Blog

Internal AI moved from dashboards into Slack threads. That changes addressing, mandate, presence, and audience — questions that used to apply only to people.

Internal AI teams walk three stages: one hand-built agent, then several, then a governance problem. Stage three needs a substrate — you can't design it first.

The permission prompt breaks down once an agent works continuously. What replaces it is curation: a surplus of candidates, a queue, and a human who picks.

The WorkOS IT Contact API went live on August 18 out of a single Slack thread. Humans made the decisions and gated the merge; agents did everything else.

Six products, three layers of the same stack, and one vendor that sits in two of them. Catalog units, sync, the agent story, deployment, pricing, and when to pick each.

What the consent screen shows, why partial grants are normal, and how to model connection health.

One string, five spec conditions, and a different meaning at every provider. Here is what Google, Microsoft, Salesforce, Xero, QuickBooks, and Slack each mean by it.

Store the token yourself, fetch it at runtime, or never hold it at all. Where the credential ends up in each pattern, what each one costs, and how to pick without guessing.

Five installs before Slack reads your submission, a partner account before Microsoft trusts your consent screen, and identity verification before Atlassian lists you. None of it is code.

Storage architecture is the half you can finish. The refresh loop, key rotation, and revocation are the half that never does.

Anthropic's enterprise-managed auth for MCP connectors is now GA. What your authorization server has to support: JWT bearer, no DCR, per-tenant issuer trust.

Meet the agents our teams rely on day to day: what each one does, what it's connected to, and where it knows to stop.

What is actually portable, how to import password hashes without forcing a reset, and how to cut over with a rollback you can trust.

Better Auth 1.7 shipped DPoP, back-channel logout, and MCP alignment. Its own upgrade guide shows why the operational half of an OAuth provider costs more.

Support agents need to see what a user sees. Here is how to run impersonation on AuthKit and Audit Logs with scoping, short sessions, clean revocation, and dual-identity records.