On November 4, 2026, Okta published an analysis by Gareth Davies, chief product officer of its Auth0 customer identity business, arguing that 80% of AI initiatives in customer journeys are running behind schedule and that identity infrastructure is a large part of the reason. The figures come from Okta's 2026 Customer Identity Trends Report, built on surveys of 5,250 consumers and 910 developers and senior leaders, which also finds that only 6% of consumers want AI to make final decisions and act for them completely autonomously.

In Short

Okta, the company behind the Auth0 login service, surveyed thousands of shoppers and hundreds of developers and executives, and only about one in five of those developers and executives said their company's AI work is moving as fast as planned. Most people will not let an AI agent buy or act for them unless they can approve or undo what it does, and only 6% want it to act completely on its own. For online sellers, that puts the login, permission and approval steps around an agent at the center of whether agent-driven sales happen at all - though the company drawing that conclusion sells exactly those steps.

What Okta published

The post, titled "Closing the AI trust gap: Why 80% of agentic commerce projects are stalled (and how to fix it)," appeared on November 4, 2026 in the Industry Insights section of Okta's newsroom under Davies' byline. It summarizes the 2026 Customer Identity Trends Report, an Auth0-branded study subtitled "Identity is the new revenue growth engine." The report itself carries no publication date. Davies describes it as recently published.

Davies opens with an analogy from the early web. "In the late 1990s, asking a consumer to type their credit card number into a web browser was treated with the same suspicion as handing a physical wallet to a stranger in an alley," he writes, before arguing that AI agents now face a similar standoff. His central claim is that security teams have to reverse a long-held instinct. "For years, security teams focused on keeping bots out. Now, we have to let the good ones in," according to the post.

The commercial context matters. Okta sells an external customer identity platform, Auth0, and the report's strongest conclusion is that organizations using only an external customer identity platform outperform everyone else on AI. Two days before the post, on November 2, 2026, Okta said Gartner had named it a Leader in the 2026 Magic Quadrant for Customer Identity and Access Management, and the November 4 post carries a promotional panel for that recognition. On September 2, 2026, Okta announced a product called AI Identity for Commerce, which it said would let consumers transact through AI agents and would be generally available in late September. The report is, in effect, an argument for the category of product Okta sells.

How the surveys were run

Okta commissioned two surveys, according to the report's methodology section. Statista GmbH ran an online survey of 5,250 consumers, with 750 respondents in each of seven countries: the US, Canada, the UK, Germany, Japan, Australia and New Zealand. Respondents were not told that Okta had commissioned it. Fieldwork took place in July and August 2026.

The second survey, recruited and fielded by Rep Data in the same two months, covered 556 developers and 354 senior leaders, a total of 910. The report calls it "double-blinded." Respondents came from the US (22.3%), the UK (22.2%), Germany (16.8%), Canada (16.5%), Australia and New Zealand (11.2%) and Japan (11.0%), and from four industries: healthcare, financial services, retail and telecom.

The report gives no margin of error, no weighting method and no breakdown of how many respondents fall into each identity-platform group it later compares. Several charts carry sample sizes that differ from the headline totals without explanation, a point that matters for the comparisons below.

The 80% figure and what it counts

The headline number rests on a single question. Only 20.3% of developers and senior leaders reported that they are "moving/shipping at the target pace" on AI. The report then asks: "What factors are holding back the other ~80%?" Its executive summary turns that into the statement that "80% of transformation initiatives are behind schedule," and the November 4 post goes further, describing "80% of agentic commerce projects" as "stalled."

Each step widens the claim. The survey measured individual respondents' views of their organization's pace, not a count of projects. It covered AI and agentic features in customer journeys across four industries, of which retail is only one, and the report does not break the pace figure out by industry. "Stalled" appears in the post's headline; the report uses "behind schedule" and "moving slower than planned."

The ambition behind those delays is broad. Practically every respondent (96%) said their organization intends to integrate AI into customer journeys, and 75.2% said they either already have such features fully embedded in production or are actively building them. Some 59% of organizations already have at least one agent that takes actions on a user's behalf, or that autonomously calls external APIs or third-party services, in production or in the pipeline, according to the report.

Senior leaders see the stakes in stark terms. Some 52% called AI "a must-win capability" for their organization's "ability to compete and grow over the next two to three years," and another 31.1% called it important. Asked for the single biggest threat to their business, 23.2% chose "competitive disruption from AI-native competitors," second only to "cybersecurity and data risk" at 31.4%. More than two-thirds (67.2%) said their business would be at least moderately threatened if a competitor launched "a meaningfully better AI-driven customer experience." The report frames this as a Red Queen race, borrowing Lewis Carroll's line about running as fast as possible just to stay in place.

Leaders blame governance, developers blame plumbing

The survey's clearest split is over why projects are slow. Among senior leaders, 59% named compliance, security review or governance as the single biggest bottleneck - "far and away their most popular choice," in the report's words. Among developers, the same answer was also the most common, but only 34.6% chose it.

The rest of the distribution tells a more practical story:

Single biggest reason for slower AI progress Developers Senior leaders
Compliance, security review, or governance 34.6% 59%
No engineering capacity right now 20.6% 18.1%
Identity and auth infrastructure "can't support agent access patterns" 17.8% 9%
No compelling enough use case identified yet 17.8% 6.9%
Leadership hasn't prioritized it 9.2% 6.9%

Davies' post leans on the identity row. It says developers are "twice as likely" as senior leaders to say their infrastructure "simply cannot support agent access patterns." The report says "nearly twice," which is the accurate reading: 17.8% divided by 9.0% is 1.98, by PPC Land's calculation. The post also describes leaders' governance answer as "vague," a characterization the report does not make.

The table contains a finding the post does not mention. Developers named the lack of a compelling use case exactly as often as they named identity infrastructure, at 17.8% each. More than a fifth of developers pointed to engineering capacity. Identity is one constraint among several, not the dominant one. The chart is also labeled with all 910 respondents, even though the question as worded applies only to those not moving as fast as they would like, and the report does not explain the difference.

How agents get their credentials

The report's most technical finding concerns how organizations let agents act. According to the report, "the safest approach for managing agent authentication and authorization is to have a unique agent identity with tightly scoped, time-limited credentials." Among respondents from organizations actively building AI and agentic capabilities, only 22.4% said they do this.

The others described approaches the report labels "dangerous": shared service accounts or long-lived API keys (17.4%), inheriting the user's token or credentials (11.5%), and hardcoded or embedded credentials (6.4%). Together the four answers account for 57.7% of that group, by PPC Land's arithmetic. The report does not say what the remaining 42.3% do, nor how many respondents were in the group.

The report lists four failure modes that grow as agent usage scales:

  • Over-permissioning: the credential carries broader authority than the agent needs for the task in front of it.
  • Blast radius: a compromise of the agent process, its memory or its logs exposes a credential that grants standing access to production systems.
  • Lack of behavioral context: the identity layer cannot distinguish between different actions when they present the same broadly scoped credential.
  • Credential sprawl: every new tool the agent integrates with means another credential to provision, store, rotate and audit.

Davies ties the infrastructure gap to data risk. "When identity infrastructure falls short, teams are more likely to build makeshift workarounds that can put sensitive customer data at risk," according to the post.

Consumers want help, not autonomy

On the demand side, the numbers are cooler. Some 52% of consumers said the pace at which AI capabilities are evolving in apps and websites is "moving too fast," against 35% who said it is "moving at about the right pace." The report reads this not as a rejection of AI but as discomfort "with its pervasiveness and the powers it has been granted."

The report's trust gap figure is 38%. In the body of the report, 38% of consumers "would be comfortable giving AI some decision-making authority in the next two years," while only 6% want AI "to make final decisions and take actions on their behalf completely autonomously." The executive summary words the same 38% differently, as consumers "currently willing to delegate decisions to AI agents," adding that most of them would do so only in low-value, low-risk scenarios. The two descriptions do not match on timing.

Auth0's web page for the report breaks the preference down further. According to that page, 6% want AI to decide and act entirely on its own, 32% want AI to handle routine tasks while they make important decisions, 37% want suggestions only, and 25% want little or no AI. The first two add up to the 38%, by PPC Land's arithmetic.

Comfort varies sharply by adopter type. Asked how likely they would be to let an AI tool complete a purchase or booking without reviewing it first, 42% of self-described early adopters said very likely and 20% rather likely. Among mainstream adopters, those shares fell to 12% and 19%, and 41% said not likely at all. Among late adopters, only 4% said very likely and 10% rather likely, while 59% said not likely at all. The report does not say what share of the 5,250 respondents falls into each group.

Approval and undo change the picture

The report's most useful data for anyone building agent-driven shopping is a breakdown of 11 actions. For each, consumers chose whether they would trust the AI to act on its own, allow it if they could reverse the action, allow it if they approved first, or never allow it.

Action Trust it on its own Allow if reversible Allow if approved first Never allow Willing under some condition (PPC Land calculation)
Requesting a refund for a purchase 9% 17% 39% 35% 65%
Booking a restaurant reservation 9% 18% 37% 36% 64%
Canceling a subscription 9% 16% 38% 37% 63%
Reordering a product bought regularly 8% 17% 34% 41% 59%
Sending a message (email or text) 8% 15% 33% 45% 56%
Accessing health data for recommendations 8% 14% 31% 47% 53%
Low-value purchase (under $25) based on past behavior 7% 16% 30% 48% 53%
Updating personal details (contact or payment) 7% 14% 31% 48% 52%
Booking travel (flights or hotels) 6% 15% 31% 49% 52%
Financial transaction (moving money between accounts) 5% 13% 23% 59% 41%
Higher-value purchase (over $100) based on past behavior 4% 14% 22% 60% 40%

Unconditional trust never rises above 9% for any action. Once approval or reversal is on offer, a majority is willing for nine of the 11 tasks. The two exceptions are the ones closest to money: transfers between accounts and purchases over $100, where six in ten consumers would never allow it. Even for a purchase under $25, 48% said never.

Approval is consistently the stronger lever. For every action, more consumers picked approval in advance than the option to reverse an agent's work afterward. Davies' post puts it in one line: consumers "want AI assistance, but they demand control," specifically "the ability to approve or undo an agent's actions."

Asked separately which measures would make them more comfortable with an app or website using AI to act for them, consumers spread their answers widely. The ability to set permission levels led at 36%, followed by notifications that allow approval of actions (34%), the option to contact a human (34%), clear information about data use (32%), a clear explanation of what the AI can and cannot do (31%), a reviewable and correctable history of actions (30%), a real-time view of what the AI is doing (28%) and independent certification or standards (23%). Some 29% chose "Nothing, I do not want AI to take actions on my behalf," a larger share than chose a real-time view or certification. No single measure reached a majority, which the report reads as evidence that "a range of options will be necessary."

The pattern matches choices retailers have already made. When Walmart introduced Agent Profiles on October 21, 2026, it made per-purchase approval the default, with optional spending limits such as $50, $100 or $200. A Zeta survey covered by PPC Land in July found 43% of parents would let AI shop within a set budget, against 27% of non-parents.

The front door still leaks

Much of the report is about conventional login and sign-up, on the argument that agents will magnify whatever friction already exists. For 93% of consumers, trust is an outcome of an app or website providing "strong security without making access difficult." Majorities value continuity across sessions (85%), faster checkout through saved information (84%) and continuity across devices (80%). Some 89% value clear control over their data and being able to see how it is used.

Asked which situations would make them stop or abandon what they were doing, consumers gave these combined "definitely yes" and "probably yes" answers:

  • Being asked to create an account before seeing key information such as prices or reviews: 74%
  • Login or verification processes taking too long: 72%
  • Being asked to verify identity multiple times during a task: 71%
  • Being asked to create an account before completing a purchase: 59%
  • Being asked to verify identity to complete a purchase or sign-up: 50%
  • Entering a code sent by phone or email at every login: 42%
  • Proving they are not a robot at login, such as a CAPTCHA: 34%

The gap between the first and fourth items is the report's point about context. A sign-up wall in front of prices drives away three in four respondents, by their own account; the same request at the point of purchase drives away fewer. Familiar measures such as multi-factor codes and bot checks draw the least resistance. When consumers must sign up, the report says, their preferred route "by far" is social login with an existing account from Google, Apple or Facebook, though it gives no figure for that preference.

The report contrasts what it calls legacy identity with customer-centric identity across four stages: long, multi-field registration forms against one-click passwordless, passkey or social sign-up; manual password entry against biometric authentication or magic links; front-loaded data requests against progressive profiling that gathers voluntarily shared, or zero-party, data over time; and static MFA prompts for every session against adaptive MFA that triggers step-up authentication only when risk signals spike.

The developer survey links friction to usage. Asked whether friction in authentication or account access has a "major" impact on how often customers use their product, 39.5% of developers at organizations on legacy systems said yes, as did 30.3% at organizations with home-built identity. The share was 19.6% for a mix of external and home-built, 18.5% for an inconsistent approach and 13.9% for organizations using only an external platform. A footnote adds that respondents with legacy systems were roughly 2.5 to 4.5 times more likely than the other groups to say they "haven't measured it directly, but suspect it matters." That caveat cuts both ways: the group reporting the most damage is also the group least likely to have measured it.

Among retailers, those using only an external platform were the least likely to say their authentication experience hurts average order value or purchase frequency, according to the report. It publishes no percentages for that retail comparison.

Fraud pressure, and a measurement problem

Nearly nine in ten developers and senior leaders (88.8%) said their organization is actively dealing with at least one of seven identity-related security or fraud challenges. Each was cited by between 30% and 40% of respondents:

  • Phishing or social engineering targeting users: 38.6%
  • Fake account creation at sign-up: 37.8%
  • Credential stuffing or brute-force attacks on login flows: 36.9%
  • API abuse or unauthorized system access: 36.4%
  • Account takeover affecting legitimate users: 36.0%
  • Bot traffic inflating engagement metrics or abusing promotions: 34.5%
  • Loyalty or rewards program abuse: 30.1%

Only 8.6% said they face none of these problems, and 2.6% were not sure. The report expects the situation to worsen because "AI technologies are easily weaponized," lowering the cost of large-scale attack campaigns.

For marketers, the sixth line is the one with a direct budget consequence. A third of organizations say bots are inflating engagement metrics or abusing promotions, a sign that some of the traffic, sign-ups and redemptions counted in campaign reports may not come from customers at all. That aligns with ADEX data published on October 27, 2026, which found bots impersonating humans in 64% of the AI-involved ad fraud schemes it flagged, and with HUMAN Security's April 2026 benchmark, which found only half of one percent separating benign from malicious automation.

The case for external platforms, and who makes it

The final third of the report argues that the identity platform an organization uses predicts its AI progress. Its three headline comparisons all favor organizations using only an external customer identity platform:

  • 28.3% of respondents at those organizations said their AI initiatives are progressing at the desired pace, against 18.1% at organizations taking another approach.
  • 34.4% already have AI or agentic features fully embedded in production, against 22.3% elsewhere.
  • Developers at those organizations were the most likely to say they are building or planning each of six AI capabilities.

The capability chart, based on 445 respondents rather than the full 556 developers, shows the widest gaps on agents that act. An agent that takes actions on a user's behalf, such as submitting forms or triggering workflows, was being built or planned by 52.8% of developers at external-only organizations, 48.4% with home-built identity, 44.6% with a mix, 32.6% on legacy systems and 29.6% with an inconsistent approach. For a conversational assistant, the external-only figure was 58.9%, against 40.7% to 51.6% for the other groups. On AI-powered fraud or anomaly detection, though, external-only and mixed organizations tied at 26.1%, so the "most likely for each" claim holds only with a tie on that capability.

Developers using only an external platform were also the most likely to say their organization has "solved" identity to the degree that it is "a competitive advantage, not a burden," and the most likely to answer "This isn't a problem for us yet" when asked how security affects customer experience. The report gives no percentages for either.

Several limits apply to all of this. The comparisons are self-reported and correlational. The report does not say how many respondents use each type of identity system, so the size of each comparison group is unknown. It does not control for company size, budget, industry or digital maturity, any of which could explain both the choice of an external platform and faster AI progress. Okta's post also drops a qualifier in places, writing of organizations that use "an external platform" where the report's figures refer to those using only an external platform.

Davies draws the conclusion directly. "Unsurprisingly, the report reveals that organizations using an external, modern customer identity platform are far more successful at this," according to the post, referring to applying "runtime, fine-grained access controls that define exactly what an agent is allowed to access." The report closes with three steps for brands. The first, rejecting the "convenient OR secure" mindset, it ties to "transitioning to a modern, external identity platform."

The 40% claim sits outside the report

The post's most striking commercial figures do not come from the survey at all. "As we shared at Oktane, brands are seeing up to 40% of their traditional search traffic shift to third-party AI agents," Davies writes, adding that these agents "convert at three to five times the rate of a human clicking around a storefront." Oktane, Okta's annual conference, ran from September 22 to 24, 2026. Neither figure appears in the report, and the post names no brands, time period or measurement method behind them. Okta's September 2 product announcement cited a different projection, from Bain, that AI agents could drive up to 25% of US e-commerce within four years.

Evidence covered by PPC Land points in more than one direction. A Microsoft Clarity study reported in November 2025 found AI-referred visitors signing up at 1.66% against 0.15% for search. In March 2026, Walmart said purchases completed inside ChatGPT converted three times lower than click-out links. Shopify said on November 3, 2026 that orders from AI searches grew 3.3 times year over year, from a base it described as small and did not quantify. And Clarity's October 29, 2026 study recorded checkout in 25.21% of agentic sessions against 14.65% of human sessions. None of these supports a 40% shift of search traffic to agents.

Why this matters for marketers

The report reframes a question that has so far been treated as a bot-management problem. If agents are becoming customers, the systems that decide who gets through login and checkout also decide which agent-driven sales happen. Davies states the commercial version plainly: "If you shut down agentic traffic because you lack the means to verify it, you are saying 'no' to legitimate sales today, and risk undermining loyalty tomorrow."

Verification is the weak point. Arkose Labs reported in October that 97.7% of the AI agent sessions it classified as legitimate carried no verified identity, with ChatGPT agent the only product signing most of its sessions. Web Bot Auth, the signature standard that Visa's Trusted Agent Protocol and Mastercard's Agent Pay adopted through Cloudflare in October 2025, is spreading slowly; Meta only began signing some Muse requests in an unannounced test around October 12, according to DataDome. Detection without signatures is unreliable: in Resemble AI's own internal benchmark, six bot tools caught between 3.1% and 14.8% of disguised agents.

A layer of standards and services is forming around that gap. The FIDO Alliance set up working groups on agentic authentication and payments in April 2026, with Google donating its AP2 protocol. Experian launched Agent Trust to tie agents to verified humans the same month and added DataDome's behavior monitoring in October. Okta's report positions customer identity platforms as another contender for that role, sitting at the merchant's own login rather than at the network edge or the payment rail.

The consumer data carries the more immediate implication for anyone selling online. Agent-driven purchases have a ceiling set by consumer consent, and the survey puts unconditional trust at single digits for every action tested. The agentic AI checkout flows that reach mainstream shoppers will, on this evidence, look less like autonomous buying and more like delegated shopping with a human sign-off, much as Walmart has already designed its Agent Profiles. And the oldest friction in e-commerce has not gone away: three in four consumers say a sign-up wall before prices would stop them, whether or not an agent is involved.

The survey's limits are worth holding alongside its findings. It is commissioned research from a vendor whose product the conclusions favor, the comparison groups are unsized, and the most-cited commercial numbers in Okta's post come from a conference keynote rather than the data.

Timeline

Summary

Who: Okta, through its Auth0 customer identity business, with an analysis by Gareth Davies, chief product officer of Auth0. The surveys were run by Statista GmbH (5,250 consumers) and Rep Data (556 developers and 354 senior leaders).

What: The 2026 Customer Identity Trends Report and Davies' post on it. Only 20.3% of developers and senior leaders say their AI work is moving at the target pace, which Okta presents as 80% of initiatives behind schedule and its post headline calls 80% of agentic commerce projects stalled. Senior leaders blame governance (59%), while developers spread the blame across governance (34.6%), engineering capacity (20.6%), identity infrastructure (17.8%) and the lack of a use case (17.8%). Only 6% of consumers want fully autonomous AI, unconditional trust never exceeds 9% for any of 11 actions, and approval or undo options lift willingness above 50% for nine of them. The report finds better AI outcomes at organizations using only an external identity platform, the category Okta sells, without disclosing group sizes.

When: November 4, 2026, for the post; the report is undated and its surveys were fielded in July and August 2026. The 40% search traffic figure in the post comes from Oktane, held September 22 to 24, 2026, not from the report.

Where: Consumers in the US, Canada, the UK, Germany, Japan, Australia and New Zealand; developers and senior leaders in the same markets across healthcare, financial services, retail and telecom. The post appeared in Okta's newsroom.

Why: AI agents are starting to shop and act on behalf of consumers, and the systems that handle login, permissions and checkout decide whether that traffic is treated as a customer or a bot. The report argues that identity infrastructure is holding back AI rollouts and that consumers will only delegate with control - a conclusion that supports the products its publisher sells, and one the underlying data supports only in part.