← All integrationsINTEGRATION · IDENTITY

Kapālins for Okta

Okta already decides who works for you. Kapālins takes people and groups from it over SCIM, signs them in with OIDC, and sweeps OAuth grants read-only, so every AI verdict names a person and every AI app someone connected with one click has an owner.

See it governed liveSetup in four steps

Policy by Okta group

Roles and AI entitlements follow the groups you keep in Okta; only people assigned to the Kapālins app are imported.

Offboarding reaches AI too

Deactivate a person in Okta and the next SCIM push removes them from the gateway, the workspace and the devices.

AI apps found by grant

OAuth grants are matched against the AI app catalogue, so a connected AI app shows up with a name and the person who granted it.

Only the people assigned to the Kapālins app are imported, the same list Okta uses to decide who can sign in.
WHO

Every verdict names a person.

Because people and groups arrive from Okta, every row in the timeline carries a person and a group, not an API key or a username string.

  • SCIM 2.0 keeps people and groups current
  • Only people assigned to the Kapālins app are imported
Kapālins Logs: one timeline of AI requests and policy verdicts
The Kapālins timeline in the pilot tenant on production. Personal addresses masked.
NON-HUMAN

The identities no directory holds.

Okta brings the people. Agents and service keys are in no directory, so Kapālins profiles each one from its own behaviour, flags the ones that drift, and shows the score line by line, beside the people Okta provides.

  • Calls, hours, models and injection rate against baseline
  • Quarantine a key in one click, reversibly
Kapālins Agentic Behaviour: an agent key flagged, with its score derivation and behavioural fingerprint
Console replay · illustrative data
A replay of the Kapālins console: an agent flagged for injection activity, its score explained line by line, its fingerprint against baseline, and the MCP calls it made outside its declared scope. Agent names and activity are illustrative.
ACT

The person, not a guess.

An incident names who did it and which group policy applied, so the review is a conversation with one person, not a hunt through logs.

  • Roles in Kapālins assigned from your groups
Kapālins incidents: sensitive data stopped before it left
Incidents in the pilot tenant: sensitive data stopped before it reached an AI service. Personal addresses masked.
Setup

Four steps.

  1. Create the SSO appAdd Kapālins as an OIDC application in Okta and enter its client details in Kapālins.
  2. Turn on SCIMCreate a provisioning token in Kapālins and paste it into the app’s provisioning settings.
  3. Allow the grant sweepConsent to read-only access to application grants.
  4. Assign the appOnly people assigned to the Kapālins app are imported.
Request a briefing

See Okta governed in thirty minutes.

Bring the person who holds the credential. We connect it live and watch the first events land.

Request a briefing All integrations
FAQ

Questions buyers ask.

Does Kapālins write to my directory?

No. Provisioning flows one way, from your directory to Kapālins, and any grant sweep is read-only.

Which groups should I provision?

Only the groups that should use Kapālins. Assign the Kapālins app in Okta to those groups and SCIM sends exactly them.

What happens when someone leaves?

The next SCIM push deactivates them, and every plane stops recognising their identity.