Okta’s 2026 Customer Identity Trends Report finds that most shoppers are hesitant to let AI agents handle purchases without oversight.
Readiness levels vary by control
Only 37% of North American users say they would allow an autonomous system to make final buying decisions. The figure rises above 50% when a confirmation step lets them approve or reverse the action.
The survey asked respondents how comfortable they were with an AI tool performing tasks such as ordering items, booking travel or accessing personal data. Willingness increased sharply when the tool required explicit sign-off.
Rapid advances in AI functionality add to the unease. Globally, 52% of respondents feel that capabilities in apps and websites are moving too quickly.
Comfort levels differ by age and tech experience. Younger users and early adopters tend to be more open, while older individuals and late adopters show stronger resistance.
Businesses must reflect these preferences. A travel-booking assistant, for example, might request permission before using stored payment information or before finalizing a ticket.
Read Also: Open-source TLS proxy Ghostunnel enables mutual authentication
Clear explanations of what the assistant can do, together with easy ways to withdraw access, help users decide how much authority to grant.
Technical hurdles slow rollout
More than three-quarters of developers in North America report that their firms already run AI agents or are actively building them, yet just 22.1% say projects are on schedule.
Shortages in engineering capacity and gaps in identity infrastructure are cited as the main bottlenecks.
Customer identity and access management consumes roughly 14% of engineering time, a recurring cost that drains resources from feature development.
“When identity infrastructure falls short, teams are more likely to build makeshift workarounds that can put sensitive customer data at risk,” said Gareth Davies, CPO at Auth0.
An agent checking delivery status needs shipping details, while changing an address or approving a new purchase requires separate permissions.
Read Also: AI finds critical bug faster than fixes arrive
Assigning each agent its own identity lets firms enforce precise limits; credentials can expire after a task or a set period, restricting access to only what is needed.
Activity logs record which agent performed an action, the permissions it held, and the outcome, aiding investigations of errors or unauthorized use.
Shared accounts and embedded credentials complicate traceability and increase exposure if an agent is compromised.
Platform choices affect deployment
Organizations that rely on an external customer-identity platform are more likely to have AI features in production and to stay on schedule, according to the global findings.
These firms also report higher use of authentication methods that simplify access while protecting interactions and revenue.
Centralizing identity checks reduces repetitive work across applications, freeing developers to build customer-facing features. Those features must present approval requests clearly, explain any extra verification, and let users regain control if something goes wrong.
Leave a Reply