A proof surface for governing Okta as the identity provider: signed-JWT verification, machine-readable SSO and SCIM provisioning posture, lifecycle events as append-only evidence, and read-only directory access by default.
Every claim points to a real artifact you can open. Where a control is specced but not yet shipped, it says so — no surface here pretends to be further along than it is.
Governance posture is only worth what a procurement team can independently confirm. Where the validator is live, a buyer fetches the declaration and walks the hash-chained audit trail themselves — capability, classification, and control evidence, machine-readable and self-checking.