In one WorkOS demo, an agent signs up with no form; consent and trust remain

When an AI agent signs up for your app, the signup form goes away. Two decisions remain. One is what the user agrees to share in a consent prompt. The other is what your app chooses to trust from the agent's provider. Isabelle Williams, a product manager at WorkOS, made this case on the AI Engineer show. She used a travel app she built, called Waypoint.

What was said

Williams began with the old problem. Email verification and form filling are where, she said, "if you know anything about product-led growth, you know this is where you lose your user."

Her answer is to let the agent's provider vouch for the person. First, the agent learns how to authenticate with the app. Then it asks the user for consent to share their name and email. Next, it gets a signed identity statement, called an ID-JAG, from its provider. The agent sends that to the app's authorization server.

The statement carries the user's name, email and whether the email is verified. It names the intended app and says how long it is valid. The app checks the provider's signature. After that, Williams said, "It's completely up to Waypoint if they want to create an account for this user." The app also picks which permissions to hand back.

In her live demo, a fresh user asked an agent to plan a conference itinerary. Other tools needed a browser signup or an API key. Waypoint accepted agents, so the agent asked for consent. A second prompt covered booking dinner. The account, the booking and a shareable itinerary followed with no further human action.

Why it matters

Our reading: the signup form was a place where teams could add friction and checks. Without it, that work moves elsewhere. Builders and buyers must now choose which agent providers to accept. They must choose which claims to rely on, such as a verified email. They must also decide how little access a new account gets at first.

Consent wording becomes part of the security design too. Williams showed a separate, more specific prompt for the dinner booking, not one blanket approval.

The other side

This was one speaker showing one app she built, with a clean demo user. The excerpts do not say what happens if a user approves a prompt without reading it. They also do not say how an app should respond if a provider's checks prove weak. Williams herself described the provider's check loosely, as verifying an email or something close to it.

She also argued that this approach needs open standards. She said that standards work is happening now.