A year and a half ago I wrote that MCP wasn't ready for the enterprise. I also said we could fix it!
A year and a half later, we did! The fix is Cross-App Access. Instead of every employee clicking through an OAuth prompt for every app they connect to their AI tools, the connection goes through the company's identity provider. The admin decides which apps can talk to each other, and users never see a consent screen. That's a lot less clicking, and the IT admin finally gets to see what's connected to what.
Back then it was a draft and a hypothetical example. Now it's shipping in over 100 places:
• 12 identity providers issuing ID-JAGs
• 18 authorization servers accepting ID-JAGs
• 11 clients, including Claude
• 34 apps and MCP servers, including Atlassian, Figma, Slack and Zoom
• 17 gateways
• 23 SDKs, libraries and test tools
This isn't one vendor's ecosystem. It's an open spec in the IETF OAuth working group, implemented independently by a lot of different companies. It's also the spec behind Enterprise-Managed Authorization in MCP.
The OAuth working group meets next week at IETF 127 in San Francisco, where we'll work through what's left to finish the draft. The IETF runs on "rough consensus and running code", and boy do we have plenty of running code!
Thanks to everyone who has built, tested and given feedback on this. If you've implemented it and you're not on the list, let me know and I'll add you.
https://oauth.net/cross-app-access/
WeChat ID
aaronpk_tv
