AI in customer loyalty is shifting programs from cost to growth

At a glance

What this is: Comarch argues that AI is changing loyalty programmes from a marketing cost centre into a growth engine, with discoverability, MCP access, and agentic execution becoming part of the operating model.

Why it matters: IAM, NHI, and AI governance teams should treat loyalty platforms as identity-adjacent systems because AI assistants, external tools, and customer entitlements now intersect in the same control plane.

By the numbers:

• Over 35% of consumers already use AI tools like ChatGPT to research and evaluate loyalty programs.

Context

AI in loyalty is no longer only a marketing capability. Once rewards, tier status, and redemption flows are exposed through conversational interfaces and external tools, the programme starts to depend on access control, data exposure limits, and machine-to-machine trust as much as on campaign design. That makes the boundary between customer experience and identity governance materially thinner than many loyalty teams assume.

The governance gap is that loyalty stacks are being asked to serve both human consumers and AI intermediaries without a mature control model for delegation, verification, and bounded access. Where MCP-connected interfaces or agentic assistants can query balances or trigger redemptions, the organisation needs to know which identity is speaking, what it is allowed to see, and how that entitlement is revoked.

Key questions

Q: How should teams use AI assistants in loyalty platforms without removing human control over decisions?

A: Teams should position AI assistants as decision support, not decision replacement. The assistant can suggest actions, surface relevant knowledge, and speed up routine work, but users should retain final approval for promotions, segmentation, and strategy changes. That approach preserves accountability, reduces friction in daily operations, and keeps the assistant aligned with business goals instead of turning it into an autonomous operator.

Q: Why do MCP-connected loyalty tools create governance risk?

A: Because MCP can standardise access without automatically limiting authority. When an external AI tool can query or act on loyalty data, the real risk is over-broad delegation across balances, rewards, and offers. Practitioners need explicit policy on which actions are allowed, what the tool may see, and how the connection is revoked when trust changes.

Q: What do security teams get wrong about agentic loyalty automation?

A: They often treat it like advanced analytics, when it is actually runtime execution. Once the system can resolve offer conflicts, send campaigns, or alter redemption outcomes, it has operational authority. That requires approval thresholds, audit trails, and clear separation between recommendation, execution, and customer-visible change.

Q: What is the difference between personalised loyalty offers and entitlement control?

A: Personalisation decides what a customer might prefer, while entitlement control decides what the system is allowed to expose or change. A loyalty engine can safely recommend an offer without being trusted to redeem it, adjust tier status, or disclose account state through an AI interface. That distinction matters once AI tools sit between users and programme actions.

Technical breakdown

MCP access turns loyalty into a delegated identity problem

Model Context Protocol connects AI agents and tools to external data sources and actions. In a loyalty setting, that means the assistant is no longer just reading public content, it may be querying point balances, tier status, offers, or redemption workflows on behalf of a user. The technical issue is delegation. The platform must distinguish customer identity, assistant identity, and the scope of the session. Without explicit policy boundaries, a conversational layer can become an over-broad access path into entitlements and rewards logic.

Practical implication: treat MCP-enabled loyalty access as a delegated identity flow and bound every tool call to a specific customer session and entitlement scope.

Agentic loyalty workflows need guardrails, not just prediction models

The article points to AI assistants that execute campaigns, simulate promotional budgets, and resolve offer conflicts automatically. That is an agentic pattern, not a simple recommendation engine. Once an AI system can choose actions and timing, governance has to cover authorization, auditability, and rollback. Predictive scoring is a data problem, but automated execution is an entitlement problem because the system can alter offers, trigger communications, or apply rewards at runtime.

Practical implication: classify any AI workflow that can change offers or rewards as an execution control and place it under approval, logging, and scope restriction.

Loyalty platforms now carry identity-like trust assumptions

Loyalty programmes increasingly depend on first-party data, app sessions, and external AI search or chat surfaces to remain discoverable and usable. That makes the control challenge similar to identity governance even when the system is not a classic IAM stack. You need to know which interfaces can expose balances, which actors can redeem value, and whether fraud controls are aligned with the same identity signals used for customer access.

Practical implication: review loyalty redemptions and balance lookups as protected entitlements, not just customer engagement features.

Threat narrative

Attacker objective: The objective is to access or manipulate loyalty entitlements through delegated third-party access rather than through the primary customer interface.

1. Entry occurs when a third-party or AI-connected interface is given access to loyalty data and actions such as balances, tiers, or rewards redemption.
2. Credential or token abuse follows if the delegated connection is over-broad, unmanaged, or reused across tools and sessions.
3. Impact occurs when an unauthorised assistant or integration queries sensitive loyalty information or triggers actions the customer did not intend.

Breaches seen in the wild

• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI loyalty is becoming an identity governance problem in disguise: once assistants can read balances, check status, or redeem rewards, the core issue is not marketing automation but delegated entitlement control. Loyalty teams will increasingly need policy, audit, and revocation logic that resembles access governance, especially where external AI tools sit between the user and the programme. Practitioners should stop treating AI-enabled loyalty as a purely commercial capability and start governing it as a controlled access surface.

MCP creates a new trust boundary for consumer-facing AI: the protocol is useful because it standardises tool access, but standardisation does not equal safety. If loyalty systems expose rewards and account state through MCP without strong scoping, they inherit the same delegation risks seen in other third-party access chains. The named concept here is delegated rewards exposure, where value-bearing customer entitlements become queryable through AI intermediaries. Practitioners should define which loyalty actions are query-only, which require step-up controls, and which must remain outside AI delegation entirely.

Agentic execution changes the risk model from recommendation to action: predictive churn scoring is analytically useful, but automatic offer resolution and campaign execution create runtime authority. That means the governance question shifts from whether the model is accurate to whether the system is authorised to act. This is the same control tension identity teams face when automation crosses into entitlement mutation. Practitioners should classify agentic loyalty functions by what they can change, not by how well they predict.

Third-party discovery is now part of loyalty security posture: the article's point that consumers use AI tools to research loyalty programmes means discoverability and exposure now extend beyond owned channels. If a programme is visible through external AI surfaces, its data-sharing and redemption paths must be designed for controlled disclosure. That does not make every AI search integration risky, but it does make unmanaged publishing of loyalty state a governance issue. Practitioners should align external exposure with least-privilege disclosure rules.

Behavioural data and entitlements need to be governed together: loyalty programmes often separate fraud prevention, offer logic, and consumer experience, yet AI collapses those layers into a single runtime decision chain. If the same platform can infer, personalise, and execute, the organisation needs one view of who or what is authorised to act on customer value. Practitioners should bring loyalty, IAM, and fraud controls into the same design review when AI or MCP is introduced.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Third-Party, B2B and Contractor Access Guide

What this signals

Delegated rewards exposure: loyalty programmes that expose balances, tiers, and redemption actions through AI interfaces need the same control thinking used for third-party access. The issue is not whether AI can improve convenience, but whether the programme can still prove who or what is allowed to act on customer value. When that answer is unclear, the loyalty stack has already drifted into identity risk.

Consumer-facing AI is extending the attack surface for entitlement abuse because value-bearing actions now sit behind conversational and external tool paths. That changes the practitioner brief from marketing optimisation to governed delegation, especially where MCP or similar connectors bridge customer experiences to reward systems.

The most resilient programmes will separate discovery, decisioning, and execution so that an AI surface can explain a benefit without being able to transfer it. That design principle is becoming more important as loyalty, fraud, and identity controls converge in the same workflow.

For practitioners

• Define delegated access boundaries for loyalty assistants Map which AI tools can read balances, view tier status, or trigger redemption, then restrict each action to the minimum entitlement required for the session.
• Separate predictive scoring from runtime execution Keep churn scoring, recommendation, and promotional automation in different control paths so that a model insight cannot directly become a reward change without governance.
• Treat MCP-enabled loyalty flows as privileged integrations Inventory every MCP server, connector, or external assistant that can reach loyalty data and apply approval, logging, and revocation to each one.
• Apply step-up checks to value-bearing actions Require stronger verification before redemptions, account changes, or offer overrides that transfer economic value from the programme to the customer.

Key takeaways

• AI-enabled loyalty is no longer just a marketing issue because assistants can now touch balances, tiers, and redemption paths.
• The governance gap is delegated access, not model quality, when external tools can interact with customer entitlements.
• Practitioners should separate recommendation from execution so loyalty AI cannot change value without explicit control.

Key terms

• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Agentic execution environment: A runtime in which an AI system can choose actions, call tools, and continue a task with limited human intervention. In identity terms, it becomes an access-bearing environment that can amplify whatever credentials and permissions it inherits, so governance must treat it like a privileged workload.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Entitlement: An entitlement is the permission set that defines what a non-human identity can do after it authenticates. It is usually expressed through roles, policies or access assignments, and unmanaged entitlements are a common reason machine identities become over-privileged over time.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management through an identity security lens. It helps security and IAM practitioners translate delegated access problems into practical control decisions.