Building AI agent access controls with intuitive, out-of-the-box security controls at Common Room
10-15
disparate data queries consolidated to Common Room secured by Auth0
3
months of development time saved by using Auth0 out-of-the-box features
100k+
ongoing clients registered securely at scale with Dynamic Client Registration
“With Auth0, MCP went from being something we'd experimented with internally to something that we could give to our customers.”
- Tom Kleinpeter, Co-founder and Chief Architect
Companies of all sizes across industries are searching for ways to connect and consolidate data to take actions more efficiently. Many of them are doing this in combination with agentic AI to minimize or eliminate time between steps. With Common Room, sales teams, marketers, and revenue operations teams have access to an AI-native platform that unifies internal data with external industry sources and other community forums. All of this data helps Common Room’s users build meaningful connections with their customers.
As these customers tie together Common Room’s solutions with their own through the Common Room MCP server, they can further combine data, compose emails, analyze information, and more, all in one place. Orchestrating and delivering this deeply automated experience requires an extensive network of applications and AI agents, including Common Room’s integrated RoomieAI. But giving these solutions free reign to communicate and act autonomously threatened to introduce potential risks as agents gained access to proprietary internal and customer data.
Designing a secure MCP infrastructure to deliver customer value
Common Room co-founders, Tom Kleinpeter and Viraj Mody, saw a need for a simple way to connect these users, agents, and systems securely. They had to emphasize Common Room’s enterprise-grade identity and governance for their MCP platform to maintain customer trust in a rapidly changing environment. Kleinpeter, both co-founder and chief architect, says: “One of the biggest things happening in the industry right now is that attackers continue to get stronger quickly. That means that anybody who’s protecting assets also needs to improve fast.”
In addition to bad actors changing tact and speed, internal teams are also developing and deploying faster than ever before. As a result, they are introducing bugs at an exponentially higher rate. Together, these shifts make improving security guardrails non-negotiable. Unfortunately, taking the time to build them in-house takes valuable time away from key product development projects. “We have to get security right. It’s a requirement, but If we have to spend time focusing on things like authentication, we can't build value or the solutions that our customers are looking for,” Kleinpeter adds.
Adopting agent-specific security measures to meet evolving threats
The team needed a secure, standardized way to link user identities across AI platforms to Common Room without diverting the engineering resources to build it from scratch. They found that Auth0 for AI Agents could provide an out-of-the-box solution that worked well with their existing infrastructure. “We knew about MCP within hours of the spec being released, but its early forms didn’t feel secure enough for us,” says Kleinpeter. “Seeing Auth0 implement the standards gave us confidence to ship this to our customers, so it made sense to lean on their expertise.”
By partnering with an established identity provider, the company could rely on Auth0’s developer-first approach to engineering with pre-built identity services, SDKs, and out-of-the-box flows, all in a single, unified identity layer across users, apps, and agents. “By giving us a solution we could just plug in and use, we could focus on our strengths instead of trying to read pages and pages of docs on security flows,” says Kirill Sapchuk, software engineer.
Unlocking AI feature launches with robust agentic authentication
With Auth0 helping support Common Room’s AI identity foundation, the team could refocus their efforts on launching new features and scaling for their customers. This rapid deployment also gave them a competitive edge as adopting Auth0 served as a catalyst for launching new AI capabilities. “With Auth0, our MCP server went from being something we'd experimented with internally to something that could give to our customers,” Kleinpeter shares.
Common Room could suddenly turn customer identity into a revenue-driving growth engine by allowing AI agents to securely execute high-value workflows across tenant boundaries and external systems. “The key to accelerating AI adoption for enterprises is enablement,” Sapchuk says. “You have to get approvals and reviews, and having a trusted partner in Auth0 has really been helpful in customer discussions because we can point them to the Auth0 docs to explain exactly how we’ll keep their data secure.”
The team is now using Auth0’s Dynamic Client Registration (DCR) to register more than 100k application clients automatically through API requests to registration endpoints to simplify access for users. To maintain security gates while enabling this speed and flexibility, the team paired this automation with Forms that prompt users to explicitly choose which RoomieAI "room" they need.
Once users are granted access, Common Room uses Auth0’s Custom Token Exchange to isolate the MCP layer and only allow tokens minted for the MCP to be used by it. By separating the MCP into its own sandbox environment, the team can define agents’ scopes, rate limits, access controls, and more separately from other tools. Embedding these enterprise-grade identity controls directly into the MCP platform allows Common Room to provide the strict trust and data oversight their customers require to fast-track AI adoption.
Powering an agentic future by setting strong identity standards
As Common Room continues to build on their MCP platform, they remain focused on expanding the capabilities of their AI agents. That growth will happen alongside building in finer access controls. To achieve this, the team intends to dive deeper into Auth0’s advanced authorization models. “With the full breadth of Auth0 features you can get very granular. For example, we can grant permission to create contacts but not organizations,” Sapchuk says. “We’re excited to leverage the breadth and depth of those features as we bring more users to the platform.”
Common Room also feels confident they’re positioned to continuously adapt as AI industry standards evolve because these security controls are built directly into their platform with Auth0. “One of the big reasons we chose Auth0 was that the space is changing. The MCP protocol itself is very new, and we want to make sure we stay at the very front of that without having to invest a lot of engineering time changing things, testing things, and making sure that they work. Our partnership with Auth0 handles that for us."
