Notifications
Clear all
Topic starter
15/08/2026 6:45 pm
TL;DR: Gartner’s 2026 fraud and financial crime Hype Cycle places CIAM for AI Agents in the On the Rise phase and Journey-Time Orchestration in Early mainstream, with both categories carrying High benefit ratings, according to Descope. The signal is that agent delegation, consent, and journey-level risk controls are becoming core identity problems, not side features.
NHIMG editorial — based on content published by Descope: Descope named in the 2026 Gartner Hype Cycle for Fraud and Financial Crime Prevention
By the numbers:
- More than 1,000 organizations run Descope today.
- Descope says its platform is backed by SOC 2 Type II, ISO 27001, and FedRAMP High authorization.
Questions worth separating out
Q: How should security teams handle delegated access when AI agents act on behalf of customers?
A: Security teams should treat delegated access as a separate governance layer, not as a normal login session.
Q: Why do journey-level controls matter more than a single login check in fraud prevention?
A: Because modern fraud often emerges after the initial authentication event.
Q: What breaks when an AI agent is not part of identity inventory?
A: When an AI agent is not part of identity inventory, governance breaks at the point of discovery.
Practitioner guidance
- Define delegated-agent identity classes Create a separate policy model for AI agents acting on behalf of customers so their scopes, consent, and revocation rules do not inherit human-user defaults.
- Map journey-level risk checkpoints Identify where identity verification, authentication, ATO prevention, and step-up checks occur today, then document where those controls fail to share state across the digital journey.
- Separate tool access from account access When agents reach back-end tools or APIs, make sure tool scopes are explicitly tied to the agent identity and not only to the underlying customer account.
What's in the full article
Descope’s full article covers the operational detail this post intentionally leaves for the source:
- Gartner category breakdowns for CIAM for AI Agents and Journey-Time Orchestration in the 2026 Hype Cycle.
- The article’s own examples of how Descope structures agent registration, consent, and per-agent scope control.
- The journey orchestration details behind risk-aware user flows, including the role of third-party risk signals.
- The specific product mapping between the Gartner categories and the Agentic Identity Hub architecture.
👉 Read Descope’s analysis of CIAM for AI agents and journey-time orchestration →
CIAM for AI agents and journey orchestration: what changes now?
Explore further
15/08/2026 6:45 pm
CIAM for AI agents is the market’s answer to delegated action, but it also exposes how fragile human-centric identity assumptions have become. The article is right to frame agentic identity as a fraud problem because the real issue is not authentication alone, but the binding of a customer to an autonomous or semi-autonomous actor that can keep acting after the initial login. That changes the control surface from session start to session behaviour. Practitioners should treat this as a new identity class with its own lifecycle, consent, and revocation model.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: Who is accountable when an AI agent uses delegated access incorrectly?
A: Accountability should follow the delegated authority chain, not stop at the agent label. The relevant owners are the teams responsible for the human identity, the service identity, the workflow, and the policy that allowed the action path. If those responsibilities are not explicit, incident review will be incomplete and remediation will focus on the wrong layer.
👉 Read our full editorial: Agentic identity and journey orchestration are moving into fraud controls
