Letting agents sign up depends on telling good agents from bad ones

Michael Grinich, founder and CEO of WorkOS, said on the AI Engineer show that it is very hard to tell good automated users from bad ones. He argued that the web's long-running bot defences now block agents too. In his view, agent signup needs a better way to let good agents in and keep bad ones out.

What was said

Grinich argued that agents are a new class of customer, yet signup assumes a human who reads the page, solves a CAPTCHA (a puzzle meant to prove you are not a bot) and copies an API key. For two or three decades, he said, the web treated automated traffic as bad. It built defences such as DDoS protection and guards against credential stuffing (attacks using stolen passwords). Agents now hit those walls too. Of the login box, he said: "Not intentionally, but just because of the legacy systems of what we built." He called the CAPTCHA "kind of dead". His proposal, auth.md, is an open spec built on existing standards. As he described it, the agent first looks for the service's auth.md file. It then creates a signed credential, called an ID-JAG, that represents its user. The service checks that credential, possibly through a separate channel, and runs a risk assessment. If satisfied, it returns a real API token. The service also sets limits. In the Cloudflare demo, a deploy was allowed for maybe 72 hours. Only registration changes. Normal APIs and MCP, a standard for connecting agents to tools, keep working.

Why it matters

Our reading: the human steps in a signup page also worked as a bot filter. Remove those steps and the screening has to move somewhere else. In Grinich's flow it moves to the service, which judges the signed credential and sets the limits. That makes the quality of the check, and how little a new agent gets at first, the heart of the matter. Grinich said strictness should vary. A database service might give away some traffic, while an email service might give nothing. Anyone running a product can ask what an unverified agent gets on day one. Buyers can ask vendors the same.

The other side

Grinich did not say the screening problem is solved. He framed it as a goal. The excerpts do not show how a service would judge an unknown agent at scale, or what happens when a bad one passes. The Cloudflare demo was a collaboration, and auth.md is a proposal, not a settled standard. He also argued that staying closed has a cost: if you do not build for agents, your product might not win.