In 2025, while many enterprises were still piloting AI coding assistants, Block rolled out AI agents across its then-12,000-person workforce in eight weeks, including marketing, finance, sales, and customer support teams. The fintech company behind Square and Cash App carried out a widely reported enterprise-scale AI agent rollout, offering practical lessons for organizations moving from experimentation to governed deployment. For companies building similar systems, an MCP Gateway governs data and tool connections, while an Agent Gateway adds agent identities, permissions, memory, and monitoring. Block built its own internal controls; MintMCP offers these capabilities as a managed platform.

Key Takeaways

• Block deployed Goose, the open-source AI agent originally developed by Block, across its then-12,000-person workforce in eight weeks by making it auto-install on company laptops through their internal software center
• A dual review process required engineering and security approval before an MCP server joined Block's internal allowlist, reducing the risk of unreviewed extensions while supporting tool growth
• Block later reported that production code shipped per engineer had increased by 40% since September 2025, alongside broader adoption of AI tools
• During a one-week Hack Week, engineers across Block built 60+ internal MCP servers; Block later reported that its internal catalog had grown to more than twice that total
• Model-agnostic design lets employees choose between Anthropic, OpenAI, Google, and Meta providers, accelerating adoption compared to forced standardization

The 8-Week Deployment That Changed Enterprise AI

Block's approach inverts the typical enterprise AI rollout. Most organizations pilot AI tools with a small engineering cohort, iterate for months, and slowly expand access. Block started from a different premise: remove friction entirely and let adoption happen organically.

The key decision was making Goose auto-install and auto-update on every company laptop through Block's internal software center. Employees never had to download anything, configure API keys, or touch a terminal. The agent appeared in their Applications folder, ready to use.

Deployment approach

The deployment sequence followed this pattern:

• Goose initially gained adoption among engineers before expanding across non-technical teams
• Block added Goose to its internal software center for automatic installation and updates
• Employees received access to preconfigured, approved MCP servers and multiple model providers
• An internal DevRel program supported adoption through workshops, office hours, and dedicated help and inspiration Slack channels

The "inspiration channel" proved critical. Employees shared wins publicly, showing colleagues what agents could accomplish. A sales analyst posted about redistributing 80,000 sales records in one hour instead of multiple days. Block's VP of Engineering described getting step-by-step guidance through an event-sponsorship procurement process. These organic success stories drove adoption faster than any training mandate could.

Security-First MCP Architecture

Block built its AI agent infrastructure on the Model Context Protocol, and the company was one of Anthropic's original MCP partners. But the raw protocol alone does not solve enterprise security requirements. Block needed a governance layer that would satisfy their security team while remaining invisible to end users.

The architecture addresses three core challenges that enterprise MCP deployments face:

Tool sprawl and shadow AI risk: Without governance, employees would connect agents to random GitHub MCP servers, creating unvetted data access paths. Block's solution requires all MCP servers to pass internal security review before employees can enable them. The agent only sees pre-approved tools.

Credential management at scale: Each MCP server connection requires authentication. At 12,000 employees and 100+ connectors, manual credential management becomes impossible. Block preconfigures approved MCP servers and integrates OAuth with its identity provider, allowing employees to enable available tools without manually editing configuration files or handling API keys.

Audit and security requirements: As a financial-services company, Block emphasizes approved MCP servers, identity-aware access, security review, and monitoring. Its public materials do not detail the complete audit schema, response-logging model, or retention policy.

For organizations building similar infrastructure, agent identity management becomes the foundation. Each agent needs its own scoped credentials that can be rotated independently, preventing the common anti-pattern where shared service accounts obscure audit attribution.

The Dual Security Review Process

Block's most replicable innovation is their dual-approval requirement for every new MCP server. Before any tool becomes available to employees, it must pass two independent reviews:

Engineering review is conducted by engineers familiar with MCP and sound engineering practices.

Security review is conducted separately by Block's security team before the server becomes available internally.

This process created initial friction. Teams wanting new capabilities faced a review bottleneck. Block addressed this through a one-week Hack Week where engineers across the company built 60+ internal MCP servers. The intensive sprint created a critical mass of approved tools, giving employees genuine utility while the ongoing review pipeline processed additional requests.

The pattern mirrors how mature organizations handle API access. You cannot query production databases without approval. You cannot deploy to production without code review. AI agents with system access deserve equivalent rigor. Organizations implementing security governance for agents can apply similar dual-gate models.

Dynamic Tool Management: Solving Context Window Bloat

Early in the deployment, Block encountered a problem that will sound familiar to anyone running agents at scale: tool overload. Employees enabled every available MCP server "just in case," filling agent context windows with tool descriptions for connectors they never actually used.

The symptoms appeared as degraded response quality and slower inference times. An agent with 100 tool definitions loaded cannot reason as effectively as one with only relevant tools active.

How dynamic tool management works

Block's solution implements dynamic tool management at the request level. When an employee submits a query, the system:

1. Analyzes the natural language request
2. Identifies which MCP servers are relevant
3. Enables only those servers for the current interaction
4. Disables irrelevant tools to preserve context window space

This happens transparently. Employees still see all 100+ tools in their settings, but any given query only loads the subset that matters. A sales analyst asking about CRM data does not need the GitHub connector loaded. An engineer debugging CI failures does not need the marketing analytics MCP.

The approach also addresses conversation-level context exhaustion. Long sessions accumulate context until the model struggles to reason effectively. Block implements automatic conversation summarization, compressing prior exchanges to preserve relevant context while freeing space for new information.

Non-Technical User Adoption: The DevRel Investment

Block's deployment would have stalled without dedicated investment in non-technical user success. Their internal DevRel team created what they call plain-language training, stripping all CLI references and technical jargon from onboarding materials.

Key enablement elements

• No terminal required: All configuration happens through graphical interfaces
• Model selection via dropdown: Employees choose between OpenAI, Anthropic, Google, and Meta without understanding the differences
• Tool enablement as toggles: Pre-configured MCP servers activate with a switch, no JSON editing
• Help channel with rapid response: Dedicated Slack channel staffed by DevRel team members
• Inspiration channel for wins: Employees post successful agent use cases, creating organic discovery

The inspiration channel surfaced unexpected use cases. A security analyst described using agents for fraud pattern detection through natural language queries against data warehouses. Previously, only SQL-proficient analysts could perform this work. The agent democratized access to fraud investigation capabilities.

One notable outcome: non-technical employees started building their own MCP servers. A user became a builder. This transition from consumer to creator indicates genuine tool mastery, not just passive adoption.

Organizations can complement gateway controls with Agent Monitor capabilities that provide visibility into supported local agent activity, including prompts, shell commands, file operations, and installed MCP tools.

Measurable Business Outcomes

Block tracks AI agent impact through concrete metrics rather than sentiment surveys:

• Engineering productivity: Block reported that production code shipped per engineer increased by 40% since September 2025. This is an engineering-output metric, not a company-wide employee productivity measure.
• Task completion time: Multi-day manual processes compress to hours. The sales record redistribution example saved an estimated three days of spreadsheet work. Goose also guided an executive through Block's procurement process by identifying the right people and next steps.
• SQL democratization: Employees without database-query skills can ask questions in natural language, reducing the need to write SQL directly. Block has not published a zero-error rate for agent-generated queries.
• Cross-functional tool building: During Hack Week, non-engineering teams proposed MCP servers for their workflows. This organic demand signals that agents have become core infrastructure rather than optional tooling.

Block has not disclosed a company-wide ROI figure. The reported productivity metric applies to production code shipped per engineer, so it cannot be extrapolated across all 12,000 employees or converted into an annual-return estimate.

Agent Identity Evolution: Cryptographic Principals in Buzz

Block's newer workspace platform, Buzz, is an open-source collaboration workspace for humans and AI agents. Buzz is self-hostable and built on Nostr, although Block describes the platform as early and still evolving.

Every action in Buzz is cryptographically signed, and agents receive their own keys and scoped authorizations. This creates a verifiable, portable history, but the records should not be described as inherently immutable because retention depends on the relay and deployment design.

What this enables

• Signed attribution: Cryptographic signatures let participants verify which identity produced an event
• Independent identity: Each agent has its own cryptographic keypair that belongs to the agent rather than the platform
• Configured permissions: Agents access connected systems according to the permissions the team configures
• Auditability: Cryptographic signatures strengthen attribution and verification, while retention and compliance controls still depend on the deployment

This model aligns with the agent gateway concept emerging in enterprise AI infrastructure. The control plane manages agent identities, permissions, memory, and monitoring as first-class concerns, not afterthoughts bolted onto existing systems.

Buzz runs on the Nostr protocol and is Apache 2.0 licensed, allowing other organizations to adopt similar cryptographic identity patterns for their agent deployments.

Lessons for Enterprise AI Teams

Block's deployment succeeded because they inverted common assumptions about enterprise AI rollout:

Start with governance, not agents: Block's public approach combines a curated MCP allowlist, OAuth and identity-provider integration, engineering review, security review, and dynamic tool selection. The agent's access is always a subset of an already-governed permission model.

Remove friction entirely, not incrementally: Auto-install eliminated the #1 adoption barrier. Employees did not evaluate whether to try AI agents. The agents were simply available, already configured, waiting to be used.

Enable choice rather than forcing standardization: Allowing model provider selection accelerated adoption. Different teams prefer different providers for different tasks. Marketing gravitates toward GPT for writing. Engineering prefers Claude for technical reasoning. Forcing one provider would have created resistance.

Invest in non-technical success: DevRel is not just for external developers. Internal developer relations ensuring non-technical employees succeed with AI tools proved essential for company-wide adoption.

Build for the security team, not around them: The dual review process seems slower than unrestricted access, but it reduced the risk of employees using unreviewed MCP extensions. Getting security buy-in early enabled faster sustainable growth.

Building Governed AI Agent Infrastructure with MintMCP

Block's rollout demonstrates that enterprise-scale AI agent adoption requires more than the agent framework itself. The underlying infrastructure for authentication, access control, tool approval, credential management, and monitoring determines whether a deployment succeeds or stalls.

Organizations building similar capabilities face a choice: build and operate internal governance infrastructure as Block did, or adopt a managed platform that provides these controls. MintMCP's platform combines two layers:

• MCP Gateway governs data and tool connections for the AI systems users already run, including Claude, Cursor, ChatGPT, Gemini, and Copilot. It handles SSO integration, role-based access control, tool-level policy enforcement, and credential abstraction, giving security teams visibility and control over which tools agents can access.
• Agent Gateway builds on that foundation to manage agent identities, permissions, memory, and monitoring for agents that work alongside users. This emerging category addresses the control requirements for coworker agents that hold memory, continue work across days, and operate as persistent members of teams.

The platform provides managed governance capabilities relevant to similar deployments, including identity-aware access, tool-level policy, credential management, hosted connectors, and audit logging. Organizations using MintMCP deploy with SOC 2 Type II audited infrastructure from day one, reducing the custom gateway engineering and security work required for a similar deployment.

For enterprises beginning AI agent deployments, Block's lessons apply regardless of infrastructure choice. Start with governance. Remove friction for users. Enable provider choice. Invest in non-technical success. And build with security, not around it. The difference between Block's approach and a managed platform is implementation time: MintMCP provides managed authentication and access control infrastructure without requiring teams to build the complete control layer internally.

Frequently Asked Questions

How did Block handle employees who were resistant to using AI agents?

Block deliberately avoided mandating AI agent usage. Their approach focused on removing friction and showcasing wins rather than requiring adoption. The inspiration Slack channel where employees shared successful use cases created organic interest. Employees who saw colleagues completing tasks faster naturally explored the tools themselves. The DevRel team answered questions without judgment, treating skepticism as a training opportunity. Within two months, usage became self-sustaining because employees genuinely found agents useful for their work.

What happens when an MCP server needs urgent security patching?

Block publicly documents automatic installation and updates for Goose, along with a curated allowlist of reviewed MCP servers. Its public materials do not detail the exact emergency patching, server-isolation, or organization-wide disable workflow, so those mechanisms should not be stated as established facts.

How does Block prevent agents from accessing data they should not see?

Block's public security guidance emphasizes preserving both user identity and software-actor identity, then applying bounded, least-privilege authorization at downstream services. The available sources do not confirm that every MCP server inherits the user's exact permissions or that Block's data warehouse integration is universally read-only. Each server passes security review evaluating data access scope before becoming available internally.

Can Block's approach work for organizations without dedicated AI engineering teams?

Block invested significant engineering resources in building their internal MCP server ecosystem and governance infrastructure. Organizations without similar capacity can adopt a managed MCP Gateway that provides hosted connectors, identity and access controls, tool-level policy, credential management, and audit logging. The key requirements are SSO integration for identity, group-based access control, tool-level policy enforcement, and comprehensive audit logging.

How does Block handle agents that need to take actions across multiple systems?

Block's Goose framework supports multi-step workflows where an agent coordinates actions across multiple MCP servers within a single interaction. Each step can invoke a different MCP server while Goose maintains context across the interaction. Block has not publicly described the centralized per-invocation audit format claimed here. Buzz adds signed agent identities and durable workspace context, but Block describes the platform as early, so it should not be presented as a mature component of the original Goose rollout.