Identity rebuild: buy WorkOS, ship internally.

What it was

The platform ran on two applications and two databases, each with its own copy of users, roles, and permissions. No one could say which system was the authority on who a person was or what they were allowed to see, so answering a simple access question meant checking both. Bringing in an outside team for stage one of a rebuild was estimated at three to four months.

Identity is a bad place to be inventive. It is a solved problem with a market of vendors who do nothing else, and every hour spent inventing our own version is an hour not spent on the product customers actually buy.

What I did

I locked four decisions before anyone wrote code.

• Buy, not build. WorkOS owns authentication. We own the record of who a person is inside our own database, so removing someone archives their history instead of orphaning it.
• No authorization engine in version one. Rewriting permissions at the same time as authentication doubles the blast radius. One authority for identity first, permissions second.
• SSO deferred until a customer asks for it. It carries an ongoing cost and ongoing maintenance, and we were not going to carry it ahead of the ask.
• Hard no on cross-tenant visibility. No company sees another company's data, with no convenience exceptions.

I delivered it in house instead. Production cutover ran on 2026-08-13 and 08-14: seven pull requests, including an auth layer touching 318 files. Before anything went near production I made sure every production database had long-term backup retention and a fresh export in hand, so the rollback path existed before it was needed.

Two days later I ran a cross-tenant read and write security sweep across production and shipped hardening from what it returned. On 08-18 the cross-app auth bridge went live, so both applications sign a person in once.

What it produced

One login, one authority on access, and a rollback path on every production database. The work landed in days, from inside the company. The scope also held, which is the part I care about: no authorization engine got built, and no single sign-on was built ahead of a customer asking for it. Both are written down as deferred, with the trigger that reopens them.

Back