How we score agent identity platforms
In short:Each platform gets a score from zero to ten on seven weighted criteria. The weighted sum divided by 100 is the total, to two decimals. Totals within 0.10 share a rank. Every score has a one-sentence reason and a public source, and we review monthly.
What are the seven criteria?
| Code | Criterion | Weight | What earns a high score |
|---|---|---|---|
| C1 | Agent identity and ownership | 20 | Each agent has a registered identity, a named accountable owner and a managed lifecycle. |
| C2 | Credential model | 20 | Agents hold no standing secrets and receive short-lived, scoped credentials. |
| C3 | Delegation and on-behalf-of | 15 | An agent acting for a person stays within that person's permissions, and the delegation chain is preserved. |
| C4 | Runtime authorization and human approval | 20 | Each action is checked at run time, and risky actions are routed to a person. |
| C5 | Discovery of unregistered agents | 10 | The platform finds agents that nobody registered. |
| C6 | Standards | 10 | Public material names OAuth 2.1, MCP authorization, Cross App Access or ID-JAG, SPIFFE, DPoP or mTLS. |
| C7 | Buying clarity | 5 | A published price, a free tier or a clear procurement path. |
How is the total calculated?
Each criterion gets a whole-number score from zero to ten. We multiply each score by its weight, add the results and divide by 100. The total has two decimals and is computed in code, never typed by hand.
For example, NewCore scores 10, 9, 9, 10, 8, 5, 5 across the seven criteria. That gives a total of 8.70.
What happens when totals are close?
Totals within 0.10 of the first platform in a group share a rank. A shared rank is shown with an equals sign, such as 3=. The next rank skips accordingly.
Descope and Silverfort share third place. Cyera Identity and Astrix Security share fifth place. Clutch Security and Token Security share ninth place.
What counts as evidence?
- Public vendor material only: product pages, documentation, pricing pages, press releases and vendor blogs.
- Every score has a one-sentence reason and at least one source with its read date.
- If we cannot find a capability in public material, we say "not found" and score it lower.
- We do not use briefings, private demos, analyst opinions or customer anecdotes to set a score.
- Roadmap items count only once they are generally available.
How often are scores updated?
Monthly. Each review rereads every source and records changes on the corrections log. The current review date is 3 November 2026.
How do the best-for rankings differ?
The best-for rankings reuse the same seven scores with different weights. The weights are shown on each page. Whoever leads on those weights leads the page.
Can a vendor change its score?
Only by publishing evidence. Send a public source to the corrections address. If it supports a change, we update the score and log it.