In the late 1990s, asking a consumer to type their credit card number into a web browser was treated with the same suspicion as handing a physical wallet to a stranger in an alley. Today, we face a similar standoff with AI agents. We want the convenience of autonomous commerce, but the idea of a bot executing transactions on our behalf without strict guardrails makes everyone—consumers, developers, and the businesses left holding the bag—a bit uneasy.
Here is the commercial reality of the agentic era: As we shared at Oktane, brands are seeing up to 40% of their traditional search traffic shift to third-party AI agents. Because these agents have already done the heavy lifting of product discovery and evaluation, they convert at three to five times the rate of a human clicking around a storefront. For years, security teams focused on keeping bots out. Now, we have to let the good ones in. If you shut down agentic traffic because you lack the means to verify it, you are saying “no” to legitimate sales today, and risk undermining loyalty tomorrow.
Yet, the industry is struggling to make this pivot safely. We recently published our 2026 Customer Identity Trends Report, and the findings highlight a massive disconnect between business ambition and technical execution: While nearly 60% of organizations are racing to introduce action-taking agents, 80% of these AI initiatives are running behind schedule.
To get these projects out of purgatory and into production, we have to address the friction on both sides of the login box.
Here are some key insights from the report that highlight the challenges and choices shaping the next generation of customer experiences.
Consumers want AI assistance, not AI autonomy
Most consumers are simply not ready to let their agents loose. According to the report, only 38% of consumers are comfortable delegating even low-risk decisions to AI, and a mere 6% want complete AI autonomy.
Much like the early days of online shopping, consumers will only adopt AI if they feel protected. They want AI assistance, but they demand control—specifically, the ability to approve or undo an agent's actions.
Reasons for AI project delays vary depending on who you ask
Based on our report, 59% of business leaders tend to blame AI delays on vague "compliance, security review, or governance" issues, developers on the ground tell a far more practical story. Our research found that developers are twice as likely (17.8% to 9.0%) as senior leaders to point out that their current identity infrastructure simply cannot support agent access patterns.
When identity infrastructure falls short, teams are more likely to build makeshift workarounds that can put sensitive customer data at risk. This compromises security and breaks user trust before the experience even begins. To build lasting trust, product teams must extend identity controls to the AI agents themselves. Securing data behind the scenes is the first and most critical step in creating a reliable and trustworthy experience.
External customer identity platforms help speed up AI deployments
Product teams don't have to build identity from scratch to launch AI features on time. The report reveals that organizations using an external customer identity platform report deploying AI with greater success than those relying on legacy or homegrown systems.
By standardizing identity and defining clear permissions for AI agents in one place, an external platform allows developers to scale features without constant rearchitecting. This keeps rollouts on schedule (28.3% that use an external platform compared to 18.1% that use another approach) while delivering the seamless, secure experiences that prevent customer abandonment.
Developers using an external platform are far more likely to view identity as a competitive advantage. They are more likely to have AI features fully embedded in production today (34.4% compared to 22.3%) and are less likely to report losing customers to security friction.
Okta named a Leader
2026 Gartner® Magic Quadrant™ for Customer Identity and Access Management
Modern identity is the AI enabler
You cannot treat agentic risk like traditional fraud. Shutting down suspicious traffic after the fact is not a viable strategy when those bots are driving a significant and growing portion of your revenue.
Revenue shouldn’t have to come at the expense of risk. Making agentic commerce viable means applying runtime, fine-grained access controls that define exactly what an agent is allowed to access. Unsurprisingly, the report reveals that organizations using an external, modern customer identity platform are far more successful at this. Standardizing identity and defining clear permissions for AI agents in one place helps companies keep their rollouts on schedule and gets AI features into production significantly faster than those relying on legacy systems.
Read the full 2026 Customer Identity Trends Report to see how brands are securing the next generation of customer journeys.
