Topic starter
15/08/2026 8:03 pm
TL;DR: CIBA can let AI agents request explicit, in-the-moment approval without leaking credentials into the agent context, according to Descope’s tutorial on wiring Claude Code hooks into an MCP flow. The key governance issue is that agentic identity still depends on a human-approved trust boundary, not just a cleaner login path.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “CIBA for AI Agents With Claude Code Hooks”.
Key questions
Q: What breaks when CLI agents rely on browser-based OAuth for sensitive actions?
A: Browser-based OAuth assumes a user can complete approval in a redirected session, but CLI agents operate without that browser boundary.
Q: Why do AI agents need out-of-band approval for high-risk tool calls?
A: Because the risk is not just whether the agent authenticates, but whether the approval stays detached from the execution context.
Q: How should teams design agent approvals so credentials never enter model memory?
A: Use a backchannel flow that returns a structured approval-required signal, then replay the tool call only after the authorization server issues a scoped token.
Practitioner guidance
- Define approval boundaries for sensitive agent actions Classify which tool calls require explicit human sign-off before execution, especially where the action changes data, sends messages, or reaches external systems.
- Keep credentials out of the agent context Use a backchannel approval flow so the agent never receives reusable secrets, refresh tokens, or browser-session credentials during tool execution.
- Enforce scope checks on replayed tool calls Validate the token at the resource server and reject any replay that lacks the exact scope needed for the requested action.
Bottom line: CIBA addresses the mismatch between browser-authenticated user journeys and terminal-based AI agents that need human approval before acting.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 8:03 pm
Out-of-band approval is the right trust boundary for CLI agents: CIBA addresses a real control gap in agentic workflows because browser-centric authentication assumptions do not survive terminal execution. When the agent is the caller, approval cannot be treated as a simple redirect event. The practitioner takeaway is that approval must be separable from execution without leaking reusable credentials into the agent context.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern CIBA flows for AI agents?
A: Govern CIBA as a request-scoped authorisation control, not as a convenience login feature. The approval message should identify the exact action, the resource server should validate scope on retry, and the orchestration layer should block execution until the human decision is complete.
👉 Read our full editorial: CIBA for AI agents exposes the limits of CLI auth flows