How to Let AI Agents Sign Up for Your App Safely — Isabelle Williams, WorkOS

Highlights

• WorkOS provides authentication infrastructure trusted by over 3,000 customers, including OpenAI, Anthropic, and Cursor.

• AuthMD operates as an open protocol using a hosted markdown file that informs AI agents how to discover endpoints and register accounts.

• IDJAG represents an IETF specification called Identity Assertion JWT Authorization Grant that securely passes verified user identity assertions from agent providers to applications.

• Scoped agent tokens restrict automated actions by enforcing permissions as the mathematical intersection between user privileges and a predefined agent blueprint ceiling.

• Dedicated agent tokens protect enterprise workflows by enabling granular auditing and immediate revocation without terminating the underlying user session.

Timeline

1. 00:00 - 03:50

   Agent Discovery and Onboarding Challenges

   Modern applications face a paradigm shift as personal agents handle product discovery and initial navigation. WorkOS provides authentication infrastructure for thousands of tech companies. Waypoint serves as a practical testing ground for implementing secure agent access workflows. AuthMD provides a standardized markdown file format that informs agents how to discover endpoints, create accounts, and call user APIs without human intervention.

   • Personal agents increasingly manage product discovery and initial user onboarding tasks on behalf of humans.
   • Waypoint functions as a travel planning application used to evaluate multi-agent authentication frameworks.
   • AuthMD uses a hosted markdown file to communicate API access mechanisms directly to automated AI agents.
2. 03:50 - 12:08

   Automated Account Creation Using IDJAG

   Traditional product-led growth funnels break when agents encounter manual sign-up forms and email verifications. IDJAG resolves this friction by allowing trusted agent providers to assert a user's verified identity securely. The application authorization server receives the signed JWT, validates the issuer public key, and decides whether to provision an account. This mechanism automates the entire onboarding loop while preserving application-level control over user provisioning.

   • Anonymous agent execution allows limited trial actions before requiring a verified user account linkage via one-time codes.
   • IDJAG acts as an IETF standard for cross-application identity sharing through cryptographically signed assertions.
   • Authorization servers verify agent-provided IDJAG signatures to automatically provision user accounts and issue scoped access tokens.
3. 12:08 - 18:25

   Granular Permission Enforcement and Agent Revocation

   Financial and compliance risks in enterprise settings demand strict limits on what automated agents can execute. Handing raw user tokens or API keys to agents creates severe security vulnerabilities. Instead, applications issue distinct agent tokens mapped to a permission ceiling blueprint. This design ensures that budget-rebalancing tools can operate within safe boundaries while preventing unauthorized changes to core approval rules or budgets.

   • Corporate applications require strict auditing and financial controls when granting automated agents access to company funds.
   • Agent tokens execute permissions determined by the intersection of user privileges and a predefined agent blueprint ceiling.
   • Revoking an agent token isolates security risks and halts automated operations without terminating the underlying user session.