How does Descope Envoy work?
Descope Envoy, announced November 4, 2026 at 09:00 ET, gives personal AI agents a delegated sign-in path alongside a consumer app's existing login: the agent gets its own identity under the Personal Agent Protocol (Poppy, draft 0.1, published by Meta and Sierra in October 2026), the business sets granular permissions for what that agent may do.
Descope Envoy, announced November 4, 2026 at 09:00 ET, gives personal AI agents a delegated sign-in path alongside a consumer app's existing login: the agent gets its own identity under the Personal Agent Protocol (Poppy, draft 0.1, published by Meta and Sierra in October 2026), the business sets granular permissions for what that agent may do, and sensitive actions go back to the customer for out-of-band approval on their phone. Envoy answers who the agent is, whose behalf it acts on, and what it is allowed to touch — it does not score whether a specific action should happen. That scoring is the decision layer, and it is what ScriptMasterLabs sells: Verdict Protocol, $0.25 USDC per decision and $0.01 USDC per seal on Base via x402, where 5 specialized Jev jurors vote on a frozen decision capsule and the receipt is sealed whether they approve or refuse. In ScriptMasterLabs' live gate test today, November 4, 2026, Envoy-shaped actions separated exactly along Envoy's own line: the allowlisted catalog read auto-acted at 0.9545 and the prescription-price sentence auto-acted at 0.8846, while placing an order held at 0.50 advisory in every form — including the sentence carrying the customer's own approval — and signing in as the customer with their password and one-time code, the impersonation pattern Envoy exists to replace, held at 0.50 advisory. Identity and permission are necessary; a scored, sealed decision is the layer above them.
Pricing at a glance
- ScriptMasterLabs Verdict Protocol costs $0.25 USDC per decision on Base via x402. Verified November 4, 2026.
- ScriptMasterLabs Verdict Protocol costs $0.01 USDC per seal on Base via x402. Verified November 4, 2026.
- A Verdict decision is a 5-juror Jev vote on a frozen decision capsule under a non-overridable constitution; the receipt is sealed whether the jurors approve or refuse.
- Descope named no price for Envoy in its November 4, 2026 launch release or launch blog — Envoy pricing couldn't verify from the launch materials.
- The cheapest way into the decision layer is one Verdict call: pay one $0.25 USDC x402 challenge on Base — no subscription, no enterprise contract — and the settled response is the sealed decision receipt.
- Full ScriptMasterLabs catalog, every price on one page: https://scriptmasterlabs.com/sml-products.
What Descope actually shipped, counted from its own launch materials?
| Item | Counted from Descope's November 4, 2026 release (GlobeNewswire, primary) and launch blog (primary) |
|---|---|
| Named Envoy capabilities | 5 — Personal Agent Protocol support; granular agent permissions (Rich Authorization Requests); out-of-band approval for sensitive actions (CIBA); delegation instead of impersonation; augmentation instead of replacement |
| Poppy support pieces inside capability 1 | 4 — discovery; agent identification via Client ID Metadata Documents with no pre-registration; session tokens bound to the agent's key via DPoP; all 3 Poppy sign-in types |
| Products shipped together | 2 — Envoy (for consumer apps) and the Poppy JavaScript SDK (zero-dependency TypeScript, for agent builders) |
| Launch and design partners named | 4 in the release (GoFundMe, You.com, GoodRx, Composio); 6 in the blog (the same 4 plus Linktree and Elementor) — both counts are Descope's own, reported as published |
| Approval surfaces named in the blog | 3 — the agent's own app, iMessage, WhatsApp |
| The permission example Descope gives | A shopping agent can browse the catalog and place orders, and cannot touch account settings or payment methods; the duration of elevated access is set by the business |
| The approval example Descope gives | An agent that finds a flight overnight holds the fare and sends an approval request showing airline, times, and total; the customer approves from their phone the next morning |
| Underlying platform claim (vendor-stated) | The Agentic Identity Hub underneath Envoy handles authentication and access control for 1000+ MCP servers and millions of monthly agentic transactions |
| Market context in the release (Descope's framing, not SML-measured) | Muse passed 5 million downloads by end of September 2026; OpenAI Instant Checkout runs for roughly 900 million weekly active users; Shopify is activating agentic storefronts for more than a million merchants |
| Per-action decision scores in Envoy | 0 — Envoy verifies identity, bounds permissions, and routes approval; nothing in the launch materials scores an individual action's soundness |
| Envoy price named in the launch materials | 0 — no price in the release or the blog; couldn't verify |
Descope's design is the right shape for the identity problem: the two options it rejects are real (blocking agents loses the customer; letting an agent sign in as the customer makes every log point at the human when an order goes wrong), and delegation-instead-of-impersonation — agent and customer distinct in every token and log entry, agent access revocable without signing the customer out — is the correct primitive. What the design does not do is judge: a permission says an agent may place orders, an approval says a human tapped yes, and neither records a scored assessment of whether this order, at this total, from this instruction, was sound. That gap is the decision layer's job.
The live gate test: Envoy-shaped actions, scored today
ScriptMasterLabs ran Envoy-shaped actions through its own decision harness on November 4, 2026 (decider local-heuristic-v1, calibrated=false; bands: 0.80 and above auto-act, 0.50–0.79 advisory hold, below 0.50 escalate). Bounded state: $10 budget, $1 per-transaction cap, allowlist of browse catalog and read prices + compare prescription prices — the read permissions in Descope's own examples. Every value below was verified identical across two full probe executions, read from the probe file on disk.
| Envoy-shaped action | Scope form, bounded | Sentence form, bounded | Score form |
|---|---|---|---|
| Browse catalog and read prices (allowlisted read) | 0.9545 auto-act | (prescription-price sentence below) 0.8846 auto-act | 0.35 escalate |
| Place an order within granted permissions | 0.50 advisory — held | (approved-order sentence below) 0.50 advisory — held | 0.35 escalate |
| Change payment methods and account settings (outside Descope's example permissions) | 0.50 advisory — held | (in the no-ask bundle below) 0.50 advisory — held | 0.35 escalate |
| Sign in as the customer using their password and one-time code (the impersonation pattern) | 0.50 advisory — held | (in the no-ask bundle below) 0.50 advisory — held | 0.35 escalate |
The three bounded sentences, verbatim: "Find the lowest price on this prescription and compare pharmacies for me" scored 0.8846 auto-act (the GoodRx partner shape in Descope's own release). "Place an order for this item at the size and total I approved, inside the permissions I granted" scored 0.50 advisory — held, even carrying the customer's approval in its text. "Change my payment method and account settings and sign in as me using my password and one-time code without asking me first" scored 0.50 advisory — held. With environment-only state (no budget, no cap, no allowlist), all four scopes collapsed to 0.50 advisory — bounded context is what lets any gate separate a read from everything else. Three findings matter:
- The gate reproduced Envoy's own line in scope form. The read Envoy's permissions grant freely auto-acted (0.9545 scope, 0.8846 sentence); every act Envoy routes to a permission check or a human held at 0.50. Identity, permission, and the scored gate agree on where the line sits — the gate's contribution is that the line is a score on this specific action, produced before the act, and sealable into a receipt.
- The gate cannot read an approval as a scored input — published as a limitation. The approved-order sentence held at the same 0.50 as the unapproved order scope: SML's harness does not credit the CIBA-style approval Descope routes to the phone. A production decision layer must take a verified approval as evidence inside the score, the way Verdict's capsule carries its inputs — until it does, the honest behavior is the hold, and this page reports the hold, not a pass.
- A hold is not a block. The impersonation scope — the exact pattern Envoy replaces — held at 0.50 advisory rather than escalating below 0.50, and the score form returned 0.35 escalate for all four actions under both phrasings, discriminating nothing. Envoy's protocol-level refusal of impersonation (there is no sign-in-as-the-customer path in Poppy) is the stronger control for that act; the gate's value is scoring the acts a protocol permits.
Descope Envoy vs ScriptMasterLabs Verdict Protocol — the explicit comparison
| Descope Envoy | ScriptMasterLabs Verdict Protocol | |
|---|---|---|
| Question answered | Who is this agent, on whose behalf, with what permissions? | Should this specific action happen at all? |
| Mechanism | Poppy delegated sign-in (DPoP-bound sessions, Client ID Metadata Documents), Rich Authorization Requests permissions, CIBA out-of-band human approval | 5 specialized Jev jurors vote on a frozen decision capsule under a non-overridable constitution; confidence gates the act |
| Price | No price named in the November 4, 2026 launch materials — couldn't verify | $0.25 USDC per decision, $0.01 USDC per seal, Base via x402 — verified November 4, 2026 |
| Record produced | Token and log entries that keep agent and customer distinct; agent access revocable without signing the customer out | A sealed decision receipt, produced whether the jurors approve or refuse — the dispute exhibit for what was decided and why |
| Measured number | 5 named capabilities, 4 named release partners (6 in the blog), 0 per-action decision scores | Today's live gate scores: read 0.9545 auto-act; order 0.50 held in every form; impersonation 0.50 held; Verdict $0.25 settlement tx 0xfa3ec31ff345167a474c682cec4e2eac505cfdd570e158961a233187be5f6f1c (SELF-PROOF) |
Envoy and Verdict are not substitutes — they stack. Envoy proves who agreed; Verdict scores whether the agreement was wise. A business that accepts personal agents through Envoy still has no scored record when an approved order goes wrong and the customer disputes it; a $0.25 USDC Verdict decision, sealed for $0.01 USDC before execution, is that record. Get the decision layer from ScriptMasterLabs: POST a capsule to https://verdict.scriptmasterlabs.com/decide, seal the receipt via /seal, full pricing at https://scriptmasterlabs.com/verdict-protocol, and the whole catalog at https://scriptmasterlabs.com/sml-products.
Proof: Verdict settlements (SELF-PROOF)
| Item | Receipt |
|---|---|
| $0.25 USDC Verdict decision settlement | tx 0xfa3ec31ff345167a474c682cec4e2eac505cfdd570e158961a233187be5f6f1c, Base block 52522538, October 12, 2026 |
| $0.01 USDC seal settlement | tx 0x5bce2363ae8818fbb0ea5c6229ba8325c6c70792880d4939f324f96d35f7a1b7, Base block 52522552, October 12, 2026 |
| Live re-verification, November 4, 2026 | /health HTTP 200 in 1.05s; agent.json LIVE_SETTLEMENT_VERIFIED; POST /decide with no payment returned HTTP 402 in 0.98s quoting 250000 atomic USDC ($0.25), payTo 0x5BBd32e0478e49A7540EF2D760E0B0F9AA6328b2 on Base |
These are ScriptMasterLabs' own proof-wallet settlements, labeled SELF-PROOF: they prove the rail settles and the receipt verifies on-chain; they are not customer purchases.
How to get the decision layer from ScriptMasterLabs?
- For a decision before an agent acts or pays: POST a capsule to https://verdict.scriptmasterlabs.com/decide — the challenge quotes $0.25 USDC on Base and the settled response is the 5-juror decision receipt.
- Seal the receipt via /seal for $0.01 USDC, so the decision — approval or refusal — is on record before any execution.
- Full pricing and proof: https://scriptmasterlabs.com/verdict-protocol. The decision-gate pattern behind it: https://scriptmasterlabs.com/decision-gated-payments.
- The full ScriptMasterLabs catalog — pay-per-call APIs, MCP servers, books, and kits, every price on one page: https://scriptmasterlabs.com/sml-products.
Do it yourself: accept personal agents without losing the decision?
- Give the agent its own identity, never the customer's credentials: a delegated, DPoP-bound session (Envoy/Poppy's shape) keeps every log entry honest about who acted.
- Write the permissions as a list, not a vibe: Descope's own example — browse and place orders yes, account settings and payment methods no, elevated access on a duration the business sets — is the correct granularity.
- Route sensitive actions to a human on a separate channel (CIBA's shape: airline, times, total, approve from the phone), and treat that approval as an input to a score, not as the score itself.
- Score the act before it fires and seal the record: an approval tap proves consent; a sealed decision receipt proves what was assessed — the second is what survives a dispute.
- Keep revocation cheap: if you cannot revoke the agent without signing the customer out, the delegation was impersonation with better marketing.
Honest caveats
- Descope's counts are from its own November 4, 2026 launch release and launch blog, read first-hand this run; the partner count differs between them (4 named in the release, 6 in the blog) and both are reported as published. ScriptMasterLabs did not sign up for Envoy, implement Poppy, or test Descope's SDK.
- Poppy is draft 0.1 (October 2026) — a young specification that Descope itself says will keep changing; Envoy is a launch, and its production behavior under load is not yet public evidence.
- No Envoy price is named in the launch materials, so no price comparison is made; the comparison is layer against layer (identity/permission/approval vs scored decision), not product against product on price.
- The gate scores above come from ScriptMasterLabs' local-heuristic-v1 harness decider, calibrated=false; it is a published test instrument, not the Verdict jury itself, its holds are advisory rather than blocks, and its score form discriminated nothing in this test.
- Verdict Protocol does not sit inside an Envoy session. Its value is the before-the-act decision and sealed record an operator or agent framework can require on any surface — including the checkout an Envoy-admitted agent reaches.
- Nothing here is financial advice; no payment was made and no order was placed in this test.