Descope Launches Envoy for Delegated AI Agent Authentication in Consumer Apps
Descope has announced Envoy, a product offering that lets consumer applications authenticate personal AI agents as distinct, delegated identities rather than forcing companies to either block agents or let them impersonate human users via credential sharing. The announcement responds to rapid adoption of personal AI agents (e.g., Meta's Muse, OpenAI's Instant Checkout, Shopify agentic storefronts) and highlights that companies like Amazon and JPMorgan Chase have already blocked external agents such as Muse and Instinct over security and liability concerns. Launch and design partners include GoFundMe, You.com, GoodRx, and Composio. Envoy implements the emerging Personal Agent Protocol (Poppy) draft 0.1 published by Meta and Sierra, aiming to standardize cryptographically bound, auditable agent sessions.
Detalhes técnicos
Envoy provides several capabilities: Poppy protocol support (agent discovery via Client ID Metadata Documents, no pre-registration, session tokens bound via Demonstrated Proof of Possession (DPoP)); granular permissions through Rich Authorization Requests (RAR) to scope what an agent can do (e.g., browsing/ordering but not changing payment methods); out-of-band approval for sensitive actions using Client-Initiated Backchannel Authentication (CIBA); and delegation (rather than impersonation) that keeps customer and agent identities distinct in logs and tokens, enabling independent revocation of agent access. Descope also released a zero-dependency TypeScript Poppy SDK for AI agent builders to ease compliance with the protocol.
This is a vendor product announcement with no reported vulnerability, exploitation, or incident; it is included for awareness of emerging identity and access management patterns for AI agents in consumer-facing applications.
Linha do tempo
-
Descope Launches Envoy for Delegated AI Agent Authentication in Consumer Apps
ler a análise desta fonte ocultar
Descope has announced Envoy, a product offering that lets consumer applications authenticate personal AI agents as distinct, delegated identities rather than forcing companies to either block agents or let them impersonate human users via credential sharing. The announcement responds to rapid adoption of personal AI agents (e.g., Meta's Muse, OpenAI's Instant Checkout, Shopify agentic storefronts) and highlights that companies like Amazon and JPMorgan Chase have already blocked external agents such as Muse and Instinct over security and liability concerns. Launch and design partners include GoFundMe, You.com, GoodRx, and Composio. Envoy implements the emerging Personal Agent Protocol (Poppy) draft 0.1 published by Meta and Sierra, aiming to standardize cryptographically bound, auditable agent sessions.
Technical Details
Envoy provides several capabilities: Poppy protocol support (agent discovery via Client ID Metadata Documents, no pre-registration, session tokens bound via Demonstrated Proof of Possession (DPoP)); granular permissions through Rich Authorization Requests (RAR) to scope what an agent can do (e.g., browsing/ordering but not changing payment methods); out-of-band approval for sensitive actions using Client-Initiated Backchannel Authentication (CIBA); and delegation (rather than impersonation) that keeps customer and agent identities distinct in logs and tokens, enabling independent revocation of agent access. Descope also released a zero-dependency TypeScript Poppy SDK for AI agent builders to ease compliance with the protocol.
This is a vendor product announcement with no reported vulnerability, exploitation, or incident; it is included for awareness of emerging identity and access management patterns for AI agents in consumer-facing applications.