TL;DR: Agentic identity and machine-to-machine flows now have formal pricing definitions for Monthly Active Consents, Monthly Active Tokens, and M2M Exchanges, clarifying how consent, token retrieval, and token exchange are counted across MCP, downstream apps, and AI agent connections, according to Descope. The real takeaway is that agentic identity is becoming a governed access layer, not just an integration detail.
At a glance
What this is: Descope has defined pricing units for agentic identity and M2M flows, centring consent, token use, and token exchange as metered governance events.
Why it matters: IAM teams need to treat agentic identity as an access-governance problem because the billing model now reflects how consent, delegation, and token exchange are operationalised.
Context
The core governance issue is that agentic identity and machine-to-machine access are no longer treated as a single undifferentiated transaction. Once consent, token retrieval, and token exchange are counted differently, teams need to understand which identity event they are actually governing before they can reason about scope, accountability, or cost.
For IAM and NHI programmes, this matters because MCP servers, outbound connections, and AI agent workflows now sit inside the same delegated-access fabric but do not behave identically. Pricing models that distinguish those events tend to expose the real control boundary: consent at the point of authorisation, token use at the point of action, and token exchange at the point of delegation.
Key questions
Q: How should IAM teams classify consent, token use, and token exchange in agentic identity flows?
A: Treat them as three different governance events. Consent is the user authorising scope, token use is the moment a credential performs work, and token exchange is the boundary where one audience or scope becomes another. Collapsing those events hides where delegated access begins, executes, and transforms, which makes policy design and audit reporting less reliable.
Q: Why do AI agents and M2M connections change identity governance models?
A: They shift governance from static account management to event-based delegation. An AI agent may retrieve a token, act on behalf of a user, and then exchange credentials for a downstream audience within one workflow. That means teams have to govern not just identity ownership, but the runtime transitions that create authority.
Q: What breaks when consent and token exchange are counted as the same thing?
A: You lose the ability to see which step created authority. Consent shows approval, but exchange creates a new trust context with different scopes and audience. If those are merged, reporting becomes misleading and policy enforcement can no longer distinguish user approval from machine delegation.
Q: When should organisations treat M2M pricing changes as an IAM design signal?
A: When the pricing model reveals separate events for consent, action, and exchange, it is signalling that the access layer is now a governed control surface. Teams should use that signal to revisit scope design, delegation paths, and where policy enforcement happens in the journey.
How it works in practice
Monthly Active Consent as a control boundary
Monthly Active Consent is counted when a unique user authorises scopes for a specific resource during a month. In practice, that turns user consent into a metered identity event rather than a one-time setup step. The important technical detail is that the resource can be an MCP server or a protected API, so the consent boundary sits at the federated authorisation layer, not inside the downstream application. That matters because scope design, resource naming, and consent reuse all determine what is counted and what is actually delegated.
Practical implication: Treat consent objects as governed access boundaries and review scope granularity before exposing MCP or inbound app flows.
Monthly Active Tokens and downstream token retrieval
Monthly Active Tokens count when a token is fetched and used to perform an action against a downstream service. That is different from static storage or background possession because the metered event is the active retrieval-and-use moment. For agentic systems, this maps to the point where an AI agent or application becomes an acting delegate rather than a passive holder of credentials. The article also makes a clear distinction between downstream third-party connections and backend API access, which is critical for usage classification and governance modelling.
Practical implication: Separate token storage from token use in your identity model so you can govern when delegation becomes an executed action.
M2M exchanges as delegated identity transitions
An M2M exchange is any token exchange that produces a new audience or scope, such as client credentials flow, OAuth token exchange, or access key to JWT conversion. In agentic identity terms, this is the transition point where one machine-held credential becomes another credential with a different trust boundary. The article also states that policy enforcement for MCP servers and AI agents can itself trigger an M2M exchange, which means governance is not just about service-to-service auth but also about policy-conditioned delegation. That makes exchange visibility central to identity control.
Practical implication: Map every token exchange path, including policy-enforced agent flows, so delegation events are visible and auditable.
NHI Mgmt Group analysis
Agentic identity pricing is really a control model in disguise: once consent, token use, and token exchange are metered separately, the identity programme has to recognise three distinct governance events. That is more than billing logic. It reveals which parts of delegated access are user-authorised, which are action-bearing, and which are trust-translating. Practitioners should read that separation as an access-governance taxonomy, not a finance detail.
Monthly Active Consent, Monthly Active Token, and M2M Exchange are different failure surfaces: user approval, runtime action, and identity translation do not fail in the same way. Conflating them hides where scope creep enters the system and where delegated access becomes operational reality. The implication is that identity teams need event-level classification before they can argue about least privilege or accountability across agentic workflows.
Scope semantics now shape governance semantics: the article’s examples show that the same user journey can create multiple identity events depending on resource, scope, audience, and downstream path. That means the access layer is no longer just about who can connect, but about what kind of delegated authority each connection creates. Practitioners should expect agentic identity to force tighter event taxonomy across IAM, NHI, and application teams.
Policy-enforced delegation is becoming a billable identity primitive: when policies on MCP servers or AI agents are counted as M2M exchanges, the market is acknowledging that authorisation is happening at runtime, not only at login. That changes how teams should think about governance boundaries for AI agents and service integrations. The operational conclusion is that policy evaluation itself has become part of the identity surface.
Token exchange visibility is the named concept that matters here: delegated access cannot be governed well if teams cannot distinguish token possession from token transformation. This article shows that exchange events are now first-class identity objects because they change audience, scope, and accountability in one step. Practitioners should treat exchange visibility as a core requirement for agentic and machine identity governance.
From our research library:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Read next: Agentic AI Identity Guide
What this signals
Token exchange visibility is now part of identity governance: when consent, token retrieval, and M2M exchange are measured separately, teams can no longer treat agentic access as one generic auth event. The operating model has to distinguish approval, action, and delegation if it wants accurate controls and reporting.
The pricing shift also hints at where governance will move next: into runtime delegation paths for agents, downstream services, and policy enforcement points. That aligns closely with state of secrets sprawl 2026 data showing AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
For practitioners
- Map consent events by resource and scope Model Monthly Active Consent separately for each MCP server, inbound app, and protected API so scope grants are counted and reviewed at the right boundary.
- Classify token retrieval as an execution event Track Monthly Active Tokens only when a credential is fetched and used, then separate those events from passive token storage in your governance reporting.
- Inventory every token exchange path Document client credentials, OAuth token exchange, access key to JWT flows, and policy-enforced agent exchanges as distinct M2M events.
- Differentiate downstream service access from backend access Mark which agent or application calls count as downstream third-party connections and which are internal backend API calls, because the governance and metering implications differ.
Key takeaways
- Agentic identity pricing now exposes the difference between user consent, token use, and token exchange as separate governance events.
- The article shows that MCP servers, outbound app flows, and AI agent connections do not all sit at the same control boundary.
- IAM teams should model delegation paths explicitly or risk miscounting where authority is created and where it changes hands.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Scoped consent and token exchange determine how much authority a machine flow can exercise. |
| NHI-09 — NHI Reuse | The same token or consent path being reused across resources changes the governance meaning of each event. | |
| Recommendation — Review delegated scopes against NHI-05 and reduce authority at each consent and exchange boundary. Track repeated consent and exchange paths under NHI-09 and separate them by resource and audience. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about how authorisation events are granted and transformed. |
| Recommendation — Map agentic access events to PR.AA-05 and verify authorisations are explicit at each delegation step. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Token retrieval and exchange are the operational primitives that can enable credential use and movement paths. |
| Recommendation — Correlate token retrieval and exchange events to TA0006 and TA0008 in detection and response workflows. | ||
| NIST Zero Trust (SP 800-207) | Policy Enforcement Point — Policy Enforcement Point | Policy enforcement on MCP servers and AI agents is part of the article’s governance model. |
| Recommendation — Place policy checks at the enforcement point so delegated access is evaluated before tokens are issued or exchanged. | ||
Key terms
- Monthly Active Consent: A Monthly Active Consent is a count of how many unique users approve access to a specific resource and scope during a month. In agentic identity, it marks the approval event that allows an MCP client or protected API to act on behalf of a user.
- Monthly Active Token: A Monthly Active Token is a token that is retrieved and used to perform an action during a month. It represents active credential use, not passive storage, so it is a better indicator of operational access than a vault inventory alone.
- M2M Application: An M2M application is a machine-to-machine identity that uses OAuth client credentials to obtain short-lived tokens for backend service authentication. It is the strongest fit for unattended infrastructure agents because the token expires automatically, but it still needs secure secret handling and clear ownership.
- Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 6, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org