Isabelle Williams of WorkOS uses a travel-app demo to explain agent onboarding and authorization in this 19-minute AI Engineer talk.

Give agents a supported way in

  • Publish auth.md to explain registration, supported access flows and available operations.
  • Let an anonymous agent try a bounded set of actions, then let a person claim its work through a sign-in and code flow.
  • The application enforces access at its API; the Markdown file explains how to request it.

Connect an agent to a consenting customer

  • An ID-JAG is a signed identity assertion from the agent provider for a particular receiving service.
  • Ask the user before sharing identity, verify the assertion and let the receiving app decide account linking and token scopes.
  • Her custom agent demo creates a travel account, prepares an itinerary and makes a dinner reservation after consent.

Give the agent its own limited token

  • Effective permissions are the intersection of the user’s permissions and the agent’s configured access ceiling.
  • Preserve both the agent identity and the user it acts for, so actions remain attributable.
  • Revoke the agent without ending the user’s session.
  • In the funding demo, the agent reallocates available money but must wait for the human to increase the budget.

Caveat: this is a WorkOS product demonstration. Compatible providers, trust configuration and server-side enforcement are still required.

“Your app is completely in control of that.” — Isabelle Williams, 6:58