# Step-up authentication for AI agents

DevFeed: [Step-up authentication for AI agents](<https://devfeed.tech/articles/step-up-authentication-for-ai-agents-16064.md>)

Original publisher: [Read original article](<https://workos.com/blog/step-up-authentication-ai-agents>)

Author: WorkOS

Published: 2026-08-17T00:00:00Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>), [MCP Server](<https://devfeed.tech/topics/mcp-server.md>), [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [security](<https://devfeed.tech/tags/security.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>)

## AI overview

This tutorial explains how to add step-up authentication to MCP servers used by AI agents. It proposes requiring human identity re-verification and approval for sensitive operations, with approvals bound to tool arguments and recorded in audit logs. It also notes that current MCP client support for RFC 9470 re-authorization is limited and that WorkOS Connect does not currently document the required freshness parameter.

## Source excerpt

Your MCP server hands an agent a token that stays valid for hours. Here is how to put a human back in the loop before it does something irreversible.