n8n automations, LangChain agents, and customer-deployed GPTs are now API users — making requests on behalf of humans.

But typical SaaS auth still assumes that users log in via SSO or email/password or bots use long-lived API keys and then integrations that are static and admin-managed.

That model breaks when agents act on behalf of specific users/orgs (delegation), live outside your infra (external), behave unpredictably (volatility, surges), or shape UX directly (real-time APIs)

We wrote up how these patterns strain existing auth models and what a future-ready auth stack should support (scoped OAuth, PKCE, token lifecycles, etc.)