It moves to a place with fewer eyes on it.
Then there is the oracle problem, which I have come to regard as DeFi's true Achilles' heel. A gateway authorizes a call based on the identity and purpose attached to it. But the agent acts on data — prices, balances, cross-chain state — and that data arrives through feeds whose latency is a structural fact, not a bug. Chainlink solving decentralization with a set of permissioned nodes is a compromise the industry has mostly agreed not to examine too closely. If an agent is authorized correctly but acts on a price thirty seconds stale, the authorization was flawless and the outcome was still a loss. The gateway guards the door. It does not check whether the floor is real.
And the floor, for cross-border flows, is where I spend my days. In 2024, working on a remittance-corridor study, I analyzed transaction data from 12,000 cross-border payments and found stablecoins compressing settlement from roughly five days to fifteen minutes while cutting costs by around 40%. That is the promise. Now layer agents on top: an autonomous treasury agent in Lagos rebalancing against a counterparty in Singapore, authorized by a gateway in Frankfurt, executing through a solver network that routes across three chains. The "omnichain app" narrative — the idea that a product is valuable because its contracts live on many chains — was manufactured by people who needed something to sell. Users have never cared how many chains a contract touches. They care whether the money arrives, on time, at the promised cost. What the gateway layer introduces is a new dependency in that chain that no user asked for and no user can see. This is the pattern I see before it becomes a trend: governance is being sold as neutral plumbing, but every gate is also a toll booth, and every toll booth has an owner. That is not a criticism of Descope specifically. It is a description of what governance always is.
There is a further gap the coverage skips entirely: performance and the standards question. A gateway that inspects every token, evaluates every policy, and logs every decision adds hops. Descope has published no P99 latency figures, no throughput benchmarks under high-concurrency agent load. In a bear market, where capital is scarce and infrastructure failures are punished immediately, an unmeasured chokepoint is a liability, not a feature. And ID-JAG is still a draft. If the standard shifts — and drafts shift — the migration cost lands on whoever built deepest on top of it. Standards followership is cheap to start and expensive to unwind. The engineering value here is real; the theoretical value is thin. And the difference between the two is the difference between a feature and a foundation. Bind your identity layer to a single protocol and you have repeated the mistake of deploying an app on one chain and calling it interoperable. I have watched that movie.
The commercial logic is where the story gets more honest and more uncomfortable. Agent identity governance is usage-based by nature: bill by agent count, by authorization event, by audit record. It scales linearly with the very growth Gartner is forecasting, which is a clean investment narrative and a clean extraction mechanism at the same time. Descope is private, has disclosed no pricing, no revenue, no customer counts, and no valuation — the absence is itself a signal, because enterprise custom pricing is the opposite of the transparent, developer-first story being told. The realistic endgame is not independence. It is absorption: Okta, Microsoft, CyberArk, or Palo Alto folding agent identity into a suite and pricing standalone vendors toward zero. The identity market has consolidated before, and the moat narrative always arrives just before the acquisition.
The received narrative is that this moment marks the arrival of a "governance moat." I think the moat is a story vendors tell themselves to justify valuation, and the real risk is its mirror image. Watch what the gateway does not cover. The core dangers in agent ecosystems — tool poisoning, where an MCP server ships a malicious tool; prompt injection, where instructions hide inside data; the confused deputy, where a trusted component is turned against its principal — live at the semantic and logic layer. A gateway that authorizes a call cannot inspect the meaning of the call. It can confirm that Agent X, owned by Y, with purpose Z, is permitted to touch resource R. It cannot tell you that resource R was poisoned three days ago by an attacker who understands that authorization and integrity are different problems. Descope's security story is locally correct and globally overstated. Deploy the gateway and you have solved authorization. You have not solved security, and the difference is the entire ballgame.
Worse, the solution introduces a new failure mode: the gateway itself becomes a single, high-value, centralized target. A decentralized fleet of MCP servers each failing independently is a mess. A single gateway failing — or being compromised — is a systemic event. DeFi promised freedom; it delivered a mirror. This gateway is the same mirror in enterprise clothing, reflecting back the oldest trade-off in finance: efficiency purchased with concentration.
There is a quieter cost too, one that matters to anyone moving money across borders. A gateway that concentrates every agent's identity traffic in one jurisdiction creates a data-residency and sovereignty problem that no compliance framework has solved. For an African corridor routing through a European gateway, the question of whose law governs the audit log is not academic.
And the moat, examined honestly, is shallow. Network effects: Descope is a mid-sized player beside Okta's tens of thousands of enterprise customers. Switching costs: moderate, because agent identity is early. Standard control: it follows ID-JAG rather than authoring it and integrates with an open-source gateway donated by another company rather than leading it. The genuine moats — network effects, switching cost, standard ownership — are precisely the ones it does not hold. What it holds is first-mover framing, and framing depreciates fast.
So where does this leave the reader positioning for the cycle? Not by betting on a gatekeeper. The durable insight is that agent identity governance is real demand meeting a market that may never belong to a standalone vendor. The most likely outcome is absorption — Okta, Microsoft, or a security platform folding the capability into a suite and pricing the independents toward zero. If you are watching this space, watch the standard, not the product: whether ID-JAG becomes a real RFC, whether the gateways stay open, whether authorization and integrity ever get solved together. The chokepoint is being built in plain sight, and nobody voted for it. We map the flows, but the ocean remains unmapped. Between the wire and the wallet, there is a void — and someone is already charging rent to cross it.
