Frequently asked questions

No. You export a folder from the Workflows console and we analyse the file. There is no API token, no OAuth grant and no admin access at any point. Okta strips all connection credentials during export, so the file contains structure but no secrets. If you ask us to connect to your tenant, we will decline.

Okta Workflows stores the body of a loop, and the contents of an error handler, as separate flow objects embedded inside the parent flow. They execute in production and can be edited, but they do not appear in the console flow list. Across 125 public Okta template folders, recursive analysis finds 867 flows where the declared list shows 560.

No, for four reasons. Terraform only reports drift on resources it manages — anything created in the console is invisible to it unless imported. The Okta Terraform provider does not model Workflows at all; it covers users, groups, applications and policies, so flows are outside its reach entirely. Even where it does have coverage, it compares attribute values on objects rather than what an automation actually does. And a terraform plan you ran yourself is not independent evidence — it is undated, unsigned and produced by the party being assessed. The two are complementary: teams already running Terraform tend to understand the gap fastest.

The complete flow inventory, each flow rendered as readable code, a call graph of the estate, a robustness score across five dimensions, and control results with the reasoning behind each. It runs entirely in your browser — nothing is uploaded, no account is required and nothing is retained.

The reading is a snapshot for you. The attestation is evidence for someone else: dated, hashed against the exact bytes you supplied, with end-to-end operation traces, a prioritised improvement register, and a stated methodology including what could not be assessed and why.

No. Assay is independent and has no commercial relationship with Okta. Okta and Okta Workflows are trademarks of Okta, Inc., used for identification only. That independence is the point — a platform vendor cannot credibly certify its own configuration.

No, deliberately. Scoring an estate and then selling the fix for it would compromise the independence the attestation rests on. We refer remediation to implementation partners and re-attest afterwards, so the improvement is measured by someone with no stake in the outcome. Where a referral fee applies, it is disclosed in the attestation.

The free reading is immediate. A baseline attestation is typically delivered within five working days of receiving the export, faster for smaller estates.

Files supplied for a paid engagement are held only as long as needed to produce and support the attestation, then deleted. What we retain afterwards is the derived record — control results, counts, scores, the file hash and the date — with folder and connection names redacted. This is set out in full in our privacy policy.

Ownership and dormancy. The format carries no owner field, no enabled-or-disabled marker and no last-run timestamp. We report those controls as not assessed rather than passed. Ownership can be assessed if you supply a register alongside the export.

Today Assay covers Okta Workflows. The control library is platform-agnostic by design and further identity platforms follow once the first is proven in production. If you run a mixed estate, tell us what is in it — it shapes what we build next.

Yes. The browser tool needs no network connection once the page has loaded, and self-hosted deployment is available for partners who want it inside their own pipeline. Ask us about it.

Your band is set at the baseline and holds for the term. If the estate grows into a higher band, the new band applies at renewal rather than mid-term.