Descope ships Agentic Identity Hub 3.0

What changed?

Descope released version 3.0 of its Agentic Identity Hub. The headline addition is the Agentic Governance Suite. Agents are now requested, justified and approved before they go live, with a documented purpose and an accountable owner.

The release also brings policy engine v2 with Deny policies. Per-tool authorization works at any enforcement point that queries Descope.

Why does it matter?

Descope has long been strong on standards. It names OAuth 2.1, PKCE, MCP authorization, DCR, CIMD, Cross App Access and SPIFFE. Its credential support includes SPIFFE SVIDs, private_key_jwt, mTLS and DPoP.

What it lacked was a governance story. Ownership and approval of agents at onboarding were thin. Version 3.0 fills that gap for onboarding.

This moved Descope's ownership score to eight out of ten in our review. A documented owner and purpose for each agent is close to what we look for.

What did not change?

Descope remains the authorization server, not the proxy. It decides; something else enforces. That is a clean design, but it means you need an enforcement point in the path of agent traffic.

We did not find per-call human approval in the public material. Approval happens when an agent is onboarded, not when it tries a risky action. Our runtime control score for Descope stays at six for that reason.

Discovery is also by request. Agents enter the hub when someone asks for them. Automatic discovery of agents nobody registered was not found.

How is it priced?

The Free Forever tier includes the Agentic Identity Hub. The Agentic Governance Suite is on Enterprise only. That split is clear and helps buying clarity. Small teams can start free and add governance when they grow.

Where does Descope sit now?

Descope ties for third place with Silverfort in the overall standings. The two products are nearly mirror images. Descope leads on credentials, delegation and standards. Silverfort leads on ownership, runtime control and discovery.

On our standards-first builders ranking, Descope places second behind Aembit. On free start for small teams, it shares second place with NewCore.

What should buyers check?

If you are considering Descope, ask how its decisions reach your tools. Which gateway or SDK will enforce them? Ask whether the governance suite's approvals can extend to actions at run time, or only to onboarding.

Also ask how the hub relates to your existing identity provider. Descope's Cross App Access support, shipped on 1 September 2026, uses ID-JAG tokens that keep the agent, user and tenant linked. That suggests a design that works with an enterprise identity provider rather than around it.

Our read

This is a meaningful release for a product that was already standards-rich. The governance suite closes the ownership gap at onboarding. The remaining gaps are runtime approval and discovery.

See the full Descope profile and the Aembit vs Descope comparison.