Assessment · the grade every build has to pass

One export in. A graded, signed answer out.

Your estate drawn, graded A to E and signed — with a fix plan Assay Studio can act on. Assay holds no Okta credential and never signs in to your org.

Draw your estate, free Open the live demo
Live demo · sample estate Ed25519 signed
C

68 / 100

118 open findings

A B C D E

One SSO application onboarding process: 8 workflows and the 41 blocks inside them.

How it works

Export a folder. Get the evidence.

1

Export your folders

In the Workflows console: Actions → Export. Folders are read together, so calls between them resolve.

2

Assay reads it

Your architecture drawn in about a minute; every flow assessed, including logic hidden inside cards.

3

You get the evidence

Your grade for free. A paid Assessment for every finding and a signed report. A Workspace keeps it current.

Okta removes connection credentials during export. Anything typed directly into a card stays in the file, and Assay checks for it.

The report

Know how it holds up, and why.

56 controls, 7 dimensions

The other 38 in the catalogue cannot be proved from an export; they are reported as not assessed, never passed.

A–E + 0–100

A risk grade set by counting open findings, not averaging, and a maintainability score.

Evidence per finding

Every finding names the flow, the card, and the fact in your file that produced it.

Fix plan to Studio

What to fix first and the effort. Send rows to Assay Studio, priced before anything is charged.

Click through the report, captured from the live demo’s sample estate.

Every screen in the live demo
The Overview of the sample estate: grade C, 68 out of 100, 118 open findings by severity

Overview. The grade, the score and the one sentence that explains where the estate landed, with every number opening the rows it counts.

Hand over evidence, not opinions. Signed with Ed25519 over the conclusions, not the PDF bytes. Anyone with the public key can verify it offline. PDF and HTML, with the full assessment as JSON and findings as CSV.

An export has no enabled marker and no owner field, so Assay reports what can reach a flow, not whether it runs, and ownership as not evidenced, never guessed. More in the FAQ.

Runs

See why a run failed, card by card.

Every card of a run Inputs and outputs, every loop item, the error on the card that stopped. Secrets are masked before anything leaves the browser.
Why it failed, and what to try first Failures grouped by cause — a rate limit, an expired connection, a missing user or group — with the first move.
Compared with the last run that worked Every value that differs from the last good run of the same flow is marked, with what it was then.
A failed run: why it failed, the cards side by side with their inputs and outputs compared with the last good run, and the card-by-card table
Run the estate day to day · Workspace and Enterprise Each one, with a picture
Changes Dry run Promote Compare orgs Run limits AI agents Campaign simulator Run alerts Search runs Table snapshots Deprecations Audit evidence Handover pack

Change control

Source control, approval and audit evidence for Okta Workflows.

Every change, card by card A version each time an export changes, and the difference between any two: flows added or removed, each card’s changed inputs, with Assay’s verdict on the change.
Reviewed before it is promoted A change request someone else decides. A pipeline can send each export and stop on the answer.
One pack for the auditor Which flows can change access, who reviewed them, what changed and who approved it, what ran, and what is missing. As a page and a PDF.
AI agents that ask before they change Okta An agent rehearses the Okta calls it intends to make; a person approves what needs it; the System Log is read back against the plan. Assay holds no Okta credential.
Access campaigns, tested on paper Who would review what, who has too much, who has nobody, and what is removed if nobody answers, before the campaign is launched at people.

Every feature, with a picture and its use cases →

A change request in Assay: two flows changed, the two cards that differ shown with the old and new value, Assay’s verdict, and the buttons to approve or reject

See it on your own estate.

Draw your architecture free in about a minute, or explore every screen in the live demo.

Draw your estate, free Open the live demo