Descope

Descope's Free tier (7,500 MAUs, 10 tenants) lets agencies build a proof-of-concept for a client in hours, then convert that into a $920/mo retainer with the Auth Starter offer. Because the platform handles passwordless, SSO, and MFA without custom code, agencies can deliver identity work that previously required a security engineer, turning a one-time setup into a recurring managed service that scales with client MAU growth.

The Descope MAU Margin Model helps agencies price identity retainers by tracking monthly active user consumption against Descope's tiered pricing. With Free at 7,500 MAUs, Pro at 10,000, and Growth at 25,000, an agency can map client size to the right tier and set fees that cover costs plus a healthy margin. For example, a funded SaaS startup with 5,000 MAUs fits the Free tier, allowing a $920/mo retainer with near-zero infrastructure cost. As the client scales past 7,500 MAUs, the agency must upgrade to Pro ($249/mo) or Growth ($799/mo), adjusting the retainer to preserve margin. This model prevents the common agency trap of flat-fee retainers that turn unprofitable as client MAUs grow. By monitoring MAU reports monthly, agencies can proactively renegotiate pricing before costs erode profits.

The Non-Human Identity Perimeter framework reframes IAM for agencies: every AI agent, API key, and service account is an identity that must be governed with the same rigor as a human employee. As agencies deploy agents for content, reporting, and client communication, each one becomes a potential entry point. A single misconfigured credential can expose client data or trigger compliance failures. The framework urges agencies to inventory all non-human identities, assign ownership, and enforce least-privilege access. For example, when Meta's ad AI altered approved creative post-launch, it highlighted how platform agents operate outside traditional human access controls. Tools like Zluri and Securden now offer dedicated non-human identity governance, while 1Password extends vaults to AI agents. Agencies that ignore this perimeter risk client trust and regulatory penalties.

Identity Blast Radius is a framework for sizing the potential damage of a single compromised credential or misconfigured access path. For agencies, the blast radius is not just the client's data but the agency's own reputation and compliance posture. A single breach from weak credential management can collapse client trust, as the category description warns. The framework forces agencies to map every identity, human or non-human, to the resources it can reach, then measure the worst-case outcome if that identity is compromised. Consider an agency using Okta for SSO and 1Password for secrets: if a shared vault credential is exposed, the blast radius includes every client project that vault touches. The goal is to shrink the radius by enforcing least privilege, segmenting access, and rotating credentials, turning a potential catastrophe into a contained incident. Recent agentic AI incidents, where autonomous agents posted thousands of messages or altered approved creative, expand the blast radius to non-human identities, making this framework essential for modern agency security.

Adopt Descope when your client needs fast, compliant auth deployment without hiring security engineers, and their MAU count fits within the Pro or Growth tier limits.

Inventory and govern every non-human identity, including AI agents and service accounts, before granting them broader access to client systems.

IF your agency serves funded B2B SaaS or fintech clients needing passwordless login, SSO, and adaptive MFA without a dedicated identity engineer, THEN Descope's Free tier (7,500 MAUs, 10 tenants) supports a proof-of-concept, and the Pro plan at $249/mo scales to 10,000 MAUs with SOC 2 reports for compliance-sensitive clients. IF your clients exceed 25,000 MAUs or demand deep custom code, THEN skip because Growth caps at 25,000 MAUs and the platform is no-code, limiting bespoke auth logic.

A productized offer where agencies deploy and manage Descope's no-code identity platform for clients, covering passwordless login, SSO, and adaptive MFA without writing auth code.