Blog

We checked the roundups' claims against all three vendors' own pricing pages, using one test: can your customer's IT admin configure SSO and SCIM themselves, on the plan you already pay for?

Enabling SSO is a dashboard toggle. The real work is the organization model, self-service configuration, and the traps that surface after your first enterprise customer.

Okta, Auth0, and Descope all shipped Cross App Access between August 24 and September 1. The two-layer pattern underneath it outlasts whichever vendor wins.

Codex extra credits price out to exact API list rates, and we measured the credit lane 1.5x slower at quality we couldn't tell apart. Overflow to the API.

When the action succeeds and the log write fails, you get a gap that nothing alerts on. Here is the write path that closes it.

MCP authorization is the OAuth 2.1 flow that lets an AI agent call a protected MCP server on a user's behalf. Here is how it works, step by step, under the 2026-07-28 spec.

Delegated agent sessions are now capped by the user and the agent definition at once, which closes a gap we couldn't close a few months ago.

Go from no auth to a full hosted sign-in flow, either in one command or step by step.

Coding agents were built to guard a filesystem. The blast radius that matters now is in your CRM.

Service principals and CI/CD federation skip the access reviews that catch humans. The OIDC trust policy string is what actually decides who reaches production.

FusionAuth 1.69 adds an AI agent entity type and lifecycle webhooks. Whether that answers the question your auditors ask depends on whose events they are.

MCP standardized how an agent asks for more permission. It has no vocabulary yet for asking whether the human behind the token is still there.

Instagram now limits the reach of AI profiles that skip its AI-generated label. Non-human disclosure just became an enforced account attribute with penalties.

Okta's Agent SSO went GA on the Cross App Access standard. The IdP brokers the connection, but your app still has to validate the grant and issue the token.

How WorkOS engineers make agents babysitting agents safe: a headless surface to supervise through, scoped jobs, visible costs, and a human on the merge button.