Okta Workflows · assurance & documentation
Know exactly what your identity automation does.
Assay reads your Okta Workflows estate and writes it down — every flow as plain, readable logic, including the loop bodies and error handlers your console never lists. Scored, dated, and ready to hand to an auditor, a new engineer, or your successor.
Runs in your browser. No credentials, no upload, no account. Thirty seconds.
What it does
Your automation, written down at last.
Workflows are built visually, card by card, usually under deadline. Six months later nobody can say precisely what a flow does without opening it and tracing every branch by hand. Assay reads the structure and writes the logic out — conditions, loops, calls and API requests, following the chain from one flow into the next.
Read it like code, review it like code
Every flow becomes something an engineer can scan in seconds and a reviewer can reason about. Comment cards written by the original builder are surfaced rather than buried. Auto-generated cards are suppressed. Calls into other flows are expanded where they run, so an operation reads as one continuous program.
It is the documentation your team never had time to write, generated from the estate itself — so it cannot drift out of date the way a wiki page does.
The complete estate
Okta stores loop bodies and error handlers as separate flow objects inside the parent. They run in production but sit outside the console list. Across 125 public Okta template folders, recursive analysis finds 867 flows where the declared list shows 560.
How it all connects
A call graph showing which flow invokes which, which are entry points, and which are referenced by nothing at all. Change a helper flow knowing exactly what runs through it, and find the dead weight before you carry it into the next migration.
A clear picture of how it holds up
Where failures are handled, where access changes are guarded, what is traceable, what is still referenced, and which tables have a stated purpose. Five dimensions, each traced to a specific fact in your file rather than to a judgement call.
Evidence you can hand over
A dated, hashed attestation with a robustness score and a prioritised improvement register, written to answer an auditor asking how you know. Delivered as a document, and as structured data for your own systems.
The deliverable
Four views of the same estate.
All generated from one real folder export. The map is what the automation is — including the flows it calls, drawn inside it. The code is what it does. The report is where it stands. The register is what to do about it.
Robustness score, by dimension
Control results
flow add_users_from_a_table_to_an_okta_group(): rows = stash.searchRows2(sort_direction="asc", sort_limit=200, stash=table[…], …) for each item in rows, …: # ─── enter Get user Okta id and add to group ─── raw_output = okta.searchUsers(resultset="First Matching Record", query=email) # unguarded — flow stops here on failure if id != "": compose = compose(text="/api/v1/groups?search=profile.name eq "{{…", 3hugqyie0=groupname) status_code = okta.hTTPRequest(requesttype="GET", request_relative_url=compose) # unguarded — flow stops here on failure get = get(object=body, path="0.id") status2 = okta.addNewUserToGroup(group_id=get, user_id=id) # unguarded — flow stops here on failure join() else: return # ─── back ───
13 of 13 external calls stop the flow on failure. Workflows supports a single shared handler flow referenced from each card.
A rate limit or a transient error retries, or records itself, instead of leaving a change half-applied.
A governance write runs inside a loop set to ignore errors, so per-item failures disappear.
A partially applied change is reported as partial rather than as success.
10 of 27 flows have logging switched off, including flows on the grant path.
Every access change leaves a record an auditor can retrieve.
5 of 7 tables carry no stated purpose, and 5 flows are referenced by nothing.
A new engineer can tell what each table holds and which flows still matter.
Assay reports and does not remediate. These items are written so your team, your integrator or a third party can act on them — and so the next attestation can measure whether they were.
Who it’s for
Three people ask three different questions.
“What does this actually do?”
You inherited an estate. The person who built it has moved on.
- Every flow readable in minutes
- Dependency map before you change anything
- Dead and unreferenced flows identified
- Onboard an engineer in a day
“How do we know, and can we prove it?”
Audit season asks what automation can change access, and who signed it off.
- Privileged operations inventoried
- Dated, hashed evidence
- Independent — no vendor grading itself
- Drift measured between cycles
“Is what we built any good?”
You run automation across many tenants and need a consistent standard.
- Per-tenant pricing
- Same score across every client
- Hand clients a professional artefact
- Proof of quality at handover
Independence
A goldsmith cannot certify their own gold.
An assay office is the historic institution of independent verification: it tests the metal and strikes a hallmark, and the mark carries weight precisely because the seller did not issue it.
That is the basis of this company. A platform vendor can build excellent posture tooling — and it can never be independent evidence about itself. Assay has no commercial relationship with Okta, takes no position on whether a finding reflects well or badly on anyone, and does not sell the remediation for the problems it reports.
We also publish what we cannot tell you. The export format carries no owner field, no enabled-or-disabled marker and no last-run timestamp, so controls depending on those are reported as not assessed rather than passed. A green tick you cannot rely on is worth less than an honest gap.
Start with your own estate.
Run the free analysis on a folder export and see what is actually in there. If it is useful, the attestation is the next step — and the first five baselines are free in exchange for a conversation about the findings.