Knowing which agent placed an order answers one question. Knowing whether the customer approved that order answers another. A storefront needs both answers before a clean identity record can count as a trustworthy transaction.

That is the useful distinction in Descope's November 4 launch of Envoy, a delegated sign-in service for personal AI agents. Rather than letting software appear in the logs as an ordinary customer, Envoy gives the agent a separate identity, permissions and an approval path back to the person it represents.

Identity is the entrance, not the purchase order

According to the product documentation, Envoy works alongside an app's existing authentication. It supports the Personal Agent Protocol, nicknamed Poppy, a draft standard published by Meta and Sierra in October. Businesses can identify an agent through its published metadata and bind session tokens to a key it holds.

That helps distinguish a person from software acting for them. It does not decide what the software should be allowed to do. Descope describes separate controls for task permissions, how long elevated access lasts, and which sensitive actions require customer approval. A retailer could permit ordering while keeping saved payment methods and account settings out of reach.

The distinction matters when reading the launch language. The blog says nothing happens on a customer's behalf until they have seen and approved it. The product page makes the configurable boundary clearer: businesses choose which actions trigger an approval request. Do not assume a universal, per-transaction confirmation policy from the presence of delegated sign-in alone.

The approval must describe the thing being approved

Descope's shopping example sends the item, size and total to the customer before the order proceeds. Its product page describes out-of-band approval through Client-Initiated Backchannel Authentication, with the request arriving on the customer's own device rather than inside the agent's session.

For a team evaluating this design, the useful review starts after the demo looks convincing. Does approval cover the exact final total? What happens if the cart changes afterward? Can an expired or declined request still leave the agent with permission to act? These are acceptance questions, not failures GigSoul has observed in Envoy.

Revocation deserves its own check. Descope says one agent's access can be removed without signing the customer out. That is a better-defined control than treating the customer's entire account session as the only available switch.

The SDK is smaller than the whole promise

The accompanying Poppy TypeScript SDK is explicitly a 0.1 pre-release. Its README documents discovery, sessions, Device Sign-In, token renewal and API calls with key-bound tokens. It also lists Direct and Mediated Sign-In, web browsing, and conversations with company agents as not yet supported.

That is not a contradiction of Envoy's claim to support all three sign-in types. The business-side service and the agent-side SDK are different components. A buyer or builder needs to check the component they will actually deploy, not transfer every product-page capability to the library.

SiliconANGLE's launch coverage corroborates the announcement and names launch and design partners. Those partnerships are not evidence that every customer journey is already running in production.

GigSoul has not tested Envoy or the SDK. The practical lesson from their documentation is narrower than a promise of safe autonomous shopping: establish who is acting, limit what they can do, and verify what the customer approved. One of those checks cannot stand in for the other two.