The next scale frontier: How Ory and Cockroach Labs are rebuilding trust for agentic AI

This blog distills key themes from a recent conversation between Spencer Kimball, CEO of Cockroach Labs, and Jeff Kukowski, CEO of Ory Corp, as they sat down to discuss what it really takes to rebuild digital trust in the age of agentic AI. Watch the full video here.

When the internet scaled to billions of users, we called it web scale. That phrase once captured an age of engineering defined by horizontal elasticity, global databases, and cloud orchestration. But the world is changing again, and this time, it’s not humans driving demand. It’s machines.

A new kind of traffic has emerged: AI agents acting autonomously, negotiating access, authenticating across systems, and generating data at a speed that dwarfs traditional user behavior. The infrastructure built to serve human requests, and now identity systems, data stores, and both authentication and authorization are suddenly outmatched.

For teams building apps and services, this isn’t an abstract future. It shows up as auth clusters that saturate unexpectedly, regional failover that doesn’t behave as modeled, and compliance teams that can’t explain where identities actually live at any given moment. Capacity planning, risk modeling, and incident response were all built around human-driven patterns and those assumptions are breaking.

Agentic scale marks a deeper shift, not just new infrastructure, but a redefinition of how we understand and manage trust. Instead of “how many users can we support?”, the questions become:

• How many autonomous agents can we allow to act on behalf of a single user, safely?
• How many authorization decisions per second can our architecture sustain before latency impacts experience or security?
• How quickly can we revoke tokens, or apply new access policies globally when something goes wrong?

From humans to agents: The end of predictable scale

In the web scale era, systems were built around predictable human patterns: logins, sessions, CRUD operations, peak traffic events. Scale was fairly linear, more users meant more requests, more infrastructure. But AI upends that logic.

When a single AI agent can spawn hundreds to thousands of sub-agents, each making authorization calls, database writes, and real-time access policy checks, traditional scaling assumptions crumble. The need to maintain security, compliance, and consistency as machine interactions multiply exponentially.

For technical executives, this means your load profiles shift from “worst hour of Black Friday” to “unbounded concurrency if an agent loop goes wrong.” Thundering herds no longer come only from human behavior, they can come from code that can recursively generate more code and more calls.

“Companies built with human-scale assumptions simply won’t scale tenfold in the next three to five years,” Kimball says. “You can’t rely on systems designed for people when you’re suddenly dealing with a population of intelligent machines.”

This shift has already begun. Enterprises that once measured authentication in thousands of requests per second are now hitting millions, and the data volume that accompanies it is staggering. Each interaction carries not just context but identity, requiring global systems that can store, verify, and revoke at machine speed.

In practical terms, this means:

• Exploding auth traffic: Every tool-using agent interaction can involve multiple policy checks, across multiple services, for a single user action.
• Token lifecycle complexity: Short-lived, high-volume credentials for agents, tools, and services must be issued, rotated, and revoked without impacting human experience.
• Non-linear incident impact: A misconfigured policy or compromised token doesn’t affect dozens of actions, it can affect millions of agent-driven operations in minutes.

The new stack: Resilient identity meets distributed data

This is where Ory and Cockroach Labs intersect. Ory delivers the scaffolding of modern identity, composable, open-source, and architected for both human users and non-human identities. CockroachDB, meanwhile, brings the data layer that virtually survives anything: a distributed SQL engine designed to replicate, rebalance, and self-heal across continents.

For enterprise teams designing the next five to ten years of their architecture, this partnership defines a reference pattern:

• Ory as the control plane for identity and access: OpenID Connect, OAuth2, fine-grained authorization, and identity lifecycle for both humans and agents.
• CockroachDB as the resilient, strongly-consistent, globally-distributed data layer that ensures those identities, tokens, and policies are always available and correct, even under regional failures.

When OpenAI benchmarked potential identity solutions, this partnership rose to the top, not for theoretical performance, but for resilience under live conditions. Ory’s OAuth2 server (i.e. Ory Hydra), backed by CockroachDB, proved capable of scaling with OpenAI’s unprecedented growth while maintaining reliability across regions.

“All of their user interactions, authentication, authorization, policy enforcement, depend on this architecture,” says Kukowski. “That’s the story behind the scenes: a system that doesn’t just survive scale, but enables it.”

At a systems level, what this looks like is:

• Stateless identity services: Ory components that can be horizontally scaled, with CockroachDB providing a consistent, shared state for tokens, sessions, and consent across regions.
• Multi-region active-active: CockroachDB replicates identity and policy data with strong consistency guarantees, so an auth decision made in one region is valid and visible in another.
• Upgrade and failure tolerance: Rolling upgrades of both identity and database layers without global downtime, critical for platforms where AI agents are calling APIs 24/7.

The takeaway isn’t that OpenAI is exceptional. It’s that they’re early. The same scale pressure is coming for everyone. Whether it’s autonomous supply chains, agent-based customer service, or AI-driven cybersecurity, every enterprise will face the same question: can your infrastructure trust and be trusted, automatically, globally, and at speed?

The strategic decision shifts from “Which auth provider should we use?” to “What is our trust architecture for agentic systems, and will it still be viable when our traffic is 100x what it is today?”

Compliance at the speed of intelligence

The challenge isn’t just technical. As agents make decisions across borders, compliance becomes a distributed systems problem. Identity data can no longer live in a single region; it must move, replicate, and be enforced according to local and regional regulations.

CockroachDB’s geo-partitioning, what was once just a database feature, is now a compliance mechanism. Ory’s identity and access management (IAM), once a security function, is now a legal safeguard. Together, they enable a new class of architectures where trust boundaries can shift dynamically, allowing organizations to maintain sovereignty over their data while still operating globally.

Concretely, that means you can:

• Pin identity records and tokens to specific regions to satisfy data residency requirements (e.g., EU vs. US), while still supporting global read access where allowed.
• Enforce regional policies at the data layer, ensuring certain identities or attributes never leave defined jurisdictions.
• Model legal boundaries as technical constraints, rather than ad-hoc scripts, manual processes, or one-off deployments per region.

“Modern identity requires not just scale, but precision,” Kukowski explains. “It has to know who or what is acting, under what authority, and within what regulatory context, all in real time.”

That’s not something legacy systems can simply fake (it until you make it). The speed of AI doesn’t allow for batch jobs or nightly audits. Identity must evolve into an always-on, self-verifying nervous system, one capable of detecting anomalies, revoking access, and re-authorizing dynamically.

This reframes compliance from a cost center to a design constraint of the core architecture. The organizations that win will:

• Treat identity and data locality as first-class design dimensions, not edge cases.
• Instrument end-to-end observability for identity events, not just application logs.
• Automate access policy rollout and rollback globally, so regulatory or risk changes can be reflected in minutes, not quarters.

A new era of digital trust

Kimball has seen this kind of disruption before, first in databases, now in identity. “Every few decades, the assumptions that underpin computing collapse,” he says. “The organizations that adapt fast enough don’t just survive the shift, they define the next one.”

Kukowski agrees. “We’re not just solving for scale,” he says. “We’re solving for a new class of intelligence that demands security, resilience, and compliance, all at once.”

The partnership between Ory and Cockroach Labs isn’t a vendor alliance. It’s a blueprint for how infrastructure must evolve to keep pace with a world where artificial intelligence becomes the primary driver of scale.

That blueprint translates into a concrete agenda:

• Unify human and non-human identity under a single, consistent model that supports users, services, agents, and tools.
• Standardize on a globally-distributed, strongly-consistent data layer for identity and policy, rather than stitching together regional databases and caches.
• Design for failure and abuse cases: assume agents will misbehave, credentials will leak, and policies will need to be rolled back quickly—and build the mechanism before the incident.
• Keep control-plane functions open and auditable so that security, compliance, and platform teams can reason about and evolve the system over time.

The Bottom Line

In the age of agentic AI, scale is no longer a goal – it’s a given. What matters now is trust under acceleration, whether your systems can authenticate, authorize, and govern autonomously and safely on behalf of its human user, without breaking under the weight of exponential interaction, or compliance for that matter.

For technical business leaders, the key questions become:

• If traffic spiked 100x tomorrow from agents, which part of your trust stack breaks first?
• Can you explain, in detail, where your identities, tokens, and policies live—and which laws apply to them?
• How quickly can you revoke, rotate, or re-scope access globally if an agent or integration goes rogue?

The companies that understand this shift will be the ones that shape the next decade of enterprise technology. And if history is any guide, they’ll be running on the kind of architecture Ory and Cockroach Labs are already building today.

Because in the future of intelligent systems, resilience isn’t optional. It’s the only thing that scales.