# WorkOS Blog News about enterprise readiness from WorkOS. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How to tell agent traffic from user traffic DevFeed: [How to tell agent traffic from user traffic]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-16T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [JSON Web Tokens](), [audit trail](), [audit](), [Security](), [Authorization]() Tags: [agent](), [audit](), [audit-trail](), [auth](), [how-to](), [logs](), [security]() ### AI overview This tutorial explains how to distinguish agent traffic from user traffic in access and audit logs. It describes identifying agent tokens with a claim, separating the acting agent from the delegating user, and recording both identities so automated changes can be queried accurately. ### Source excerpt Your access logs probably say a person did something an agent did. Four claims fix that, and one of them exists for exactly this purpose. ## How to study for the MCPA security and governance domain DevFeed: [How to study for the MCPA security and governance domain]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-16T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [Security](), [Authorization](), [OAuth]() Tags: [agent](), [agentic](), [audit](), [authorization](), [model-context-protocol](), [oauth](), [security]() ### AI overview A study guide for the security and governance domain of the Model Context Protocol Associate exam. It explains trust boundaries, token audience validation, token handling between MCP servers and upstream APIs, and the distinction between consent and authorization. ### Source excerpt Security and governance is 24% of the new Model Context Protocol Associate exam. Here is what each competency actually covers in the 2026-07-28 spec, and the distinctions candidates get wrong. ## MCP went stateless: What changed in the 2026-07-28 spec DevFeed: [MCP went stateless: What changed in the 2026-07-28 spec]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [migration](), [HTTP](), [servers](), [client]() Tags: [api](), [client](), [http](), [load-balancer](), [mcp](), [replacement](), [request](), [routing](), [server](), [servers](), [sessions](), [stateless](), [stream]() ### AI overview The 2026-07-28 MCP specification removes protocol-level sessions, the initialize handshake, and stream resumability, making the protocol behave more like an ordinary HTTP API. Most migrations are mechanical, but lost stream requests can cause reliability regressions or duplicated side effects when retried, so side-effecting tools need application-level idempotency keys. The elicitation change also requires architectural rework. ### Source excerpt Sessions, the initialize handshake, and stream resumability are all gone. Here is what replaced them, and what breaks if you ignore it. ## How to test an AI agent policy before enforcing it DevFeed: [How to test an AI agent policy before enforcing it]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T22:03:24Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [AI Agent](), [Authorization](), [Testing](), [Access Control](), [Linear]() Tags: [access-control](), [ai-agent](), [authorization](), [how-to](), [testing]() ### AI overview This guide explains how to test authorization policies for AI agents before enforcing them. It presents reusable tests for role-based access control, task intent, organizational rules, and approval requirements, with checks against the connected service. ### Source excerpt Design and test AI agent policies that block unsafe actions and keep useful work moving. Learn to test intent, RBAC, and approvals, or try WorkOS Airlock. ## Who gets to define an AI agent's intent? DevFeed: [Who gets to define an AI agent's intent?]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T20:25:55Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [AI Agent](), [Artificial Intelligence]() Tags: [ai](), [ai-agent](), [identity](), [policy](), [scopes](), [tool](), [workflow]() ### AI overview The article explains how to define an AI agent's intent while preserving identity, resource-access controls, and company policy. It argues that the requester should specify the agent's purpose and intended effects, while the organization determines which actions are permitted. Using Airlock examples, it distinguishes task intent from policy decisions such as approval or denial of specific operations. ### Source excerpt An agent's task describes the work to do. Learn how to define useful intent while keeping identity, resource access, and company policy in force. ## From Atlas experiment to Airlock: extracting agent governance into a product DevFeed: [From Atlas experiment to Airlock: extracting agent governance into a product]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T15:35:36Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [Security](), [Artificial Intelligence](), [App](), [Linear](), [Slack]() Tags: [agent](), [ai](), [ai-agents](), [authorization](), [email](), [integrations](), [linear](), [permission](), [policy](), [product](), [security](), [slack]() ### AI overview The article explains how WorkOS's Airlock grew from the Atlas experiment into a standalone authorization product for governing AI-agent actions in company tools. A demonstration shows policies blocking emails containing financial information and requiring approval for unfamiliar distribution lists. ### Source excerpt Airlock grew out of Atlas to give IT and security teams a shared way to govern agent actions. Aaron Tainter's Agent Night demo shows how it works. ## Let coding agents review PRs without giving them unrestricted merge access DevFeed: [Let coding agents review PRs without giving them unrestricted merge access]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T15:29:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [AI-assisted coding](), [Code review](), [GitHub](), [Authorization](), [Pull Request](), [pull-requests]() Tags: [ai-code-review](), [authorization](), [code-review](), [coding-agents](), [github](), [reviews]() ### AI overview This guide explains how to let coding agents review GitHub pull requests without granting unrestricted merge access. It recommends separate review and merge credentials, explicit merge assignments governed by WorkOS Airlock, required checks and reviews, and reapproval when the reviewed commit changes. ### Source excerpt Set GitHub permissions for AI code review, govern merges with Airlock, and prevent agents from merging code that changed after approval. ## MCP authorization: governing tool calls beyond OAuth DevFeed: [MCP authorization: governing tool calls beyond OAuth]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T15:04:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Model Context Protocol](), [Authorization](), [MCP OAuth](), [MCP Server](), [OAuth]() Tags: [authorization](), [mcp](), [mcp-server](), [oauth](), [permissions](), [policy](), [scope](), [scopes]() ### AI overview This guide explains why OAuth scopes alone cannot govern the content and destination of MCP tool calls. It presents server- or gateway-side policy enforcement before execution, including request-content inspection, approval handling, and testing for data leakage. ### Source excerpt Secure MCP tool calls beyond OAuth scopes. Learn where to enforce tool permissions, check request content, and test for data leakage with Airlock. ## AI agent approval workflows: handling edits and retries DevFeed: [AI agent approval workflows: handling edits and retries]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T15:02:39Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [AI Agent](), [Authorization](), [Tool]() Tags: [agent](), [authorization](), [execution](), [how-to](), [retry](), [review](), [server](), [tool](), [workflows]() ### AI overview This guide explains how to add human approval to AI agent tool calls with WorkOS Airlock. It covers binding approval to an exact request, persisting the proposed action, resuming execution after approval, and recovering when a provider response is uncertain. ### Source excerpt Add human approval to AI agent tool calls. Learn how to review exact requests, resume execution, and handle edits and retries with Airlock. ## Agent session chains that can't escalate DevFeed: [Agent session chains that can't escalate]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [API](), [API keys](), [systems]() Tags: [agent](), [api](), [auth](), [authorization](), [backend](), [multi-agent](), [multi-agent-systems](), [permission](), [server](), [systems]() ### AI overview The article explains how Agent Auth session chaining lets an agent create separately scoped child sessions for subtasks. Each child records its parent, uses its own access and single-use refresh tokens, can be revoked independently, and cannot outlive the root session. The supplied text also states that the backend creates the chain server-side using an API key. ### Source excerpt An agent can open a child session of itself for a sub-task. The chain re-derives authority at every hop and can never outlive its root. ## Calling the WorkOS API from server-side Swift DevFeed: [Calling the WorkOS API from server-side Swift]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Swift](), [API](), [Back end](), [SDK](), [Vapor]() Tags: [api](), [async](), [backend](), [sdk](), [swift]() ### AI overview This article explains how to call the WorkOS API from trusted server-side Swift applications. It covers typed resource clients, structured errors, automatic retries for transient failures, and AsyncSequence-based pagination. ### Source excerpt Typed resources, structured errors, automatic retries, and AsyncSequence pagination for server-side Swift apps. ## What your agent sandbox can reach by default DevFeed: [What your agent sandbox can reach by default]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-15T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Network](), [Access Control](), [Claude Code](), [codex](), [Claude](), [ChatGPT]() Tags: [access-control](), [anthropic](), [llms](), [network](), [security]() ### AI overview This reference compares outbound network access defaults in Codex, ChatGPT Work, Claude Code, and other hosted agent environments. It examines what the documentation says before configuration and argues that egress allowlists provide a stronger boundary than detection filters. ### Source excerpt Codex, ChatGPT Work and Claude Code make five different choices about outbound network access. Here is what each one allows before you configure anything, what the docs publish, and where the boundary does not reach. ## How to answer the identity questions on an enterprise security questionnaire DevFeed: [How to answer the identity questions on an enterprise security questionnaire]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Security](), [Single sign-on (SSO)](), [Provisioning](), [OpenID connect (OIDC)](), [App]() Tags: [configuration](), [enterprise](), [how-to](), [identity](), [integration](), [oidc](), [okta](), [provisioning](), [saml](), [security](), [sign-in](), [sso]() ### AI overview A practical guide to answering identity-related questions in enterprise security questionnaires. It explains what reviewers are really assessing behind SAML single sign-on and SCIM provisioning questions, including implementation details such as per-organization configuration, certificate rotation, and reliable deprovisioning. ### Source excerpt Every line has a literal answer and a real question behind it. Here is what the buyer is actually checking, which answers you can buy, and the three you cannot fake. ## AuthKit vs Better Auth for B2B SaaS DevFeed: [AuthKit vs Better Auth for B2B SaaS]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: comparison Language: en Sources: [WorkOS Blog]() Topics: [Software as a service](), [Single sign-on (SSO)](), [Security](), [log management](), [threat detection](), [Frameworks](), [MFA](), [Passkeys]() Tags: [auth](), [comparison](), [enterprise](), [logs](), [mfa](), [saas](), [security](), [threat-detection](), [vercel]() ### AI overview This comparison examines AuthKit and Better Auth as platforms for B2B SaaS products selling to enterprise IT buyers. It argues that both now provide core capabilities such as SSO, SCIM, and audit logs, so the meaningful differences are provider coverage, where user lifecycle management begins, and contractual responsibility. The article also describes Better Auth's hosted infrastructure, dashboard, SIEM drain, self-service provisioning, and threat detection features, while noting its convergence with AuthKit on enterprise requirements. ### Source excerpt Both ship SSO, SCIM and audit logs now. The comparison that decides enterprise deals has moved to the long tail: provider coverage, where user lifecycle actually starts, and who is contractually on the hook. ## How WorkOS Vault's local encryption works DevFeed: [How WorkOS Vault's local encryption works]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Encryption](), [Cryptography](), [Security](), [data]() Tags: [cryptographic](), [data](), [encryption](), [pii](), [security](), [token]() ### AI overview The article explains how WorkOS Vault performs local encryption using envelope encryption. Each operation uses a single-use data encryption key, which is protected by a key encryption key stored in a hardware security module. Sensitive plaintext and ciphertext remain within the customer's infrastructure; only the wrapped key is sent to WorkOS. Key contexts automatically select or create isolated keys for organizations or tenants, with support for customer-managed keys and documented limits on context size and key counts. ### Source excerpt Envelope encryption, data keys, and why your sensitive data never has to leave your infrastructure ## How to add WorkOS AuthKit to a Ruby on Rails app DevFeed: [How to add WorkOS AuthKit to a Ruby on Rails app]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Rails](), [Authentication](), [Ruby](), [Command-line interface](), [Authorization](), [password reset]() Tags: [authentication](), [building](), [cli](), [how-to](), [password-reset](), [production](), [ruby](), [sign-in]() ### AI overview A tutorial on adding WorkOS AuthKit to a Ruby on Rails application. It explains how the CLI sets up the integration, how the sealed-cookie session layer is refreshed in a Rails before_action, and how Redirect URI, Initiate login URL, and Sign-out URI settings affect authentication flows and production logout. ### Source excerpt The CLI gets you signed in. This is the session layer underneath it: what the sealed cookie holds, how to refresh it inside a before_action, and the three dashboard settings that break logout in production. ## The hard part of an MCP gateway is auth DevFeed: [The hard part of an MCP gateway is auth]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-11T15:22:28Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [MCP Server](), [Authorization](), [Model Context Protocol](), [Artificial Intelligence]() Tags: [audit](), [auth](), [github](), [integration](), [mcp](), [mcp-gateway](), [mcp-server](), [salesforce](), [scopes](), [slack](), [warehouse]() ### AI overview The article examines Sierra's internal MCP gateway and argues that its most difficult challenges are authentication, identity, per-tool scopes, consent, and audit rather than MCP protocol design. It also discusses integration work and the lack of standardized gateway behavior. ### Source excerpt Sierra's MCP gateway iceberg is a field report on agent auth: identity, per-tool scopes, consent, and audit are the submerged mass, and they ship off the shelf. ## User Impersonation Can Trigger Analytics, Emails, Webhooks, and Background Jobs as the Wrong User DevFeed: [User Impersonation Can Trigger Analytics, Emails, Webhooks, and Background Jobs as the Wrong User]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-11T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [systems]() Tags: [analytics](), [authorization](), [automation](), [email](), [feature](), [feature-flags](), [notifications](), [support](), [webhooks]() ### AI overview The article explains that user impersonation is a session-level concern whose downstream effects can inherit the impersonated identity. It inventories risks including analytics, notifications, lifecycle email, chat activity, webhooks, feature flags, caches, and queued jobs, with examples of misleading user communications and unintended email automation. ### Source excerpt The side effects nobody documents: analytics, lifecycle email, feature flags, webhooks, and the background job that runs as the wrong person an hour later. ## How Neon made Postgres claimable for agents with auth.md DevFeed: [How Neon made Postgres claimable for agents with auth.md]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-10T14:21:50Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Database](), [Protocol (disambiguation)](), [API](), [OAuth]() Tags: [agents](), [api](), [auth](), [database](), [protocol]() ### AI overview Neon used auth.md to let agents provision bounded temporary Postgres projects before a human creates an account. People can later claim the projects into a Neon organization, while unclaimed projects expire. ### Source excerpt How Neon used auth.md to let agents provision bounded database projects before a human signs up, then later transfer them to people who want to keep them. ## OIDC is a standard, identity providers are not DevFeed: [OIDC is a standard, identity providers are not]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-09T16:09:50Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [interoperability](), [OAuth](), [JSON Web Tokens](), [Authentication]() Tags: [compatibility](), [interoperability](), [jwt](), [oauth](), [oidc](), [providers]() ### AI overview This article explains why generic OpenID Connect integrations often require provider-specific compatibility settings. It discusses differences in token-endpoint client authentication, including client secret basic, client secret POST, and private key JWT. ### Source excerpt Generic OIDC connections meet identity providers that read the same spec differently. Here are the per-connection compatibility settings we added, and why. ## SCIM directory sync: A deep dive into deprovisioning DevFeed: [SCIM directory sync: A deep dive into deprovisioning]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Protocol (disambiguation)](), [Security](), [Parser](), [Entra ID]() Tags: [audit](), [deep-dive](), [filter](), [protocol](), [provisioning](), [reconciliation](), [security]() ### AI overview This deep dive explains how SCIM directory deprovisioning reaches applications, why identity providers commonly deactivate users instead of deleting them, and how provider-specific payloads and missed events can create security risks. It covers normalization, reconciliation, session termination, and inspecting provider requests. ### Source excerpt What actually happens when a user is removed: the event your app receives, the directories that never send one, and how to catch what gets dropped. ## Inside the ID-JAG: How enterprise-managed authorization actually works DevFeed: [Inside the ID-JAG: How enterprise-managed authorization actually works]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Authorization](), [Model Context Protocol](), [JSON Web Tokens](), [OAuth]() Tags: [authorization](), [enterprise](), [jwt](), [mcp](), [mcp-server](), [oauth]() ### AI overview This tutorial explains how the Enterprise-Managed Authorization extension to MCP uses ID-JAGs--short-lived, signed JWT authorization grants--to let an identity provider authorize a client to access an MCP resource server. The authorization server exchanges the ID-JAG for an access token, replacing repeated user consent screens with centrally managed enterprise authorization. The article notes that the ID-JAG draft remains an active IETF document even though the MCP extension is marked Stable. ### Source excerpt The consent screen is no longer where access gets decided. Here is what replaced it, and what your MCP server now has to validate. ## How to Implement OIDC Back-Channel Logout DevFeed: [How to Implement OIDC Back-Channel Logout]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [JSON Web Tokens](), [App](), [Server]() Tags: [how-to](), [implement](), [jwt](), [oidc](), [server](), [sso](), [token](), [tokens]() ### AI overview This tutorial explains OIDC back-channel logout, including provider discovery, endpoint registration, form-encoded logout requests, and logout-token validation. It also describes how session-specific and user-wide logout work and notes limitations acknowledged by the specification. ### Source excerpt It is the one standard that can end a session your app already issued, it has been final since 2022, and almost nobody implements it. Here is the whole mechanism, the validation your endpoint owes, and the two limitations the spec admits to itself. ## How to add SSO to your B2B SaaS app with WorkOS AuthKit DevFeed: [How to add SSO to your B2B SaaS app with WorkOS AuthKit]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-07T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [Single sign-on (SSO)](), [Software as a service](), [Authentication](), [SDKs]() Tags: [asp-net](), [asp-net-core](), [authentication](), [b2b](), [claude](), [cli](), [codex](), [configuration](), [cursor](), [how-to](), [saas](), [sdk](), [sso]() ### AI overview A tutorial on adding SSO to a B2B SaaS application with WorkOS AuthKit. It explains that AuthKit handles SSO-specific SAML operations, while developers must design the organization model, configure who manages connections, account for existing users, and test failure cases. ### Source excerpt Enabling SSO is a dashboard toggle. The real work is the organization model, self-service configuration, and the traps that surface after your first enterprise customer. [Next page]()