The target brought their own Okta, their own HRIS, their own cloud, their own conventions. The deal docs gave you ninety days. Panaptico runs the integration as a live graph — tool rationalization, identity collisions, policy merges, and the deal-timeline gates that actually signed off the acquisition.
Acquirer
4,200Halo Commerce
halo.com · est. 2017
Unified
5,020Halo Commerce (NewCo)
unified stack · both domains kept
Target
820Prism Labs
prism.com · est. 2020 · acq. 2026-03-15
Stack decisions
8 · signed
Identity collisions
47 · resolved
Policies reconciled
7 of 7
Active gate
Day 60 · ID unify
Dual-spend
$1.9M · closes D90
The gap
01
Two Oktas, two HRIS, two clouds, two chat tenants, two code orgs. Every one of them made decisions the acquirer never heard of and needs to honor or override — usually in ninety days.
02
Day 1 is a welcome mailbox and a laptop. Day 90 is the deal document — payroll unified, access consolidated, compliance posture honored, dual-spend closed. The gap in the middle is where integrations die.
03
You pay for both Oktas until the target's users are absorbed. Both chat tools until the workspaces merge. Every week of indecision is another week of duplicate SaaS on a line item somebody has to explain.
Stack reconciliation
For every function that exists on both sides, Panaptico binds the rationalization to a decision record — who wins, which direction the data flows, and why. No post-close meeting, no vendor politics.
Identity
Okta · 4,200 users
Okta · 820 users
Halo winsPrism users migrate into Halo tenant
Halo runs PAM + ZTA pipeline; easier to absorb than rewrite
Email · productivity
Google Workspace
Microsoft 365
Halo winsPrism → Google · 60d window
Halo has integrated Drive + Looker; M365 data archived 7y
Code hosting
GitHub Enterprise · 1 org
GitHub Enterprise · 1 org
Halo winsPrism repos transferred · SSO rebound
SAML rebind only; CI secrets re-vaulted
Cloud
AWS · 4 accounts
GCP · 3 projects
SplitAWS is tool-of-record · GCP preserved 12mo for data
Data science warrant to stay on BigQuery through Q4
Collaboration
Slack · Enterprise Grid
Slack · Pro
Halo winsShared channels D0 · merge to Grid D90
Grid governance already signed; Pro absorbs cleanly
HRIS
Workday
BambooHR
Halo winsPrism records → Workday · Bamboo sunset D120
SOX control boundary lives in Workday
Observability
Datadog
New Relic
Halo winsPrism services instrument to Datadog
Single pane; see Consolidations for savings model
Ticketing
ServiceNow
Jira Service Mgmt
Halo winsPrism tickets migrated · JSM sunset D90
CAB + change record retention already in ServiceNow
Identity collisions
Same email, different people. Different emails, same person. Two VPs of Engineering. A shared admin account on fourteen SaaS tenants. Panaptico classifies every collision and binds each one to a signed resolution before cutover.
47 collisions · 4 classes · 0 unresolved
Halo
b.stevens@halo.com
Prism
bob.stevens@prism.com
Resolution · Same person · consultant on both sides · identities merged, both mailboxes forwarded 90d
Halo
alex.chen@halo.com · Senior SWE
Prism
alex.chen@prism.com · Platform TL
Resolution · Different people · Prism issued alex.chen2@halo.com · comms sent D-3 before cutover
Halo
Priya Menon · VP Engineering (Halo)
Prism
Dev Raj · VP Engineering (Prism)
Resolution · Dev Raj becomes SVP Platform · reports to Priya · signed by CEO + CHRO on D7
Halo
7 contractors in both directories
Prism
Paid through Halo · provisioned in Prism
Resolution · Deduped · single Workday record · Prism Okta account deprovisioned D14
Halo
admin@prism.com
Prism
super-admin on 14 Prism SaaS tenants
Resolution · Shared account · broken into 4 named admins · break-glass vaulted in 1Password
Policy reconciliation
Every policy collision resolves upward — stricter wins unless explicitly relaxed. Each call is a decision record with a signer and a binding to the systems still governed by it.
MFA session lifetime
12h active · 30d refresh
8h active · 7d refresh
12h active · 30d refresh
CISO · 2026-03-28
Password rotation
90d · WebAuthn preferred
never · SMS allowed
90d · SMS disabled · WebAuthn for admins
CISO · 2026-03-28
Device trust
MDM mandatory · Intune
BYOD allowed
MDM mandatory · 60d grace for Prism fleet
CISO · CIO · 2026-04-02
Contractor rotation
Quarterly re-attestation
Annual
Quarterly · CHRO signs re-attestation report
CISO · CHRO · 2026-04-05
Privileged access
BeyondTrust PAM
Shared password vault
BeyondTrust · Prism shared accounts decomposed (see Collisions)
CISO · 2026-04-08
Data classification
4-tier: Public / Internal / Confidential / Restricted
3-tier: Open / Internal / Sensitive
4-tier · Prism assets re-tagged · automated scan completes D75
CISO · Legal · 2026-04-12
Retention · deleted users
180d
30d
180d · Prism records back-filled to 180d
Legal · CPO · 2026-04-14
Deal timeline gates
Integration has the deadlines the deal docs wrote. Panaptico binds each gate to a signed must-be-true list and refuses to advance until every item clears.
D-Day · Close
Deal close · Day 0
Must be true
Gated by
CEO · Legal · CHRO
Day 30
Payroll + HR unified
Must be true
Gated by
CHRO · CFO
Day 60
Identity + access unified
Must be true
Gated by
CISO · CIO
2 blockers · open
Day 90
Full tool rationalization
Must be true
Gated by
CFO · CIO · COO
Panaptico turns the integration plan into a live graph — tool-of-record decisions, identity collisions, policy merges, deal-timeline gates. All signed. All queryable. Through Day 90 and after.