Agent Identity Shipped Three Times in One Week. The Code Priced a Cost Center, Not a Moat.

Three infrastructure vendors shipped agent-identity products in a single week. Descope pushed Agentic Identity Hub 3.0, ServiceNow moved an AI governance suite, Postman dropped a Fabric Gateway. The narrative machines immediately called it a sector. I called it a tick — three prints on the same tape, same direction, same session. In a sideways market, that is not noise. It is positioning. Three independent sellers do not arrive at the same shelf by accident unless a real order is forming behind them. But a print is not a moat. A print is a claim about where liquidity is about to sit, and claims get marked to market. The product, on the surface, is clean. A gateway sits between an AI agent and the MCP server it wants to reach. Every call must carry four things: an owner, a purpose, an access scope, and an audit trail. Authorization moves out of the MCP server and into the traffic path. That is the entire pitch. No latency number. No throughput figure. No security test result. No price. In my world, a strategy that ships without a backtest is not a strategy. It is a story with a signature line. Here is the structure, stripped of varnish. MCP — the Model Context Protocol — was published by Anthropic in November 2024. It standardizes how a model calls external tools and data. Think of it as a wire format for delegation. A model wants to read a file, hit an API, or move value; MCP defines the handshake. The protocol shipped with an authorization layer built on OAuth 2.1. It also shipped with known holes. The confused deputy problem — where a privileged service is tricked into acting for a less privileged caller — is documented. Token passthrough, where credentials are forwarded without re-validation, is documented. These are not exotic bugs. They are the standard failure modes of any delegation system, and anyone who has run a keeper bot, a relayer, or a multi-sig has already met all of them. Now scale. Gartner projects that by 2028, large enterprises will manage roughly 150,000 agents each. Only 13% of organizations claim they can govern them. That gap — 150,000 principals against a 13% governance rate — is the actual market. Non-human identities are multiplying faster than any IT department can inventory them. Every agent is a credential. Every credential is a delegation. Every delegation is a potential confused deputy. Descope's move is to pull the authorization decision forward, out of the MCP server, into a gateway every agent call must cross. The mechanism is a Policy Enforcement Point embedded in the traffic path. If you have run Envoy, Kong, or Apigee, you have already deployed a PEP. The novelty is not the pattern. The novelty is that the pattern now speaks agent. The market is not buying a new architecture. It is buying a familiar architecture with a new vocabulary, and it is paying for the vocabulary. I have spent the week reading the Descope documentation the way I read token whitepapers in 2017 — hunting for the sentence that is missing. Here is what the gateway does, mechanically. An agent requests access. The gateway intercepts before the MCP server sees it. It checks the identity assertion, evaluates a policy, admits or denies. On admission, it writes an audit entry. Four fields are enforced: owner, purpose, access, audit. Clean. It is also role-based access control, attribute-based access control, purpose binding, and audit logging — four things that existed separately — fused into one enforcement point for the agent era. The engineering is real. The novelty is a combination, not a breakthrough. The purpose field is the only genuinely interesting dimension. Agents are stateful in a way humans are not. A human authenticates once and acts within a session. An agent can chain a hundred tool calls a second, each expanding its reach. Binding a call to a declared purpose — this agent is fetching a feed, not initiating a transfer — is a real constraint. It is the difference between an access token and a mandate. But a purpose is only as strong as the entity that validates it. Who decides a purpose is legitimate? The gateway can confirm a purpose field is present. It cannot confirm the purpose is honest. An agent that declares read-only and then attempts a write is a violation the gateway catches. An agent that declares read-only and exfiltrates data through an allowed channel is a violation the gateway does not catch. That is the boundary the marketing does not cross. Descope did not invent its identity standard. It adopted ID-JAG — the Identity Assertion Authorization Grant — a draft in the IETF OAuth working group. ID-JAG lets an identity provider assert a user to a different domain's authorization server in exchange for a token. A cross-domain trust bridge. Adopting a draft rather than shipping a proprietary standard is the correct engineering call: fewer bespoke parsers, more interoperability. It is also a statement about position. A follower, not a standard-setter. The company that controls the standard controls the migration cost. Descope is exposed to that cost, not insulated from it. If ID-JAG changes before it becomes an RFC, every implementation pays to move. That is a liability dressed as a feature. Now the number missing from every write-up: latency. A PEP in the traffic path is not free. Every agent call takes an extra hop — token validation, policy evaluation, audit write. In high-frequency systems, the hop is the whole game. I spent 2021 measuring gas the way other people measure milliseconds, and I learned that the cost you cannot see is the cost that kills you. A gateway adding five milliseconds to every call is invisible at ten requests a minute and fatal at ten thousand requests a second. Descope published no P99 latency, no throughput ceiling, no degradation curve under load. For a product whose entire value sits in the critical path of every agent call, the absence of a performance number is not a documentation gap. It is the most important undisclosed fact in the announcement. There is a second structural cost. A gateway is a single point of failure by construction. Centralize authorization and you centralize the blast radius. When it is up, every call flows through one policy engine — clean, auditable, uniform. When it is down, every agent stops. When it is compromised, every agent's credentials pass through the attacker's choke point. The write-ups call this a moat and skip the part where the moat is also the drawbridge. DeFi taught this lesson with bridges. A bridge concentrates value at one point, and that point becomes the target. The largest hacks in the space have not been logic errors. They have been concentrated trust. A centralized authorization gateway for agents is structurally the same object. Here is where my own history matters. In 2017, I manually audited the smart contracts of three mid-cap ERC-20 projects in Remix. I found integer overflow vulnerabilities in two of them before launch. The lesson was not that overflow is dangerous. The lesson was that the vulnerability lived in the code, and the code could be read. Authorization bugs are different. The 2020 flash loan attack on the protocol where I held a leveraged position was not an access-control failure. Every caller was authorized. The attack was economic — a sequence of legitimate calls producing an illegitimate outcome. The gateway would have admitted every one of those transactions. That is the precise gap. MCP's core risks — tool poisoning, prompt injection, confused deputy — live in the semantic layer, not the authorization layer. Tool poisoning is a malicious MCP server advertising a tool that behaves differently than it claims. Prompt injection is untrusted input rewriting the agent's instructions mid-task. These are logic attacks. A gateway enforcing owner, purpose, access, and audit will admit a poisoned tool call without hesitation, because the call carries a valid identity, a declared purpose, a permitted scope, and a clean audit trail. All four elements satisfied. The attack succeeds anyway. Code does not lie, but it does obfuscate. The gateway will tell you exactly what it admitted. It will not tell you what it should have blocked. Authorization is not security. It is the accounting of security. The ledger remembers what the ego forgets — but the ledger only records what crosses the gate, and it has no opinion on whether what crossed was honest. The audit dimension deserves its own paragraph, because it is the one field that touches regulation directly. An immutable record of who did what, when, and why is exactly what the EU AI Act's transparency and record-keeping obligations demand, and it maps onto the supply-chain security posture behind the US executive order on AI. That is genuine utility. But utility is not moat. A compliance record is a feature every platform will eventually ship, because compliance is table stakes, not differentiation. The company that sells you the record is not the company that owns the standard for the record. Those are different businesses, and only one of them compounds. The non-human-identity market is where the real money is moving. Vendors like Astrix, Oasis, Token Security, and Entro have raised on the thesis that machine credentials are the fastest-growing attack surface in the enterprise, outpacing human accounts by an order of magnitude. Agent governance is the natural extension of that thesis: not just discovering machine identities, but constraining what they can do. Descope is betting that the constraint layer — the gateway — captures more value than the discovery layer. That is a contestable bet. Discovery is the wedge; constraint is the expansion. The wedge usually wins the account, and the expansion usually gets bundled. Translate this to the chain, because that is where the stakes multiply. An AI agent with a wallet is a non-human identity with spending power. It can swap, lend, provide liquidity, and vote in governance, all autonomously, all inside whatever scope its credentials permit. The gateway is pitched for enterprise agents, but the same architecture is arriving on-chain. Keeper networks, MEV bots, DAO treasury automation — every one is already a delegated agent, every one already runs on ad hoc authorization. The gap Descope is monetizing in the enterprise already exists in DeFi, and DeFi has been patching it with multi-sig and timelocks for years. Which brings the uncomfortable part. The code-is-law framing that governs DAO treasuries has the same flaw as the gateway pitch. A smart contract's upgrade rights always sit with a few multi-sig admins. Authorization is decentralized in the contract and centralized in the humans. An agent gateway has the same shape: decentralized authorization in the policy engine, centralized control in whoever runs the gateway. You have moved the trust, not removed it. The ledger is honest about what it records. It is silent about who holds the keys to the recorder. The competitive field is worth mapping, because the moat claim only survives if you do not look sideways. ServiceNow ships an enterprise AI governance suite, bundled into a larger platform. Postman ships a gateway with a developer-tools lineage. Okta and Auth0 extend a general identity provider into agent territory. The non-human-identity security vendors approach from discovery and posture management. Descope's differentiation is depth of MCP integration and developer experience. Against ServiceNow it lacks enterprise distribution. Against Okta it lacks installed base. Against the NHI vendors it lacks the discovery layer. It is strong in one axis and thin in the rest, which is the profile of an acquisition target, not a platform. One more mechanical risk. The agent protocol landscape is not converged. MCP, A2A, ID-JAG, and the function-calling conventions of the major model vendors coexist without a winner. A gateway bound tightly to MCP is making a bet. If MCP wins the enterprise, the bet pays. If a competing protocol captures the traffic, the gateway is a toll booth on an empty road. In the 2017 cycle, the projects that died were not the ones with bad code. They were the ones that bet on the wrong standard and shipped before it settled. The code did not lie. It optimized for a world that never arrived. There is a liquidity lens here too, and it is the one I actually trade. In 2024 I built a dashboard tracking Grayscale's GBTC and BlackRock's IBIT wallet movement and correlated inflows with price. The signal was never the headline. The signal was the wallet. Agent governance is the same setup one layer down. The signal is not the press release. The signal is the disclosed price, the published latency, the named customer, the graduated standard. Right now every one of those prints is absent. A market sized on an uncited 13% is a market sized on a rumor, and rumors do not clear. The counter-intuitive angle is not that the gateway is useless. It is that the gateway is a cost center being sold as a moat, and the tape is pricing the story, not the mechanism. Enterprises do not buy governance because it generates revenue. They buy it because a regulator, an auditor, or a board demands it. That makes agent governance a compliance line item — necessary, recurring, chronically underpriced. A company that sells compliance does not own a moat. It owns a subscription. The real moats in infrastructure are network effects, switching costs, and standard control. Descope holds none of the three. Its integration partner — the agentgateway project donated by Solo.io to the Linux Foundation — is an open-source distribution channel, not a lock-in. Its identity standard is a draft it follows, not one it wrote. Its developer experience is strong, inherited from a customer-identity background, but developer love is not a switching cost when the alternative is a free bundle from Okta or Microsoft. The most likely endgame for a sub-scale leader in a hot niche is acquisition, not independence. That is not failure. It is a liquidation event with a nicer name. Watch the free tier. A governance product with no published price and no published free-tier limit is a product whose unit economics are still being discovered. In 2020 I watched yield farms advertise a 40% APY and quietly omit the denominator. The denominator is always the story. Here the denominator is the price, and it is missing. The deeper risk is that agent governance may not be an independent market at all. If Okta, Microsoft, or the model vendors fold identity and governance into the base platform, the standalone gateway becomes a feature, not a product. Cloud security followed exactly this arc. The specialists got absorbed. Silence in the order book is louder than noise — and right now the loudest thing about the agent governance market is that nobody has published a price. The trade is not which vendor has the moat. The trade is a question with a timestamp: does agent governance become a standalone market, or a line item inside someone else's platform? Track four prints. Descope's first disclosed enterprise price — the missing number. Whether ID-JAG graduates from draft to RFC — the standard risk. Whether Okta or Microsoft ships a competing agent identity product within two quarters — the platform squeeze. And the original source of that 13% — because a market sized on an uncited statistic is a market sized on a rumor. Alpha hides in the friction of chaos, not in the press release.