Notifications
Clear all
Topic starter
15/08/2026 8:03 pm
TL;DR: CIBA can let AI agents request explicit, in-the-moment approval without leaking credentials into the agent context, according to Descope’s tutorial on wiring Claude Code hooks into an MCP flow. The key governance issue is that agentic identity still depends on a human-approved trust boundary, not just a cleaner login path.
NHIMG editorial — based on content published by Descope: CIBA for AI Agents With Claude Code Hooks
Questions worth separating out
Q: How should security teams govern AI systems that can act without human approval?
A: Security teams should govern autonomous AI the same way they govern other high-risk identities, but with runtime enforcement instead of periodic review.
Q: Why do browser-based login flows fail for CLI AI agents?
A: Browser redirects assume the user and the application share the same interactive session, which is not true for CLI agents or background tool execution.
Q: What do teams get wrong when they treat agent hooks as the control layer?
A: They often assume the hook itself is the security boundary.
Practitioner guidance
- Define an approval boundary for sensitive agent actions Classify which tool calls require out-of-band human approval, then separate those from low-risk agent actions so the agent does not request consent for every routine operation.
- Enforce scope validation at the resource server Validate token audience and scope server-side before any protected tool executes, and reject fabricated or replayed tokens even if the agent retries the call.
- Use binding messages that name the exact action Include a human-readable statement of what the agent is requesting, such as the tool name and scope, so the approver can make a decision with clear context.
What's in the full article
Descope's full tutorial covers the operational detail this post intentionally leaves for the source:
- Step-by-step Descope console configuration for MCP server resources, scopes, and discovery metadata
- Full Claude Code hook script that intercepts the CIBA-required response and replays the protected tool call
- Working Python examples for token validation, scope enforcement, and OAuth protected metadata routing
- Exact environment variables and local deployment steps for running the MCP server and hook together
👉 Read Descope's tutorial on CIBA for AI agents with Claude Code hooks →
CIBA for AI agents: what changes when approval happens out of band?
Explore further
15/08/2026 8:03 pm
CIBA is a useful control pattern, but it does not remove the core identity problem for agents. It only proves that an agent can request approval without carrying a browser session or secret in context. The underlying governance challenge remains scope, ownership, and replay control for a tool-using identity that can invoke actions repeatedly across a session. Practitioners should treat CIBA as a consent mechanism, not as a complete agent identity model.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How do you know whether CIBA is actually reducing agent risk?
A: Look for evidence that sensitive tool calls cannot execute without an explicit approval record, that the agent never sees reusable credentials, and that scope checks happen on every retry. If approval is optional, vague, or bypassable through alternate client paths, the control is not doing its job.
👉 Read our full editorial: CIBA for AI agents exposes the limits of CLI auth flows
