WorkOS has published a map of NIST’s seven Zero Trust tenets onto the MCP request path, and its argument starts from the protocol itself. The 2026-07-28 revision of the Model Context Protocol removed sessions, so every request carries its own token and a server “can’t lean on ‘this connection was fine a minute ago.’” WorkOS reduces the job to five checks: give every agent its own verifiable identity, bind every token to one MCP server, authorize each tool call rather than the connection, never forward the token you received, and deny by default while asking a human before irreversible actions. The sharpest line is about shared credentials: “A key shared by many callers is not an identity.”
There are no vendor figures to discount here. This is an architecture guide, and most of it stands without WorkOS. The spec really does cover client identity, token binding and error signaling, and really does leave per-tool policy, upstream calls and audit to the implementer. Where the post becomes a pitch is in where it puts the answer: AuthKit Resource Indicators for audience binding, FGA for the per-record half of the “intersection rule” that gives an agent the overlap of its own and the user’s permissions. That is fair positioning, and the advice holds whichever authorization server you run.
The catalog lines up with most of the request path. WorkOS has 41 API pages, and the ones the guide walks are all there: the WorkOS Authorization API and WorkOS Permissions API for per-tool decisions, the WorkOS User Management.session Tokens API and WorkOS API Keys API for the credentials the guide says should be short-lived and per-caller, the WorkOS-connect API for registering agents, and the WorkOS Audit Logs API for the fifth check’s record of user, agent, tool, arguments and verdict. The agentic access profile is published.
The measurement shows where the guide is ahead of the surface. WorkOS holds a Kin Score of 58.7, strong, with discoverability at 68.3 and contract governance at 27.3. Agent Readiness is 59.4, agent-ready, and the identity dimensions this post is about are lit: delegated identity, protected resource metadata, auth clarity. So is dynamic client registration, the mechanism the post says the new spec deprecates in favour of Client ID Metadata Documents. The unlit ones are the fifth check. Reversibility is not documented, consent identity is unlit, there is no dry-run mode. WorkOS tells you to ask a human before an irreversible action, and its own contracts do not yet say which of its actions are irreversible.