Topic starter
06/07/2026 9:40 am
TL;DR: Agentic identity and machine-to-machine flows now have formal pricing definitions for Monthly Active Consents, Monthly Active Tokens, and M2M Exchanges, clarifying how consent, token retrieval, and token exchange are counted across MCP, downstream apps, and AI agent connections, according to Descope. The real takeaway is that agentic identity is becoming a governed access layer, not just an integration detail.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Descope M2M & Agentic Identity Pricing Update”.
Key questions
Q: How should IAM teams classify consent, token use, and token exchange in agentic identity flows?
A: Treat them as three different governance events.
Q: Why do AI agents and M2M connections change identity governance models?
A: They shift governance from static account management to event-based delegation.
Q: What breaks when consent and token exchange are counted as the same thing?
A: You lose the ability to see which step created authority.
Practitioner guidance
- Map consent events by resource and scope Model Monthly Active Consent separately for each MCP server, inbound app, and protected API so scope grants are counted and reviewed at the right boundary.
- Classify token retrieval as an execution event Track Monthly Active Tokens only when a credential is fetched and used, then separate those events from passive token storage in your governance reporting.
- Inventory every token exchange path Document client credentials, OAuth token exchange, access key to JWT flows, and policy-enforced agent exchanges as distinct M2M events.
Bottom line: Agentic identity pricing now exposes the difference between user consent, token use, and token exchange as separate governance events.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:55 am
Agentic identity pricing is really a control model in disguise: once consent, token use, and token exchange are metered separately, the identity programme has to recognise three distinct governance events. That is more than billing logic. It reveals which parts of delegated access are user-authorised, which are action-bearing, and which are trust-translating. Practitioners should read that separation as an access-governance taxonomy, not a finance detail.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: When should organisations treat M2M pricing changes as an IAM design signal?
A: When the pricing model reveals separate events for consent, action, and exchange, it is signalling that the access layer is now a governed control surface. Teams should use that signal to revisit scope design, delegation paths, and where policy enforcement happens in the journey.
👉 Read our full editorial: Descope's pricing shift for agentic identity changes M2M governance