Workflow Verification
Don’t trust the configuration. Run the process.
A verification is a short chain of steps (reads, writes, or a cloud browser) that walks a real process against your live systems. Each step must observe what it expects, and cleanup always runs.
Workflow Verification · Runs
A Workday hire can reach their apps on day one
EnvironmentNew hire · Managed Mac · Office network through Zscaler
Workday + Okta + browser
3 steps + cleanupWORKDAY_ISU · OKTA_API_TOKEN
Create a test hire in Workday
Step 1 · Code · Writes
Wait for Okta to provision the account
Step 2 · Code · Read-only
Sign in and open Google Workspace, Slack, and Jira
Step 3 · Cloud browser · Read-only
Rescind the test hire and remove the account
Cleanup · always runs
Steps met
3/3
Cleanup
Done
Duration
0:41
History
Step 3: Jira returned 403
Every app loaded as the new hire. Onboarding works from Workday to day one, and the test hire is gone.
Step 3 expected
3 of 3 apps
loaded as the new hire
How it works
From a sentence to a scheduled proof.
In five steps.
- 1
Describe
Name the process that must keep working, or pick a suggestion for a system you've connected. AI drafts the steps, what each must observe, and the cleanup.
- 2
Credentials & environments
Choose vault credentials by name, then the environments to run in: hosted and matched to your enterprise, or a runner inside your network.
- 3
Preview & edit
Walk the whole chain before anything runs. Steps are read-only by default, and any step that writes is marked.
- 4
Run
Each step must observe what it expects before the next one starts. Cleanup always runs, pass or fail.
- 5
Schedule
Run daily, hourly, or on demand. Every run keeps what each step observed and how long it took.
Three ways to verify
Check it. Sweep it. Trace it.
Pick the shape of the question.
Check
Does this one thing work right now? Steps act and observe, and the run passes, fails, or says it could not verify. Use it when you can cause the behaviour on demand.
Sweep
Across all these targets, where does it hold? A probe runs against every discovered target and returns a row each: affected, clear, or not observed.
Trace
Did this process run correctly, every time it ran? Events it left behind are matched to the expected steps, with a verdict for every instance. Use it for backups, leavers, renewals: things that happen on their own.
Traces
Prove it from what it left behind.
Every run, not just the last one.
Some processes can't be triggered on demand and play out over hours or days, across several systems. A Trace reads the events they emit, ties each one to an instance, and judges every instance against the steps, order, deadlines, and conditions it should have met.
Workflow Verification · Trace
Nightly Backup Copied to Azure
Key: backup run ID · expected nightly 02:00
Completed
24
last 30 nights
Need attention
3
deviated, late, missed
Not observed
1
never counted as passing
Match rate
92%
41 events uncorrelated
Tonight · 02:00
In flightTransfer started 6 min ago, within deadlineSun 4 Oct
DeviatedAt export.completed: 0 B vs 4.2 GB last runSat 3 Oct
Latechecksum_verified missing 2h past deadlineFri 2 Oct
MissedScheduled 02:00, backup.triggered never arrivedThu 1 Oct
Not observedJob log connector down 01:10 to 07:20Wed 30 Sep
CompletedAll 5 steps in order, 4.1 GB, 38 minSun 4 Oct · export
Job reported success
0 bytes written
Decided by the model
Order, deadlines, and conditions decide the state. Classifications label messy events, they never decide the verdict.
Missed runs show up
Schedules, parent events, and inventories say an instance should exist, so a run that never started is not invisible.
Gaps are never green
When telemetry is missing or events can't be correlated, the instance is Not observed, with the match rate shown.
Every state names a cause
Deviated, late, failed, or missed always comes with the step and the rule that caused it.
Trace instances
One instance, every step.
Across every system it touched.
Open any instance to see its events against the model. Stable IDs are mapped between systems, probes read the live state instead of trusting the log, and the step that broke is highlighted.
Trace · Leaver access removal · Instance
W-20431 · Same-day leaver
WorkdayExpected start · worker W-20431OktaMapped W-20431 → 00u8f2Okta14 of 14 appsOktaLive read of the accountOktaDeadline 10:04 passed, 3 sessions still active
JamfMacBook Pro C02X…Deactivated, but still signed in
Okta shows the account inactive, yet sessions were never revoked. If the step arrives, the instance becomes Completed (late) with the delay recorded.
sessions.revoked
Required within 1h
3 sessions active
Environments
Run it where your people run it.
Not from a clean browser in someone else's cloud.
A sign-in test only means something under the conditions your people sign in with. Configure each environment a verification runs in to match your enterprise, then run the same steps in all of them.
Workflow Verification
Okta App Login Verification
Run in all 4Office · Managed Mac
NYC office network through Zscaler
Remote · Managed Windows
Home internet through Zscaler Private Access
Contractor · Unmanaged laptop
Public internet, no agents
London office
Your network, your devices
Office · Managed Mac
Edited 2 days ago by j.rivera
sales.test@acme.com, in the Sales and US Staff groups
Enrolled in Jamf, FileVault on, CrowdStrike running
TLS inspection with your root certificate, office DNS
New York, US
Office IP range 203.0.113.0/24
Chrome 129
Corporate extensions and managed browser policy
A hosted environment configured to match this one. Switch to a runner inside your network at any time.
4
environments, one verification, the same steps in each
- Identity, device, network, location, and browser, configured per environment
- Hosted environments configured to match yours, or a runner inside your network
- As many environments per verification as you need
- Every run records which environment it ran in and where it ran
- Traffic takes your real path: proxy, TLS inspection, mail gateway, device posture
- Test identities and devices are yours, referenced by name like any credential
Across environments
Same verification. Every environment.
Differences side by side.
When one environment disagrees with the rest, it stands out immediately, and the run keeps the evidence from each one.
Workflow Verification · Latest run
Okta App Login Verification
Office · Managed Mac
Hosted · matchedSigns in, no MFA promptSigned in, no promptPassedRemote · Managed Windows
Hosted · matchedMFA prompt, then accessMFA prompt, then accessPassedContractor · Unmanaged laptop
Hosted · matchedBlocked by device ruleSigned inFailedLondon office
Your networkSigns in, no MFA promptSigned in, no promptPassedOnly the unmanaged laptop disagrees
The Okta device rule for this app changed 2 days ago. Every other environment behaves as expected, so the fix is scoped to one rule.
Contractor · Unmanaged laptop
Expected blocked by device rule
Signed in
Library
A library of proofs.
Each with its last result.
Every verification shows the systems it touches, whether it writes, how often it runs, and what happened last time.
Workflow Verification
Verifications
A new hire can sign in and reach their apps
Okta · browser3 + cleanupWritesDailyPassedA user can reset their password
Okta · email4 + cleanupWritesDailyPassedNightly backup restores to a clean instance
AWS RDS5 + cleanupWritesWeeklyFailedCheckout API responds within its latency budget
Cloud Run3Read-onlyHourlyPassedDNS changes reach every zone
Cloudflare2Read-onlyDailyCould not verifyA leaver's sessions are revoked
Okta · Google3 + cleanupWritesDailyPassedThe failed restore took 4h 20m, over its 4-hour window. The fix is already in Remediation.
Suggestions · Okta
10 ideas
ready to build from the systems you connected
Safety
Safe to run against production.
Because it has to be.
Read-only by default
New steps read. Anything more needs to be declared, and nothing runs until you press Run.
Writes are marked
Any step that changes something is flagged on the step and on the verification before it can run.
Cleanup always runs
Test users, records, and sessions are removed at the end, even when a step fails.
Credentials by name
Verifications reference vault credentials by name. Values never appear in the definition.
Examples
Processes teams prove.
Every day, not once a year.
Works with
The rest of the loop.
One platform, one set of receipts.
Prove the process works.
Before someone finds out it doesn't.
Start with the process your helpdesk hears about most. Panaptico drafts the steps; you review them and press Run.