Descope Launches Envoy to Give Personal AI Agents Separate App Identities

Descope introduced Envoy on Nov. 4, giving consumer apps a way to identify personal AI agents separately from customers and set permissions for software acting on their behalf without changing customer sign-in.

Apps can use Envoy to define which tasks an agent may perform, request customer approval for sensitive actions and revoke the agent’s access while the customer stays signed in. A shopping agent, for example, can browse products and place orders while being blocked from payment methods.

Envoy is designed to work with the Personal Agent Protocol, or Poppy, a draft framework for businesses to verify personal agents and create sessions tied to them. Sierra published Poppy’s first draft on Oct. 9. The protocol also describes how companies can publish endpoints for agents to use.

“Consumer apps can either block agents or let them sign in as humans, but neither approach works in the long term,” Descope co-founder and CEO Slavik Markovich said.

Descope also announced a TypeScript SDK with no external dependencies. It includes tools for discovering agents, managing sessions and making DPoP API calls.

GoFundMe, GoodRx, You.com and Composio are among the partners Descope named for Envoy. They plan to work with the company on the service in the coming months. GoFundMe Chief Product and Technology Officer Arnie Katz said the product would keep people and agents distinct in sessions and let users approve donations from their phones. GoodRx Chief Technology Officer Nitin Shingate said agents would have limited permissions for pricing information while users retain control of their actions.

Descope previously introduced approval and access controls for workplace AI agents. Envoy is designed for consumer apps and personal agents acting on customers’ behalf.