Descope: governance profile
Agentic Identity Hub 3.0 released 15 October 2026. Rank 5, total 6.85.
In short: Descope ranks fifth at 6.85 out of 10. Its Agentic Governance Suite records a documented purpose and an accountable owner for every approved agent, and policy engine v2 adds Deny policies. Automatic discovery and per-call approval were not found. A Free Forever tier exists, but the governance suite is Enterprise only.
1No. 5
How does Descope score in each area?
| Area | Weight | Score | Reason | Source |
|---|---|---|---|---|
| A1 Inventory and discovery | 15 | 5 | Agents are onboarded by request and approval, and automatic discovery was not found. | Source: Descope Agentic Identity Hub 3.0, read |
| A2 Ownership and accountability | 20 | 9 | Each approved agent carries a documented purpose and an accountable owner. | Source: Descope Agentic Identity Hub 3.0, read |
| A3 Policy authoring and enforcement | 20 | 8 | Policy engine v2 adds Deny policies and policy ordering. | Source: Descope Agentic Identity Hub 3.0, read |
| A4 Human approval and escalation | 15 | 6 | Approval happens at onboarding, and per-call approval was not found. | Source: Descope Agentic Identity Hub 3.0, read |
| A5 Audit evidence | 15 | 5 | It monitors MCP clients, but audit export is not detailed. | Source: Descope Agentic Identity Hub 3.0, read |
| A6 Lifecycle and revocation | 10 | 7 | It issues short-lived tokens and keeps agents reviewable. | Source: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read |
| A7 Buying clarity | 5 | 7 | A Free Forever tier exists, but the governance suite is Enterprise only. | Source: Descope Agentic Identity Hub 3.0, read |
Which of the 24 controls does Descope document?
Not found means we did not find the control described in the sources listed. It does not mean the product lacks it.
- GOV-01Agent inventory: partly documentedSource: Descope Agentic Identity Hub 3.0, read
- GOV-02Named accountable owner: documentedSource: Descope Agentic Identity Hub 3.0, read
- GOV-03Documented purpose: documentedSource: Descope Agentic Identity Hub 3.0, read
- GOV-04Least privilege at creation: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-05Short-lived credentials: documentedSource: Descope Agentic Identity Hub, read
- GOV-06Per-action policy: documentedSource: Descope Agentic Identity Hub, read
- GOV-07Human approval for high-risk actions: partly documentedSource: Descope Agentic Identity Hub 3.0, read
- GOV-08No self-approval: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-09Policy testing before go-live: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-10Tool allow-listing and hiding: partly documentedSource: Descope Agentic Identity Hub, read
- GOV-11Revocation and kill switch: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-12Decommission at task end: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-13Per-action audit log tied to a person: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-14SIEM export: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-15Periodic access review: partly documentedSource: Descope Agentic Identity Hub 3.0, read
- GOV-16Shadow agent detection: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-17MCP server registry: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-18Delegation bounded by the person's permissions: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-19Agent incident response: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-20Change management for agent permissions: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-21Third-party agent onboarding: partly documentedSource: Descope Agentic Identity Hub 3.0, read
- GOV-22Data access boundaries: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-23Evidence retention: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- GOV-24Board reporting: not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
What does Descope cost?
A Free Forever tier includes the Agentic Identity Hub. The Agentic Governance Suite is Enterprise only, with no published Enterprise price.
Does Descope work alongside your identity provider?
Not stated in the material we read.
A governance layer runs alongside your identity provider, never instead of it.
How does Descope rank for specific buyer needs?
- Shares fifth at 6.75Best for regulated industries
- Shares third at 6.95Best for human oversight
- Shares seventh at 6.55Best for shadow agent inventory
- Shares seventh at 6.35Best for audit evidence
- Fourth at 7.00Best for a small team's fast start
- Shares sixth at 6.95Best for lifecycle and revocation
Head-to-head comparisons
Frequently asked questions
- 6.1 What is Descope best at?
- Its highest area score is ownership, at 9 out of 10. Each approved agent carries a documented purpose and an accountable owner.
- 6.2 Where are the gaps in Descope?
- Its lowest area is inventory, at 5 out of 10. Agents are onboarded by request and approval, and automatic discovery was not found. Controls not found in its public material: 15 of 24.
- 6.3 How is Descope priced?
- A Free Forever tier includes the Agentic Identity Hub. The Agentic Governance Suite is Enterprise only, with no published Enterprise price.
Reviewed by The Register desk