Build a multi-user Claude Agent SDK app that acts as each of your users
Blog post from WorkOS
Multi-user AI agents can create serious cross-tenant security failures when developer-owned API tokens are shared through environment variables or tool configurations, allowing one user’s agent session to access another person’s Jira, Slack, or other connected services without obvious errors. The proposed design resolves the authenticated user server-side for every request, builds an in-process tool server per request, and captures that acting user in a closure rather than accepting a model-controlled user ID parameter. It uses WorkOS Pipes Relay to make provider API calls under each user’s delegated OAuth grant without exposing provider tokens to the agent runtime, while requiring organization-scoped sessions so successful actions can be audited. The approach also emphasizes narrowly scoped provider grants, removal of unnecessary built-in agent tools, explicit allowlists and permission modes, provider-specific response validation such as Slack’s HTTP 200 error responses, and audit events that identify the individual user, action, target, and agent run. Although this architecture limits impersonation and improves accountability, it does not prevent misuse within the permissions a user has granted, and it requires careful handling of relay limitations, provider revocation behavior, multi-site Jira configurations, and testing with a genuinely separate second user rather than relying on happy-path demonstrations.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.