Topic starter
15/08/2026 6:45 pm
TL;DR: Gartner’s 2026 fraud and financial crime Hype Cycle places CIAM for AI Agents in the On the Rise phase and Journey-Time Orchestration in Early mainstream, with both categories carrying High benefit ratings, according to Descope. The signal is that agent delegation, consent, and journey-level risk controls are becoming core identity problems, not side features.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Descope Named in the 2026 Gartner® Hype Cycle™ for Fraud and Financial Crime Prevention”.
Key questions
Q: What breaks when AI agents are given access without identity governance?
A: What breaks is accountability.
Q: Why do fraud and identity teams need journey-time orchestration for agentic sessions?
A: Because fraud risk changes across the session, not just at login.
Q: What are the most common mistakes in customer-facing AI agent authorization?
A: Teams often give an agent the customer’s credentials, rely on coarse session approval, or fail to separate data access from transactional authority.
Practitioner guidance
- Define delegated agent identities Treat AI agents as governed customer-side identities with their own scopes, lifecycle, and revocation path rather than as anonymous automation running behind a user session.
- Bind agent actions to the authorising customer Require every agent transaction to resolve back to the customer who granted consent so auditors can distinguish legitimate delegation from account takeover.
- Orchestrate risk across the whole journey Connect registration, authentication, step-up, and account takeover signals into one journey layer so risk decisions can change as the session evolves.
Bottom line: AI agents used in customer journeys turn delegation into a first-order identity control problem, because the system must know who authorised the action and what the agent may do.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:45 pm
Delegated customer activity is now an identity problem, not a fraud add-on. The article shows why AI agents acting on behalf of customers push fraud controls into identity architecture itself. Once a software actor can initiate payments or account actions, the decisive control is whether the delegation chain is provable and revocable. Practitioners should treat that as a CIAM design issue, not a downstream fraud rule.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: Should organisations treat AI agent consent as a one-time login decision?
A: No. Consent for an agent should be task-bound, revocable, and tied to specific actions and data sets. A one-time approval becomes unsafe as soon as the agent starts chaining actions, because the risk profile can change after the initial authorisation has already been granted.
👉 Read our full editorial: Agentic identity and journey orchestration are moving into fraud controls