Atomation is built around disclosed access boundaries, tenant-bound request context, deterministic findings, point-in-time report output, and controlled summary generation.
The page should make the access boundary, evidence boundary, and report boundary clear before a customer connects Okta.
A temporary Super Admin SSWS token inherits full privileges while active, configures the permanent app with Super Administrator and the approved 32 grants, and must be revoked before setup succeeds. Routine scan tokens request only the 31 reads and do not auto-remediate.
Applies to assessment setup, point-in-time data processing, finding output, and report delivery.
Findings are produced by versioned checks against captured point-in-time evidence. Current report paths are deterministic; narrative context never determines whether a finding exists.
Applies to assessment setup, point-in-time data processing, finding output, and report delivery.
Current finding and report paths are deterministic and do not require an external AI service. Customer identity data is not sent to third-party AI services for report generation.
Applies to assessment setup, point-in-time data processing, finding output, and report delivery.
Portal requests carry workspace and role context, and customer-facing routes are intended to remain tenant-bound. This claim does not imply a completed independent isolation audit or that every internal query has been separately proven.
Applies to assessment setup, point-in-time data processing, finding output, and report delivery.
Security controls are being designed with third-party assurance expectations in mind, but Atomation does not claim certifications, authorizations, endorsements, or partner statuses it does not hold.
Applies to assessment setup, point-in-time data processing, finding output, and report delivery.
Remediation is a separate approved service path with separate scope and controls.
Okta API Services app configured for assessment evidence and connector grant maintenance.
Setup configures the Atomation connector app; runtime scans do not change users, groups, policies, apps, or settings.
Deterministic checks decide findings; summaries explain output.
Reports are generated from a point-in-time assessment record. The current portal exports PDF and Markdown reports; supported inventory views export CSV.
The Okta connection is the entire attack surface of an assessment tool, so ours is deliberately narrow and independently checkable from your own Okta admin console.
Okta API Services app using OAuth 2.0 client credentials — no user login flow, no browser extension, no agent in your environment.
private_key_jwt with an asymmetric key pair. No shared client secret exists to leak or rotate.
DPoP (demonstrating proof of possession) is enabled by default, so access tokens are sender-constrained and resistant to token theft and replay.
Current guided setup assigns Super Administrator to the permanent service app for complete assessment visibility. Okta evaluates both requested scopes and the assigned admin role.
Routine scan tokens request 31 assessment read scopes. The app also holds okta.appGrants.manage, an org-level grant-management scope that Atomation excludes from scans and reserves for a future reviewed workflow targeting the configured connector app.
The engine audits its own service app on every scan and raises a finding if the connection drifts beyond the approved assessment and connector-maintenance grant list.
Atomation is hosted. Customer-facing requests carry workspace and role context, but this page does not claim that every internal query or every operator access path has completed independent isolation testing. Traffic uses TLS; stored connector private keys and supported connector secrets use AES-256-GCM encryption at rest.
Point-in-time captures of observed Okta configuration such as policies, apps, groups, zones, and authenticators. Atomation does not claim cryptographic immutability.
Assessment evidence uses login, email, and Okta ID where a finding needs an account reference. Portal SSO and SCIM profiles are a separate workspace identity surface and can contain profile attributes.
Rule results with evidence references and point-in-time PDF or Markdown report output. The portal does not publish an enforced automatic-retention tier today.
Control-plane connector private keys and supported stored connector secrets use AES-256-GCM encryption at rest. The temporary setup token is not stored as the connector credential.
The assessment scopes cannot read Okta user passwords or MFA secrets, and the assessment scanner does not collect them.
Assessment collection is PII-minimized to the identifiers needed for evidence. This is distinct from workspace identity profiles provisioned through SSO or SCIM.
Current finding and report paths are deterministic and do not send customer identity data to an external AI service, model API, or browser extension.
The connector is not an auto-remediation path. Remediation is a separately scoped consulting engagement performed by you or with you, never by standing automation.
The active portal exports assessment reports as PDF or Markdown and offers CSV export on supported inventory views. It does not expose DOCX, raw JSON, or raw snapshot downloads. Cancelled workspaces enter a 30-day suspended offboarding period by default and are then permanently purged, with an authorized immediate-purge option. See the publicData Retention and Deletion Policy for the verified lifecycle, backup boundary, and exceptions; a signed agreement may add customer-specific terms.
Findings are produced by versioned, code-based rules — each result cites the exact Okta object it observed. Rule and collector changes are reviewed, tested, bundled, signed, and released deliberately. Atomation does not claim that a release-note watcher automatically changes production rules.
Atomation helps assess identity controls. It does not claim certifications, authorizations, or hosting statuses it does not hold — and we'd rather show you the boundary than sell you an acronym.
Found something that worries you — on this site, in the product, or in how we handle data? Email [email protected] and it goes straight to the founder. Good-faith reports get a fast, human response.
Request a scoped Okta assessment. We'll align the baseline around your org count, reporting needs, evidence requirements, and delivery model.
