October 2025 Summaries

Authorization is a critical feature for B2B SaaS applications that evolves with a company's growth, fundamentally reshaping technical architecture at each stage. Pavan Kulkarni, Engineering Manager at WorkOS, highlighted this during his talk at the Enterprise Ready Conference 2025, emphasizing the distinction between authentication and authorization and the latter's importance in enterprise trust and compliance. Using Figma as a case study, he illustrated the evolution of authorization systems, from primitive permissions to complex attribute-based access controls, demonstrating how these systems must adapt quickly as companies scale, especially with the rise of AI agents and AI-native features that introduce new complexities. WorkOS's solution, AuthKit, aims to simplify authorization management for rapidly growing companies by providing a flexible system that evolves with customer needs, avoiding the need for complete rewrites at each stage of development. Kulkarni's insights underline the necessity for B2B SaaS companies to prioritize authorization as a core component of their product strategy, accommodating the intricate access management requirements of enterprise clients.

SAML Request Signing and Response Encryption are critical elements in securing Single Sign-On (SSO) for enterprise applications by ensuring the authenticity, integrity, and confidentiality of identity data exchanged between Service Providers (SP) and Identity Providers (IdP). Request Signing employs public-key cryptography to verify that authentication requests are genuine and unaltered, even when traversing intermediaries such as proxies or load balancers. Response Encryption similarly uses cryptographic techniques to protect sensitive user data in SAML responses, ensuring only the intended SP can access it. These mechanisms are particularly vital in environments handling sensitive data or under regulatory scrutiny, providing protection against spoofing, tampering, and eavesdropping. Effective certificate management and key rotation are essential to maintaining these security measures, as they ensure the ongoing validity and synchronization of cryptographic keys. Implementing both Request Signing and Response Encryption in a SAML-based SSO flow fortifies security, aligning with modern enterprise requirements and compliance standards.

At the Enterprise Ready Conference 2025, Tobin South from WorkOS addressed the complex issue of managing identity for AI agents, emphasizing the challenges posed by their non-deterministic behavior and the inadequacy of traditional identity infrastructure. The session highlighted the Model Context Protocol (MCP) as a new standard interface for AI agents, which, while powerful, introduces security and monitoring challenges, especially concerning dynamic client registration and the unpredictable nature of AI agents. WorkOS's approach focuses on adapting existing identity systems to seamlessly integrate AI agents at an enterprise scale, supporting various identity models and ensuring robust authentication, authorization, and monitoring. By leveraging established identity systems like Microsoft Entra ID, Google's IAM, and Okta, WorkOS facilitates a "write once, work everywhere" strategy, allowing for agent provisioning and deprovisioning through SCIM extensions. Tobin's pragmatic message underscored the need for vendors to integrate with existing identity systems rather than creating entirely new paradigms, asserting that the infrastructure to manage AI agents effectively and securely is already available, built on proven enterprise identity systems.

The System for Cross-Domain Identity Management (SCIM) is a standard protocol that facilitates the automatic provisioning and deprovisioning of user accounts across a company's applications, and a new draft aims to extend this model to AI agents and their host applications. This draft proposes two new SCIM resource types, "Agents" and "Agentic Applications," to manage non-human identities like bots and automation workflows, leveraging SCIM's existing schemas and operational model. The extension addresses the growing need for standardized identity management of AI agents, which can now act independently in digital environments, by using the same trusted standards as human users. It introduces the concepts of "Agent" as a digital worker with its identifier, metadata, and privileges, and "Agentic Application" as the platform managing these agents. The draft suggests that these entities be integrated into identity platforms like WorkOS, allowing for automated lifecycle management, role assignment, app memberships, and accountability through ownership attributes. This move aims to ensure that AI-powered agents are managed with the same security, governance, and auditing standards as human users, emphasizing accountability, credential management, and clear app-agent boundaries while providing identity providers with a structured path to include digital workers in their systems.

WorkOS API Keys offers a streamlined solution for B2B applications needing reliable API access management, eliminating the complex and time-consuming task of building API authentication infrastructure from scratch. By providing a production-ready API key system, WorkOS addresses common security pitfalls and management challenges associated with DIY solutions, such as key storage, rotation, and permission modeling. The product integrates seamlessly with existing WorkOS infrastructure, using organization and permission data to create secure, fine-grained API keys. A customer-facing widget enables easy key management, while comprehensive APIs offer flexibility for custom workflows. Positioned as a cohesive addition to existing authentication and authorization setups, WorkOS API Keys aims to meet immediate needs while planning enhancements like user-scoped keys and advanced role-based access control features.

At the Enterprise Ready Conference 2025, a panel of industry experts refuted the idea that developer experience is becoming obsolete due to AI's ability to navigate APIs without the need for refined design and documentation. They argued that semantic clarity in APIs is crucial for AI systems to function effectively, as unclear abstractions hinder both human and machine understanding. The panel emphasized the importance of combining AI's strengths in dealing with fuzzy problems and platforms' capabilities in handling concrete tasks, using intuitive workflow primitives. They also highlighted the need for concise, information-dense documentation, warning against the risks of exposing complex operations to AI without proper safeguards. AI's impact on team dynamics was discussed, with a focus on maintaining accountability and active learning despite the shortcuts AI offers. Practical advice included starting with narrow applications of AI to solve specific problems and maintaining high standards for APIs, documentation, and security to ensure successful AI deployment. The panel concluded that success in AI integration requires discipline and foundational work rather than chasing every new AI feature.

The Enterprise Ready Conference 2025 featured a panel of CTOs from leading companies discussing the rapid transformation brought on by AI, emphasizing the need for responsible adoption, clear regulatory compliance, and brand protection. Enterprise clients are focused on robust guardrails to ensure AI agents interact with customers safely, highlighting AI's value in providing 24/7 support and improving customer experiences. While AI excels in structured tasks like customer support, it struggles with ambiguous tasks like sales discovery due to a lack of context. The panelists noted a shift in engineering roles, with CTOs demonstrating the potential of AI by automating tasks and proving rapid transformations, which has led to junior engineers advancing faster and more mobility across codebases. Product managers and interns are taking on more significant technical projects with AI's help, contributing to a shift in communication and documentation practices among engineering teams. As AI becomes a core product feature, companies must adapt to non-deterministic components, leading to a resurgence of forward deployed engineering to directly implement solutions for customers. The panelists advised founders to focus on delivering value to customers, as successful AI products require identifying the right human workflows to replace. The evolution of chatbots into effective tools underscores the broader shift towards AI agents interacting with products on a large scale, with companies prioritizing customer value, forward deployment, and preparation for exponential growth to define the next era of enterprise software.

When building a Model Context Protocol (MCP) server, developers face the challenge of authenticating users, as the MCP specification does not provide explicit guidance on this aspect. Three viable options are available depending on the level of control and expertise a team desires: building a custom OAuth server, using WorkOS as an OAuth bridge, or employing AuthKit for a fully hosted OAuth solution. The first option offers complete control but requires significant expertise in OAuth 2.0 implementation and maintenance. The second option allows teams with existing user databases to maintain user authentication while outsourcing token management to WorkOS. The third option is ideal for new MCP servers or those seeking a fully managed authentication solution, as AuthKit handles the entire OAuth flow. Each option offers a different balance between control, complexity, and ease of setup, allowing developers to choose based on their specific needs and resources.

At the 2025 Enterprise Ready Conference, Chris Kelly from Augment Code demonstrated a critical advancement in AI-assisted coding tools: the importance of context. Unlike traditional AI tools that excel in syntax but struggle with intent, Augment Code's "context engine" deeply indexes a codebase semantically, mapping relationships and patterns to provide relevant insights during programming tasks. This approach allows AI to act more like a seasoned engineer by referencing existing patterns, libraries, and utilities, thereby reducing code redundancy and enhancing code quality. In a live demo, Chris showcased how Augment’s system enriched a simple coding task by integrating existing resources, setting it apart from other AI tools that often operate in isolation. By focusing on understanding rather than mere completion, Augment Code aims to embed AI into the software development lifecycle, offering a CLI and extensions for VS Code and JetBrains IDEs to support large or regulated codebases, and redefining what makes code enterprise-ready.

At ERC 2025, Cosmo Wolfe, CTO and Co-Founder of Metronome, showcased the platform's approach to addressing complex billing requirements for enterprises, drawing parallels with WorkOS's focus on authentication infrastructure. Wolfe highlighted the evolution of billing from simple operations to intricate, real-time systems that support hybrid consumption models and enable real-time fraud detection and upsell workflows. Metronome's architecture treats billing like an observability platform, streaming raw product events to calculate invoices in real time, offering flexibility for handling complex contracts and scheduling discounts, as demonstrated through a live enterprise sales scenario. This approach underscores the necessity for adaptable billing infrastructure that can seamlessly transition from product-led growth to enterprise-level complexities, mirroring WorkOS's mission to provide scalable solutions for authentication challenges. Wolfe emphasized the importance of a unified billing platform that grows with a business, eliminating the need for multiple systems and enabling seamless adaptation to changing pricing models.

Drew Houston, the Founder and CEO of Dropbox, shared the journey of Dropbox's evolution from a consumer-focused product to a strategic enterprise tool during a discussion with Michael Grinich at the ERC 2025. Initially developed to solve Houston's personal issue of forgetting his thumb drive, Dropbox spread virally through a referral program, ultimately becoming indispensable in various work environments despite not being designed for enterprise use. The company's transition into the enterprise market was driven by organic adoption and the need for features like shared billing, which highlighted Dropbox's unique position in enterprise software. Houston's vision for Dropbox grew as he recognized the importance of integrating enterprise functionalities while maintaining a user-friendly experience, leading to exponential user growth and the development of essential enterprise features. As the company matured, Houston's focus shifted to addressing modern organizational challenges through AI, resulting in innovations like Dropbox Dash, which aims to streamline work processes by integrating various work tools into a universal search engine. Throughout his tenure, Houston has emphasized personal growth and staying technologically informed, which has been crucial in navigating industry changes and maintaining Dropbox's relevance. This commitment to innovation and problem-solving has evolved into a broader mission to design a more effective and fulfilling way of working, addressing the cognitive challenges faced by modern professionals.

At the Enterprise Ready Conference 2025, Jon Morehouse, co-founder and CEO of Nuon, addressed a significant challenge for modern SaaS companies: deploying applications into customer-controlled cloud environments while maintaining operational control. With the rise of AI, enterprises are increasingly demanding that applications run within their own cloud environments due to concerns over data privacy, compliance, and geographic data residency. The Bring Your Own Cloud (BYOC) model offers a solution, allowing customers to maintain control over their data and ensure business continuity even during third-party outages. However, implementing BYOC is technically challenging, as it requires packaging applications for installation in customer environments, managing updates, and troubleshooting without direct access. Nuon's platform addresses these challenges by providing a control plane that detects unauthorized changes in customer configurations, allowing vendors to remediate issues without needing direct access, and offering approval workflows for deployment changes. This approach facilitates a SaaS-like experience in customer-hosted environments, essential for companies catering to regulated industries or those requiring compliance with geographic data regulations. As BYOC becomes a necessity rather than a differentiator, platforms like Nuon aim to simplify the deployment process without increasing operational complexity for SaaS companies.

At the Enterprise Ready Conference 2025, Sentry's co-founder and CPO, David Cramer, showcased the company's innovative approach to software reliability, emphasizing a shift from merely detecting bugs to actively fixing them using AI. Sentry, already well-regarded for its error detection capabilities, is experimenting with large language models (LLMs) to analyze vast amounts of runtime data, providing concise root cause summaries and suggesting fixes. The system can now propose and even implement fixes by generating pull requests through external coding agents, marking a significant leap from error analysis to automated resolution. This development positions Sentry not just as a tool for identifying problems but as a pioneering system capable of automated remediation, enhancing its role in the developer workflow. Cramer's demonstration highlighted Sentry's commitment to evolving its platform with AI, reflecting a broader trend in enterprise software towards augmenting human capabilities with advanced technology.

The Enterprise Ready Conference 2025 panel, featuring industry leaders like Cristina Cordova, Quinn Slack, and Dani Grant, provided a candid examination of the challenges facing enterprise productivity tools, particularly those driven by AI. The discussion revealed that approximately 80% of users derive net negative value from agentic coding tools, highlighting a significant gap between AI's potential and its real-world application. The panel emphasized the need for a clearer definition of productivity, noting that many enterprises rely on vague "vibe-based" assessments rather than concrete metrics. They addressed the tension between quality and velocity, advocating for customer satisfaction and product-market fit over merely increasing PR volume. The conversation also explored diverse go-to-market strategies, from generous free tiers to hard paywalls, illustrating that success depends on context-specific approaches rather than a universal playbook. The panelists argued for a return to more supportive software models where vendors take responsibility for ensuring user success, warning that if AI tools continue to offer net negative value, enterprises will lose patience. Ultimately, the discussion underscored the importance of balancing rapid innovation with meaningful results, suggesting that the future belongs to those who can genuinely enhance enterprise productivity rather than just promise it.

The Enterprise Ready Conference 2025 highlighted key insights into the evolving intersection of AI and security, with a focus on whether companies are converging or diverging in their approach to securing AI systems and using AI to enhance security. A panel featuring experts from Opal Security, Socket, Formal, and RunReveal discussed the challenges of adapting traditional security principles to the rapid pace of AI operations, emphasizing the need for both AI for security and security for AI. They explored how AI can be utilized to address the unique risks it introduces, such as agentic worms and new attack surfaces, while maintaining fundamental practices like authentication and audit trails. The discussion underscored the importance of integrating AI into security practices and maintaining human oversight, as well as building a security culture within organizations. The panelists concluded that AI and security are becoming inseparable, requiring a recursive approach where AI systems help secure each other, monitored by AI tools that ensure operational integrity at unprecedented speeds.

The Enterprise Ready Conference 2025 focused on the concept of the "Enterprise Chasm," introduced by Michael, which highlights the gap between products with basic product-market fit and those that are truly enterprise-ready, capable of succeeding within large organizations. This concept emphasizes that achieving product-market fit is essential but insufficient for market domination without enterprise-specific capabilities such as compliance, IT integration, and security features. WorkOS showcased its suite of products designed to help companies bridge this chasm, including AuthKit for identity management, integrations with Stripe for billing, and WorkOS Pipes for seamless third-party integrations in AI applications. The conference also explored the evolving medium of AI, drawing parallels to historical shifts in media like film and music, and suggesting that while current AI tools are still in their nascent stages, they hold the potential to revolutionize how applications are built and used. Michael underscored the importance of building robust infrastructure to support this transition and invited attendees to join the journey of discovering how AI will reshape the enterprise landscape.

WorkOS is a modern API platform designed to help SaaS companies integrate essential enterprise features such as single sign-on, directory sync, audit logs, and role-based access control, enabling them to attract and retain enterprise customers. The platform supports well-known companies like OpenAI, Vercel, and Webflow, highlighting its effectiveness in bridging the gap between startups and enterprise-level clients. The company's culture emphasizes high standards, intentional growth, leadership by example, and empowering employees with autonomy and trust, fostering an environment where initiative and ownership are highly valued. WorkOS maintains a remote-first workforce across the US and Canada, utilizing tools like Slack and Zoom to ensure connectivity and transparency within its team. The company is committed to developer satisfaction, moving quickly without compromising quality, and maintaining transparency and collaboration, with a focus on building a company that prioritizes excellence and developer-centric products.

At the Enterprise Ready Conference 2025, Tobin South from WorkOS's AI Agents team showcased a demonstration highlighting the critical importance of identity and authentication infrastructure in AI-powered applications. The demo featured MCP.shop, an e-commerce platform utilizing ChatGPT's Apps SDK for a conversational shopping experience, underpinned by WorkOS AuthKit for enterprise-grade identity management. This demonstration emphasized that AI applications require robust identity and access control systems, similar to traditional applications, to ensure user authentication, authorization, audit trails, and session management. WorkOS's integration with OpenAI's Apps SDK exemplifies how developers can leverage existing identity infrastructure to focus on building unique AI functionalities without having to develop complex security protocols from scratch. This setup allows AI applications to meet enterprise security standards, addressing a significant challenge AI companies face in balancing rapid technological advancements with the need for solid infrastructure to gain enterprise trust and deployment.

Between October 20 and 21, WorkOS experienced significant service outages due to an initial AWS us-east-1 region failure and subsequent cascading outages at critical vendors. The first outage, from 06:50 to 09:20 UTC, severely impacted Single Sign-On and AuthKit services, while Directory Sync saw minimal disruptions. The root cause was traced to AWS database proxy failures which led to varying error rates across products. A second outage occurred from 18:55 UTC on October 20 to 01:50 UTC on October 21, primarily affecting AuthKit, Admin Portal, and the WorkOS Dashboard, due to a feature-flag provider incident compounded by issues with a hosting infrastructure provider. This led to long request latencies and intermittent timeouts, with 70% of requests failing at the peak of the incident. WorkOS identified flaws in their integration with the feature-flag provider's SDK, contributing to the issues. To mitigate future risks, WorkOS plans to enhance system resiliency by implementing timeouts, circuit breakers, fallback logic, and deploying services across multiple AWS regions, including a multi-region deployment of all services by Q1 2026.

Launched in preview in September 2025, the Model Context Protocol (MCP) Registry provides a centralized metadata catalog for MCP servers, aiming to reduce fragmentation within the ecosystem by allowing AI applications and tool clients to discover and connect to servers efficiently. It supports extension and federation, enabling organizations to create custom sub-registries while adhering to a consistent interface. The registry is built as an open catalog with an API backed by an OpenAPI specification, and it focuses on discovery rather than running or auditing the servers. It includes minimal validation to ensure reliability and offers extensibility for additional properties, such as tags and categorization. The registry's architecture promotes federation, allowing both public and private subregistries to augment or mirror the canonical public MCP server metadata provided by the upstream registry. While namespace and ownership verification are proposed features, the registry also emphasizes scalability and evolution, with plans for future enhancements, including integrity verification and package support, though these are not part of the current preview. Moderation is managed through a hybrid model of community oversight and automated systems, ensuring safety while maintaining openness.

AuthKit's localization process, which translated the tool into 90 languages in five weeks, exemplifies how modern developer tooling and large language models can streamline the translation and localization of digital products. Localization, which adapts digital experiences to align with users' cultural and linguistic preferences, is important beyond language translation as it includes adjustments for dates, numbers, and idioms. The approach taken by AuthKit involved extracting hard-coded strings from their React-based app and leveraging FormatJS for efficient translations. They used tools like negotiator for parsing language headers and implemented a system to generate and manage translation IDs automatically. A major aspect of their strategy was embracing a comprehensive list of user-preferred languages, guided by real user data from headers like accept-language. Developers incorporated a script that uses AI models, specifically Claude Sonnet 4, to automate translations, ensuring structured outputs and deterministic results. The process also included measures for runtime translations and testing across different languages using browser tools. Overall, AuthKit demonstrates how thoughtful design and cutting-edge technology can make localization feasible and scalable, even for complex applications.

Multi-Factor Authentication (MFA) is a critical security measure that provides an additional verification layer beyond passwords, utilizing methods like app notifications, codes, or biometrics. However, attackers have developed strategies such as MFA fatigue attacks, which exploit human behavior by overwhelming users with repeated authentication requests until one is mistakenly approved, granting unauthorized access. This form of social engineering begins with credential theft and involves persistent login attempts that bombard the victim with MFA prompts, leading to potential account compromise. To counteract these attacks, strategies like number matching for push notifications, limiting the frequency of notifications, context-aware authentication, and user education are recommended. Moreover, leveraging phishing-resistant MFA methods and implementing monitoring systems to detect suspicious patterns can enhance defense mechanisms. Despite its importance, MFA alone is not foolproof and must be combined with other security practices to effectively mitigate risks associated with human vulnerabilities.

As AI agents become increasingly capable and integrated into more systems through MCP servers, security, specifically authentication and authorization, becomes paramount. The guide details how MCP manages these security measures using OAuth 2.1, which is widely used across the modern web for securing APIs and login flows, and PKCE for secure authentication without secrets. It explains the architecture involving the host, client, and server, and emphasizes the importance of validating requests to ensure only authorized actions are taken. The guide also discusses the evolution from simple API keys to more robust OAuth-based strategies, highlighting the benefits of using scoped, time-limited tokens over static keys. It covers key components like Protected Resource Metadata and Authorization Server Metadata, which provide clients with necessary security configurations, and Dynamic Client Registration, which allows for scalable client-server interactions. Additionally, it elaborates on the validation of JWTs to ensure secure and authorized access, and the use of Role-Based Access Control (RBAC) to enforce access control by mapping roles to OAuth scopes. Throughout, it underscores the importance of a well-structured security framework that is both scalable and auditable, ensuring that AI-driven systems can operate securely and efficiently.

SAML certificates play a crucial role in ensuring secure communication between Identity Providers (IdPs) and Service Providers (SPs) by using X.509 certificates to facilitate authentication and data encryption. These certificates serve as digital keys that enable IdPs and SPs to verify the authenticity of messages and protect sensitive information. The two main types of SAML certificates are signing certificates, which validate the origin and integrity of SAML requests and responses, and encryption certificates, which ensure that only intended recipients can access sensitive data. Proper management of these certificates, including tracking expiration dates, automating metadata refresh, and maintaining secure storage of private keys, is essential to avoid common errors such as expired certificates or metadata mismatches that can disrupt Single Sign-On (SSO) functionality. While self-signed certificates are usually sufficient for SAML integrations, some organizations may require CA-signed certificates for compliance or security reasons. Platforms like WorkOS can help automate certificate management, reducing the risk of downtime and keeping SSO systems reliable and secure.

Modern teams often begin using Auth0 for authentication and identity management, but as products grow and require more enterprise-level features like B2B SSO and fine-grained organizational management, they may consider migrating to platforms like WorkOS. WorkOS offers a developer-friendly, enterprise-ready identity platform with features such as SSO support, user management, SCIM, MFA, access control, and organization management, along with predictable, scalable pricing. The migration process from Auth0 to WorkOS involves exporting and importing user data, organizations, SSO connections, and configuring additional features, with an emphasis on maintaining service continuity and minimizing disruption for end users. WorkOS provides comprehensive support and documentation to assist teams through each phase of the transition, ensuring a seamless shift to a more robust and flexible identity management system. The migration is not merely data transfer but an opportunity to enhance the identity system with enterprise-grade capabilities while addressing challenges like escalating costs and vendor lock-in associated with Auth0.