41554 blogs · [ { "id": "01a0d4cc-dd92-723d-b118-adfffe3574d6", "title": "One token, two jobs: ID-JAG in enterprise access and agent registration", "url": "https://workos.com/blog/one-token-two-jobs-id-jag-in-enterprise-access-and-agent-registration", "published_at": "2026-09-24T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-adfffee2a232", "title": "Deterministic rules and AI judgment: how Airlock governs agent actions", "url": "https://workos.com/blog/airlock-deterministic-rules-runtime-checks", "published_at": "2026-09-23T16:46:53+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-adffff7a88ce", "title": "What is WorkOS Airlock? Intent-based access control for AI agents", "url": "https://workos.com/blog/workos-airlock", "published_at": "2026-09-23T16:46:32+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0000532485", "title": "Delete the MCP servers and the agent is back to a long-lived key in a shell", "url": "https://workos.com/blog/mcp-removal-is-an-auth-regression", "published_at": "2026-09-23T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0000965622", "title": "Impersonation when your session is a bearer token", "url": "https://workos.com/blog/impersonation-bearer-token-sessions", "published_at": "2026-09-23T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae00014d7a1d", "title": "Four ways MCP authorization breaks in production", "url": "https://workos.com/blog/mcp-authorization-failures", "published_at": "2026-09-23T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0001a9962f", "title": "How to evaluate an AI agent pilot with Airlock", "url": "https://workos.com/blog/airlock-pilot-internal-ai-agents", "published_at": "2026-09-22T22:31:35+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0002127e3e", "title": "How do you authorize a voice AI agent when there's no screen?", "url": "https://workos.com/blog/voice-ai-agent-authorization", "published_at": "2026-09-22T14:02:24+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0002cecce0", "title": "Your access token is a snapshot, not a live query", "url": "https://workos.com/blog/access-token-claims-authorization", "published_at": "2026-09-22T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0003831051", "title": "On October 19, your unauthenticated GitLab automation gets 60 requests an hour", "url": "https://workos.com/blog/gitlab-rate-limits-authenticated-automation", "published_at": "2026-09-22T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0003bef417", "title": "Non-human identity governance: Where SCIM fits (and where it doesn't)", "url": "https://workos.com/blog/non-human-identity-governance-and-scim", "published_at": "2026-09-22T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae00043072e0", "title": "IBAC vs RBAC vs ABAC vs ReBAC: Which access control model fits AI agents?", "url": "https://workos.com/blog/ibac-vs-rbac-vs-abac-vs-rebac", "published_at": "2026-09-21T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0004dfbf53", "title": "Enterprise-Managed Authorization: Account linking with no user", "url": "https://workos.com/blog/ema-account-linking-subject-resolution", "published_at": "2026-09-21T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae000536ad05", "title": "AI agent credentials: Four architectures compared", "url": "https://workos.com/blog/agent-credential-architectures", "published_at": "2026-09-21T00:00:00+00:00" }, { "id": "01a0d7d4-cd55-7027-ac01-ccc64033a458", "title": "WorkOS: How SSO Works and the Fastest Way to Add It", "url": "https://workos.com/guide/the-developers-guide-to-sso?utm_source=daringfireball&utm_medium=newsletter&utm_campaign=q32026", "published_at": "2026-09-20T17:35:31+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0005eabe4b", "title": "Debugging with SCIM Logs", "url": "https://workos.com/blog/making-scim-debuggable", "published_at": "2026-09-18T18:09:09+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0006997361", "title": "Software engineering is getting a second material", "url": "https://workos.com/blog/software-engineering-second-material", "published_at": "2026-09-18T15:53:05+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0006e9e4c8", "title": "What an MCP server costs you in tokens", "url": "https://workos.com/blog/mcp-server-token-cost", "published_at": "2026-09-18T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae00075c33be", "title": "MCP went stateless: What changed in the 2026-07-28 spec", "url": "https://workos.com/blog/mcp-stateless-spec-2026-07-28", "published_at": "2026-09-16T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0007c05090", "title": "How to study for the MCPA security and governance domain", "url": "https://workos.com/blog/mcpa-certification-security-and-governance", "published_at": "2026-09-16T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0007e24c44", "title": "How to tell agent traffic from user traffic", "url": "https://workos.com/blog/identifying-agent-traffic", "published_at": "2026-09-16T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0008866c7e", "title": "How to test an AI agent policy before enforcing it", "url": "https://workos.com/blog/test-ai-agent-authorization-policies", "published_at": "2026-09-15T22:03:24+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae0009093d6d", "title": "Who gets to define an AI agent's intent?", "url": "https://workos.com/blog/define-ai-agent-intent", "published_at": "2026-09-15T20:25:55+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae00092f4318", "title": "From Atlas experiment to Airlock: extracting agent governance into a product", "url": "https://workos.com/blog/atlas-to-airlock-agent-governance", "published_at": "2026-09-15T15:35:36+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae000a11abe9", "title": "Let coding agents review PRs without giving them unrestricted merge access", "url": "https://workos.com/blog/ai-coding-agent-github-merge-policies", "published_at": "2026-09-15T15:29:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae000ae87fba", "title": "MCP authorization: governing tool calls beyond OAuth", "url": "https://workos.com/blog/mcp-authorization-airlock", "published_at": "2026-09-15T15:04:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae000b740cbb", "title": "AI agent approval workflows: an email example with Airlock", "url": "https://workos.com/blog/ai-agent-approval-policies-airlock", "published_at": "2026-09-15T15:02:39+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae000b7b1ae3", "title": "Agent session chains that can't escalate", "url": "https://workos.com/blog/agent-session-chaining", "published_at": "2026-09-15T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae000c3e81c6", "title": "Calling the WorkOS API from server-side Swift", "url": "https://workos.com/blog/calling-workos-api-server-side-swift", "published_at": "2026-09-15T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae000c4b3f94", "title": "What your agent sandbox can reach by default", "url": "https://workos.com/blog/agent-sandbox-egress-defaults", "published_at": "2026-09-15T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae000c641b86", "title": "How to answer the identity questions on an enterprise security questionnaire", "url": "https://workos.com/blog/enterprise-security-questionnaire-identity", "published_at": "2026-09-14T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae000cb2fe79", "title": "How WorkOS Vault's local encryption works", "url": "https://workos.com/blog/how-vault-local-encryption-works", "published_at": "2026-09-14T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae000ce61548", "title": "AuthKit vs Better Auth for B2B SaaS", "url": "https://workos.com/blog/authkit-vs-better-auth-b2b", "published_at": "2026-09-14T00:00:00+00:00" }, { "id": "01a0d4cc-dd92-723d-b118-ae000d907e1b", "title": "How to add WorkOS AuthKit to a Ruby on Rails app", "url": "https://workos.com/blog/add-authkit-to-rails", "published_at": "2026-09-14T00:00:00+00:00" }, { "id": "01a094b9-3c8b-70e1-b4e5-29cbd03dae5e", "title": "The hard part of an MCP gateway is auth", "url": "https://workos.com/blog/mcp-gateway-hard-part-is-auth", "published_at": "2026-09-11T15:22:28+00:00" }, { "id": "01a094b9-3c8b-70e1-b4e5-29cbd0a3d299", "title": "What else happens when you impersonate a user?", "url": "https://workos.com/blog/user-impersonation-side-effects", "published_at": "2026-09-11T00:00:00+00:00" }, { "id": "01a08c63-dc45-7392-bb6d-8c4d867f557d", "title": "How Neon made Postgres claimable for agents with auth.md", "url": "https://workos.com/blog/neon-claimable-postgres-auth-md-case-study", "published_at": "2026-09-10T14:21:50+00:00" }, { "id": "01a08c63-dc45-7392-bb6d-8c4d86cb6e9a", "title": "OIDC is a standard, identity providers are not", "url": "https://workos.com/blog/oidc-standard-identity-providers-are-not", "published_at": "2026-09-09T16:09:50+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb4260cf65d", "title": "Inside the ID-JAG: How enterprise-managed authorization actually works", "url": "https://workos.com/blog/mcp-enterprise-managed-authorization-id-jag", "published_at": "2026-09-08T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb426c51416", "title": "How to implement OIDC back-channel logout, and why almost nobody has", "url": "https://workos.com/blog/oidc-back-channel-logout", "published_at": "2026-09-08T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb4275173ae", "title": "SCIM directory sync: A deep dive into deprovisioning", "url": "https://workos.com/blog/scim-directory-sync-deprovisioning-deep-dive", "published_at": "2026-09-08T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb427f16e50", "title": "Auth0 vs Frontegg vs WorkOS: Who's actually enterprise ready in 2026?", "url": "https://workos.com/blog/workos-vs-auth0-vs-frontegg", "published_at": "2026-09-07T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb4283eaa3f", "title": "How to add SSO to your B2B SaaS app with WorkOS AuthKit", "url": "https://workos.com/blog/add-sso-b2b-saas-authkit", "published_at": "2026-09-07T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42931399b", "title": "Three identity vendors shipped the same agent access pattern in eight days", "url": "https://workos.com/blog/cross-app-access-converged-in-eight-days", "published_at": "2026-09-04T16:24:43+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42a2619ee", "title": "When your Codex allowance runs out, use an API key instead of credits", "url": "https://workos.com/blog/codex-allowance-runs-out-use-api-key-not-credits", "published_at": "2026-09-04T15:35:41+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42a5893df", "title": "When the action succeeds and the audit write doesn't", "url": "https://workos.com/blog/audit-log-write-reliability", "published_at": "2026-09-04T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42b250cdb", "title": "What is MCP authorization? How OAuth works for AI agents", "url": "https://workos.com/blog/what-is-mcp-authorization", "published_at": "2026-09-03T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42b7dc39a", "title": "Your AI agent shouldn't inherit your admin's permissions", "url": "https://workos.com/blog/scoping-ai-agent-permissions", "published_at": "2026-09-03T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42baf991c", "title": "How to add AuthKit to a Next.js app", "url": "https://workos.com/blog/add-authkit-to-a-nextjs-app", "published_at": "2026-09-02T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42c742fbb", "title": "Your agent's permission model stops at your home folder", "url": "https://workos.com/blog/agent-permissions-blast-radius", "published_at": "2026-09-02T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42d6ab5f7", "title": "Your most privileged identity has no login", "url": "https://workos.com/blog/workload-identity-trust-policies", "published_at": "2026-09-02T00:00:00+00:00" }, { "id": "01a0d4cc-dd93-70f5-9cdd-1db686af8b95", "title": "August Updates", "url": "https://workos.com/blog/august-2026-updates", "published_at": "2026-09-02T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42d85c4e1", "title": "Agents need identity, authorization, and audit in the same place", "url": "https://workos.com/blog/agent-identity-authorization-audit", "published_at": "2026-09-01T17:46:01+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42dd1fd1f", "title": "MCP: Scope step-up is not authentication step-up", "url": "https://workos.com/blog/mcp-scope-step-up-vs-authentication-step-up", "published_at": "2026-09-01T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42dd4f552", "title": "Instagram will now demote accounts that won't admit they aren't human", "url": "https://workos.com/blog/instagram-ai-generated-profile-label", "published_at": "2026-08-31T20:36:24+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42e82bbd6", "title": "Your app is the other half of agent SSO", "url": "https://workos.com/blog/agent-sso-resource-app-side", "published_at": "2026-08-31T20:22:53+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42f0bb755", "title": "Agents babysitting agents", "url": "https://workos.com/blog/agents-babysitting-agents", "published_at": "2026-08-31T18:26:02+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb42fa2c68e", "title": "Keeping credentials out of an AI agent's context with Relay", "url": "https://workos.com/blog/credentials-out-of-agent-context", "published_at": "2026-08-31T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb4301462e3", "title": "Refresh token behavior across fourteen providers", "url": "https://workos.com/blog/refresh-token-behavior-across-fourteen-providers", "published_at": "2026-08-31T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb430a2d12d", "title": "OAuth token refresh has a race condition. Fix it with a conditional write, not a distributed lock.", "url": "https://workos.com/blog/oauth-refresh-token-race-condition", "published_at": "2026-08-31T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb431096cba", "title": "How to run an internal-tools demo night that outside engineers actually show up to", "url": "https://workos.com/blog/internal-tools-demo-night-playbook", "published_at": "2026-08-28T12:52:51+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb4318e1e3b", "title": "WorkOS Pipes: Where your users' tokens actually live", "url": "https://workos.com/blog/workos-pipes-where-your-users-tokens-actually-live", "published_at": "2026-08-28T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43244fda5", "title": "How to verify WorkOS access tokens in your own API", "url": "https://workos.com/blog/verify-workos-access-tokens-in-your-own-api", "published_at": "2026-08-28T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43268963b", "title": "Every integration catalog is also a list of what you don't support", "url": "https://workos.com/blog/adding-a-custom-provider", "published_at": "2026-08-28T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb4334ee1a8", "title": "Putting an agent in a shared thread makes it a colleague", "url": "https://workos.com/blog/agents-in-shared-threads-social-contract", "published_at": "2026-08-27T15:16:58+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb433a65f72", "title": "You can't design the agent platform first", "url": "https://workos.com/blog/internal-ai-maturity-curve-agent-then-substrate", "published_at": "2026-08-27T14:51:36+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb434987e12", "title": "Curating queues beats approving actions", "url": "https://workos.com/blog/curating-queues-beats-approving-actions", "published_at": "2026-08-27T14:28:13+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb4353b7956", "title": "How we shipped a production API out of one Slack thread", "url": "https://workos.com/blog/shipping-a-production-api-from-one-slack-thread", "published_at": "2026-08-27T14:09:14+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb4362a9d5b", "title": "Pipes compared to Nango, Composio, Arcade, Paragon, and Merge", "url": "https://workos.com/blog/pipes-vs-nango-composio-arcade-paragon-and-merge", "published_at": "2026-08-27T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb436eaf7f3", "title": "Designing the connect flow your users actually see", "url": "https://workos.com/blog/oauth-connect-flow-ux", "published_at": "2026-08-27T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43718d294", "title": "What invalid_grant actually means, provider by provider", "url": "https://workos.com/blog/invalid-grant-oauth-errors-by-provider", "published_at": "2026-08-27T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb437bc8096", "title": "Three ways to let an AI agent call third-party APIs on behalf of a user", "url": "https://workos.com/blog/ai-agent-third-party-api-access-patterns", "published_at": "2026-08-27T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb438a7eecc", "title": "What shipping an OAuth app on Slack, Microsoft, and Atlassian actually takes", "url": "https://workos.com/blog/oauth-app-approval-slack-microsoft-atlassian", "published_at": "2026-08-27T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb439942605", "title": "Token isolation is the easy half of multi-tenant OAuth", "url": "https://workos.com/blog/multi-tenant-oauth-beyond-token-isolation", "published_at": "2026-08-27T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43a33cda1", "title": "Enterprise-managed auth is GA and your MCP server needs a new grant type", "url": "https://workos.com/blog/enterprise-managed-auth-ga-mcp-server-builders", "published_at": "2026-08-26T14:14:11+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43b0f391b", "title": "5 Atlas agents essential to how we operate at WorkOS", "url": "https://workos.com/blog/atlas-agents-at-workos", "published_at": "2026-08-26T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43b101c4d", "title": "How to migrate from a custom auth system to a third-party provider", "url": "https://workos.com/blog/migrate-custom-auth-to-third-party-provider", "published_at": "2026-08-26T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43bba4537", "title": "Running your own OAuth and OIDC provider in 2026 is an operations problem", "url": "https://workos.com/blog/problems-with-running-your-own-oauth-oidc-provider-2026", "published_at": "2026-08-25T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43bf7d188", "title": "How to let support agents act as a user without losing the audit trail", "url": "https://workos.com/blog/support-impersonation-delegated-sessions", "published_at": "2026-08-25T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43c520358", "title": "The person with the problem is now the person who builds the tool", "url": "https://workos.com/blog/person-with-the-problem-builds-the-tool", "published_at": "2026-08-24T14:42:28+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43cb08709", "title": "Why regex isn't email validation", "url": "https://workos.com/blog/why-regex-isnt-email-validation", "published_at": "2026-08-24T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43d6df641", "title": "Add sign-in to an Android app with the WorkOS Android SDK", "url": "https://workos.com/blog/sign-in-to-an-android-app-with-the-workos-android-sdk", "published_at": "2026-08-24T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43e0edd9b", "title": "Build a multi-user Claude Agent SDK app that acts as each of your users", "url": "https://workos.com/blog/build-multi-user-claude-agent-sdk-app", "published_at": "2026-08-24T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43ec1c32d", "title": "How to add enterprise SSO to an Express.js API", "url": "https://workos.com/blog/how-to-add-enterprise-sso-express-js-api", "published_at": "2026-08-21T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43ecd482a", "title": "Auth0 Enterprise Connect in beta vs. WorkOS for enterprise SSO and SCIM", "url": "https://workos.com/blog/auth0-enterprise-connect-vs-workos", "published_at": "2026-08-21T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb43f533da2", "title": "Session lifetime is a security control, not a UX setting", "url": "https://workos.com/blog/session-lifetime-security-control", "published_at": "2026-08-18T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb4404ce31c", "title": "How to store and refresh session tokens correctly with the WorkOS iOS SDK", "url": "https://workos.com/blog/ios-sdk-token-storage-refresh-guide", "published_at": "2026-08-18T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb441054a75", "title": "RFC 9470 explained: The OAuth step-up authentication challenge protocol", "url": "https://workos.com/blog/rfc-9470-step-up-authentication-challenge", "published_at": "2026-08-18T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb441dd4e79", "title": "Running the WorkOS API locally", "url": "https://workos.com/blog/running-the-workos-api-locally", "published_at": "2026-08-17T20:30:39+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb44251ea2d", "title": "What it's like to join WorkOS as a product designer", "url": "https://workos.com/blog/joining-workos-as-a-product-designer", "published_at": "2026-08-17T19:47:49+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb4433e7677", "title": "Agent Night demo recap: How Mastra turned its issue backlog into a software factory", "url": "https://workos.com/blog/agent-night-mastra-software-factory-demo-recap", "published_at": "2026-08-17T19:04:08+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb443488736", "title": "Agent Night demo recap: Evil Martians on making your docs discoverable to agents", "url": "https://workos.com/blog/agent-night-evil-martians-llm-discoverability-demo-recap", "published_at": "2026-08-17T19:04:06+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb443c04cf5", "title": "Agent Night recap: Airlock and intent-based access control", "url": "https://workos.com/blog/agent-night-recap-airlock-intent-based-access-control", "published_at": "2026-08-17T19:04:02+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb4440022d3", "title": "Agent Night panel recap: AGI arrived, or it's a skill issue", "url": "https://workos.com/blog/agent-night-panel-recap", "published_at": "2026-08-17T18:34:23+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb44439c3a9", "title": "Agent Night demo recap: exe.dev — your agent can rewrite the software you use", "url": "https://workos.com/blog/agent-night-exe-dev-demo-recap", "published_at": "2026-08-17T18:34:20+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb444fd40bf", "title": "Agent Night demo recap: Brian Douglas's self-healing Pokémon agent", "url": "https://workos.com/blog/agent-night-bdougie-self-healing-pokemon-demo-recap", "published_at": "2026-08-17T18:34:12+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb445fb5b60", "title": "Step-up authentication for AI agents", "url": "https://workos.com/blog/step-up-authentication-ai-agents", "published_at": "2026-08-17T00:00:00+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb44624ef57", "title": "Stop giving your coding agent a million-token context window", "url": "https://workos.com/blog/coding-agent-context-window-compaction-settings", "published_at": "2026-08-14T19:33:33+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb446c6d709", "title": "How to switch models in Claude Code with one command", "url": "https://workos.com/blog/claude-code-model-switching-gateway-wrapper", "published_at": "2026-08-14T14:04:26+00:00" }, { "id": "01a0821a-281d-71ac-8b41-3cb447b8fb2e", "title": "WorkOS Applied AI Showcase July 28 2026 - Moving to an AI-native Organization", "url": "https://workos.com/blog/applied-ai-showcase-nyc-recap", "published_at": "2026-08-14T13:36:57+00:00" } ] posts Claim your blog

Back to WorkOS Engineering

Blog · corpus.blog/blogs/workos.com/posts

WorkOS Engineering

workos.com

2026

One token, two jobs: ID-JAG in enterprise access and agent registration original ↗

24 Sept 2026

Deterministic rules and AI judgment: how Airlock governs agent actions original ↗

23 Sept 2026

What is WorkOS Airlock? Intent-based access control for AI agents original ↗

23 Sept 2026

Delete the MCP servers and the agent is back to a long-lived key in a shell original ↗

23 Sept 2026

Impersonation when your session is a bearer token original ↗

23 Sept 2026

Four ways MCP authorization breaks in production original ↗

23 Sept 2026

How to evaluate an AI agent pilot with Airlock original ↗

22 Sept 2026

How do you authorize a voice AI agent when there's no screen?original ↗

22 Sept 2026

Your access token is a snapshot, not a live query original ↗

22 Sept 2026

On October 19, your unauthenticated GitLab automation gets 60 requests an hour original ↗

22 Sept 2026

Non-human identity governance: Where SCIM fits (and where it doesn't)original ↗

22 Sept 2026

IBAC vs RBAC vs ABAC vs ReBAC: Which access control model fits AI agents?original ↗

21 Sept 2026

Enterprise-Managed Authorization: Account linking with no user original ↗

21 Sept 2026

AI agent credentials: Four architectures compared original ↗

21 Sept 2026

WorkOS: How SSO Works and the Fastest Way to Add It original ↗

20 Sept 2026

Debugging with SCIM Logs original ↗

18 Sept 2026

Software engineering is getting a second material original ↗

18 Sept 2026

What an MCP server costs you in tokens original ↗

18 Sept 2026

MCP went stateless: What changed in the 2026-07-28 spec original ↗

16 Sept 2026

How to study for the MCPA security and governance domain original ↗

16 Sept 2026

How to tell agent traffic from user traffic original ↗

16 Sept 2026

How to test an AI agent policy before enforcing it original ↗

15 Sept 2026

Who gets to define an AI agent's intent?original ↗

15 Sept 2026

From Atlas experiment to Airlock: extracting agent governance into a product original ↗

15 Sept 2026

Let coding agents review PRs without giving them unrestricted merge access original ↗

15 Sept 2026

MCP authorization: governing tool calls beyond OAuth original ↗

15 Sept 2026

AI agent approval workflows: an email example with Airlock original ↗

15 Sept 2026

Agent session chains that can't escalate original ↗

15 Sept 2026

Calling the WorkOS API from server-side Swift original ↗

15 Sept 2026

What your agent sandbox can reach by default original ↗

15 Sept 2026

How to answer the identity questions on an enterprise security questionnaire original ↗

14 Sept 2026

How WorkOS Vault's local encryption works original ↗

14 Sept 2026

AuthKit vs Better Auth for B2B SaaS original ↗

14 Sept 2026

How to add WorkOS AuthKit to a Ruby on Rails app original ↗

14 Sept 2026

The hard part of an MCP gateway is auth original ↗

11 Sept 2026

What else happens when you impersonate a user?original ↗

11 Sept 2026

How Neon made Postgres claimable for agents with auth.md original ↗

10 Sept 2026

OIDC is a standard, identity providers are not original ↗

9 Sept 2026

Inside the ID-JAG: How enterprise-managed authorization actually works original ↗

8 Sept 2026

How to implement OIDC back-channel logout, and why almost nobody has original ↗

8 Sept 2026

SCIM directory sync: A deep dive into deprovisioning original ↗

8 Sept 2026

Auth0 vs Frontegg vs WorkOS: Who's actually enterprise ready in 2026?original ↗

7 Sept 2026

How to add SSO to your B2B SaaS app with WorkOS AuthKit original ↗

7 Sept 2026

Three identity vendors shipped the same agent access pattern in eight days original ↗

4 Sept 2026

When your Codex allowance runs out, use an API key instead of credits original ↗

4 Sept 2026

When the action succeeds and the audit write doesn't original ↗

4 Sept 2026

What is MCP authorization? How OAuth works for AI agents original ↗

3 Sept 2026

Your AI agent shouldn't inherit your admin's permissions original ↗

3 Sept 2026

How to add AuthKit to a Next.js app original ↗

2 Sept 2026

Your agent's permission model stops at your home folder original ↗

2 Sept 2026

Your most privileged identity has no login original ↗

2 Sept 2026

August Updates original ↗

2 Sept 2026

Agents need identity, authorization, and audit in the same place original ↗

1 Sept 2026

MCP: Scope step-up is not authentication step-up original ↗

1 Sept 2026

Instagram will now demote accounts that won't admit they aren't human original ↗

31 Aug 2026

Your app is the other half of agent SSO original ↗

31 Aug 2026

Agents babysitting agents original ↗

31 Aug 2026

Keeping credentials out of an AI agent's context with Relay original ↗

31 Aug 2026

Refresh token behavior across fourteen providers original ↗

31 Aug 2026

OAuth token refresh has a race condition. Fix it with a conditional write, not a distributed lock.original ↗

31 Aug 2026

How to run an internal-tools demo night that outside engineers actually show up to original ↗

28 Aug 2026

WorkOS Pipes: Where your users' tokens actually live original ↗

28 Aug 2026

How to verify WorkOS access tokens in your own API original ↗

28 Aug 2026

Every integration catalog is also a list of what you don't support original ↗

28 Aug 2026

Putting an agent in a shared thread makes it a colleague original ↗

27 Aug 2026

You can't design the agent platform first original ↗

27 Aug 2026

Curating queues beats approving actions original ↗

27 Aug 2026

How we shipped a production API out of one Slack thread original ↗

27 Aug 2026

Pipes compared to Nango, Composio, Arcade, Paragon, and Merge original ↗

27 Aug 2026

Designing the connect flow your users actually see original ↗

27 Aug 2026

What invalid_grant actually means, provider by provider original ↗

27 Aug 2026

Three ways to let an AI agent call third-party APIs on behalf of a user original ↗

27 Aug 2026

What shipping an OAuth app on Slack, Microsoft, and Atlassian actually takes original ↗

27 Aug 2026

Token isolation is the easy half of multi-tenant OAuth original ↗

27 Aug 2026

Enterprise-managed auth is GA and your MCP server needs a new grant type original ↗

26 Aug 2026

5 Atlas agents essential to how we operate at WorkOS original ↗

26 Aug 2026

How to migrate from a custom auth system to a third-party provider original ↗

26 Aug 2026

Running your own OAuth and OIDC provider in 2026 is an operations problem original ↗

25 Aug 2026

How to let support agents act as a user without losing the audit trail original ↗

25 Aug 2026

The person with the problem is now the person who builds the tool original ↗

24 Aug 2026

Why regex isn't email validation original ↗

24 Aug 2026

Add sign-in to an Android app with the WorkOS Android SDK original ↗

24 Aug 2026

Build a multi-user Claude Agent SDK app that acts as each of your users original ↗

24 Aug 2026

How to add enterprise SSO to an Express.js API original ↗

21 Aug 2026

Auth0 Enterprise Connect in beta vs. WorkOS for enterprise SSO and SCIM original ↗

21 Aug 2026

Session lifetime is a security control, not a UX setting original ↗

18 Aug 2026

How to store and refresh session tokens correctly with the WorkOS iOS SDK original ↗

18 Aug 2026

RFC 9470 explained: The OAuth step-up authentication challenge protocol original ↗

18 Aug 2026

Running the WorkOS API locally original ↗

17 Aug 2026

What it's like to join WorkOS as a product designer original ↗

17 Aug 2026

Agent Night demo recap: How Mastra turned its issue backlog into a software factory original ↗

17 Aug 2026

Agent Night demo recap: Evil Martians on making your docs discoverable to agents original ↗

17 Aug 2026

Agent Night recap: Airlock and intent-based access control original ↗

17 Aug 2026

Agent Night panel recap: AGI arrived, or it's a skill issue original ↗

17 Aug 2026

Agent Night demo recap: exe.dev — your agent can rewrite the software you use original ↗

17 Aug 2026

Agent Night demo recap: Brian Douglas's self-healing Pokémon agent original ↗

17 Aug 2026

Step-up authentication for AI agents original ↗

17 Aug 2026

Stop giving your coding agent a million-token context window original ↗

14 Aug 2026

How to switch models in Claude Code with one command original ↗

14 Aug 2026

WorkOS Applied AI Showcase July 28 2026 - Moving to an AI-native Organization original ↗

14 Aug 2026