Gap note
Descope Envoy gaps
Descope Envoy gap note, checked 2026-11-04. It quotes primary pages on settlement, spend controls, revocation, composition, license, governance, cross-company use, and refunds. A not documented line uses the read date. The note does not rank the listing. Omitted means that dimension was not checked for this note.
Last verified 2026-11-04
Sources
Descope Envoy listing · Gaps JSON · See what changed this week
| Dimension | Status |
|---|---|
| Settlement asset | Not documented |
| Spend controls | Mixed |
| Revocation | Documented |
| Protocol composition | Mixed |
| License | Not documented |
| Governance body | Mixed |
| Cross-company use | Mixed |
| Refunds and disputes | Not documented |
Settlement asset
Not documented
Not documented as of 2026-11-04. A settlement asset. The 4 November 2026 release describes delegated sign-in for personal agents. It does not name a settlement asset.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
Spend controls
Documented
The 4 November 2026 release says businesses define what an agent may and may not do on a customer's account with OAuth Rich Authorization Requests, and that the business sets the duration of any elevated access.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
The 4 November 2026 release says out-of-band approval for sensitive actions uses Client-Initiated Backchannel Authentication (CIBA).
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
Not documented
Not documented as of 2026-11-04. A payment amount cap. The 4 November 2026 release describes Rich Authorization Requests and CIBA approval. It does not state a payment amount cap.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
Revocation
Documented
The 4 November 2026 release says the customer and the acting agent stay distinct in every token and log entry, and that a company can revoke an agent's access without signing the customer out.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
The Agent Login docs say Descope revokes refresh tokens and the access tokens issued under them. That page does not use the name Envoy.
Descope docs: Personal Agent Protocol (Poppy) · Read 2026-11-04
Protocol composition
Documented
The 4 November 2026 release says Envoy implements Personal Agent Protocol discovery, agent identification through Client ID Metadata Documents with no pre-registration, DPoP-bound session tokens, and all three Poppy sign-in types.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
The 4 November 2026 release says permissions use Rich Authorization Requests, out-of-band approval uses CIBA, and Descope published a zero-dependency TypeScript Poppy SDK.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
The Agent Login docs say Descope delivers the company side of Poppy, identifies agents with Client ID Metadata Documents instead of registration, and runs authorization code and device sign-in. That page does not use the name Envoy.
Descope docs: Personal Agent Protocol (Poppy) · Read 2026-11-04
Not documented
Not documented as of 2026-11-04. The names of the three sign-in types in the 4 November 2026 release. The release says Envoy supports all three Poppy sign-in types and does not name them.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
License
Not documented
Not documented as of 2026-11-04. A software license or a repository URL for Envoy or the TypeScript Poppy SDK. The 4 November 2026 release says the SDK is zero-dependency TypeScript and does not name a license or a repository.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
Governance body
Documented
Descope announced Envoy on 4 November 2026. The release calls it a set of capabilities for personal AI agents to sign in as delegated users.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
The Agent Login docs say setup starts on the Agent Login page in the console. That page does not use the name Envoy.
Descope docs: Personal Agent Protocol (Poppy) · Read 2026-11-04
Not documented
Not documented as of 2026-11-04. A general availability label, a beta label, or a standards body for Envoy. The 4 November 2026 release announces Envoy and does not apply those labels.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
Cross-company use
Documented
The 4 November 2026 release says Envoy runs alongside the customer identity stack a company already has.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
The Agent Login docs say a company can keep its existing login and send customers to that login through External Authentication. That page does not use the name Envoy.
Descope docs: Personal Agent Protocol (Poppy) · Read 2026-11-04
Not documented
Not documented as of 2026-11-04. A credential a company can check without Descope. The 4 November 2026 release says Envoy runs alongside the identity stack a company already has.
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People's Behalf · Read 2026-11-04
Refunds and disputes
Who handles a refund when an agent pays
Not documented
Not documented as of 2026-11-04. A refund or dispute process. The Agent Login docs mention a refund only as an example of a high-impact action a company may put behind a separate approval.
Descope docs: Personal Agent Protocol (Poppy) · Read 2026-11-04
Questions
- What does not documented mean?
- Not documented means the cited page does not state the fact. The line names that page and the day it was read. It is not a claim that the fact is false.
- What does omitted mean?
- Omitted means this note has no checked source for that dimension. The dimension was left out rather than filled in.
- Does the index rank these products?
- No. The table can be sorted by name, by dimension status, or by checked date. Sort order is not a score.
- Where is the machine readable file?
- GET /data/gaps.json. The file includes every note, the cited sources, and the read dates.