How it works
Three steps, and no access to your tenant.
Assay works from a file you export yourself. There is no API token, no OAuth grant and no admin role at any point — which is why a first engagement takes days rather than the two months a vendor security review usually adds.
Export a folder
In the Okta Workflows console, open a folder and choose Actions → Export. You get a
.folder file. Okta strips every connection credential during export, so the file
contains structure and no secrets.
Analyse it
Drop the file into the browser tool. It is parsed in your own tab — nothing is uploaded, no account is needed, nothing is retained. You see the full inventory, the generated code, the call graph and the score immediately.
Attest it
When you need evidence rather than a reading, we issue a dated, hashed attestation with the improvement register, and re-attest on a schedule so drift is measured rather than discovered.
What happens inside the analysis
Four passes over the export, each producing part of the deliverable.
Discovery
The whole file is walked recursively. Flows embedded inside loop bodies and error handlers are found and added to the inventory alongside the declared ones, with a note of where each was found.
Structure
Card addresses, execution edges, branch targets and the dataflow graph are parsed into an internal model. This is what makes the generated code an accurate reading rather than a guess.
Controls
Each control runs against that model deterministically. No machine judgement decides a result, so every finding can be explained by pointing at a specific fact in your file.
Rendering
The same model produces the plain-language descriptions, the diagrams, the end-to-end operation traces and the score — so all four always agree with one another.
What an attestation contains
Eight sections, in this order, every time. The format is versioned so a customer can compare one attestation against the next without wondering whether the report changed underneath them.
Executive summary
Estate size declared and actual, the control pass rate, and the three findings that matter most.
Flow inventory
Every flow with its cards, connectors and findings — including the block bodies the console does not list.
Estate map
Call graph, folder tree, entry points, and anything referenced by nothing at all.
Operation traces
Each business operation followed end to end, as a sequence diagram and as readable code.
Control results
Every control with its result, the evidence behind it, and a plain statement of what it checks.
Robustness score
Five weighted dimensions, each traced to a specific fact rather than a judgement call.
Improvement register
Prioritised items with effort estimates and the result of acting on each one.
Methodology
What was assessed, what could not be, and the SHA-256 of the exact file you supplied.
See it on your own estate.
The free reading takes thirty seconds and needs nothing but a file you already have.