StitchOps joins the Okta Integration Network and Okta's Cross App Access ecosystem

On September 22, Okta published its expanded Cross App Access (XAA) ecosystem, and StitchOps is listed as a resource app integration, alongside Notion, Zendesk, and Miro. At Oktane26, Okta put visibility and control over AI agents at the center of the conversation.

That framing is the right one. It is also why we built our side of XAA.

StitchOps in the Okta Integration Network

StitchOps is also listed in the Okta Integration Network, so Okta customers can add StitchOps directly from the catalog and govern it under the same identity policy as the rest of their stack. Together with our XAA resource app integration, Okta governs who and what can reach StitchOps, and StitchOps carries that governed access into the applications that were never built for it.

The listing covers Single Sign On, Directory and HR Sync, Automation, and Identity Governance and Administration (IGA).

What Cross App Access does

AI agents are starting to do real work inside the enterprise. To do it, they need access to the applications where that work lives. Until recently, that access usually came from one of two places: a user clicking through a consent screen for each connection, or a static API key sitting in a configuration file.

Neither gives IT and security teams much to work with.

XAA moves that decision to the identity layer. An agent (the requesting app) asks for access through the user's Okta identity. Okta checks the request against enterprise policy. The downstream system (the resource app) grants access scoped to the task, and every connection is logged. No standing credentials, no consent prompts scattered across dozens of tools, and one place to see what every agent is connected to.

That is visibility and control, applied to agents.

Where visibility and control usually stop

Here is the part most agent demos skip.

Governing an agent's identity is one problem. Getting the work done inside the application the agent was sent to is another.

A large share of the systems enterprises depend on were never designed to be called by software. Vendor portals. Desktop applications. Payroll and benefits systems. Line of business platforms that have run the same way for fifteen years. Some have partial APIs. Many have none.

When an agent reaches one of those systems, it holds a valid token and has nothing to use it on. The work falls back to a person with a spreadsheet and a ticket queue. The visibility and control the organization just established ends at the edge of the one app that mattered.

That gap is a property of legacy applications, not of any identity platform. But it is where most agent projects will stall.

What it means for StitchOps to be a resource app

StitchOps is an execution runtime. We automate work in systems with no usable API, broken APIs, or partial APIs, anywhere a person can log in and act. We use browser and desktop automation, computer vision, and execution driven by AI, and we use APIs wherever they exist.

As an XAA resource app, StitchOps can be reached by an agent under Okta identity and policy. Okta governs the agent's request. StitchOps then carries out the work inside the target application, through the same interface a person would use, with logs for every step and evidence for every run.

Okta decides who the agent is acting for and what it is allowed to touch. StitchOps makes sure the work actually happens, including in the applications that were never built for it.

Kyle Harris, our cofounder and CTO, and his team built our XAA integration.

"Most enterprise software was built for a person at a keyboard, not for a program," says Kyle. "Instead of waiting for vendors to fix that, we taught agents to use the keyboard."

Any technology includes the old ones

Okta's mission is to free everyone to safely use any technology. We take the word "any" seriously.

For most enterprises, any technology includes new AI agents and the modern SaaS stack. It also includes the claims system from 2009, the supplier portal with a login page and nothing underneath it, and the desktop application a whole department still runs on. If agents can only work safely in the applications with clean APIs, visibility and control cover the easy part of the business and leave the rest to manual work.

Extending governed agent access to those systems is the job we signed up for.

What this looks like in practice

These are the workflows we hear about most from IT and security teams:

• Provisioning new hires into applications that do not support SCIM or have no API at all.
• Offboarding that revokes access in the unconnected apps too, not only the connected ones.
• Access reviews where the remediation executes instead of becoming a ticket.
• Password rotation for accounts in applications that were never built for it.
• Lifecycle changes triggered by HR that reach every system in the chain.
• Apps that sell SCIM only on their top plan, where the SCIM tax adds up across every seat.

In production

One example: an automotive group with 4,000 employees across 110 rooftops in several US states. Onboarding and offboarding across many applications used to land on IT by hand. StitchOps now automates those lifecycle changes across the apps, tied to Okta.

Roughly four in five of its employees turn over each year: about 3,200 hires and 3,200 terminations, or 125 lifecycle events every week. Each person touches 23 systems: HR, Okta, email, and 20 birthright apps.

Before StitchOps, five full time IT staff entered every hire and reversed every departure by hand across those systems, and handled password resets for every active employee. By our estimate, that came to about 10,670 hours a year, the full capacity of the team. The labor was only the visible cost. New hires waited a day or more for full access, leavers kept live accounts in some apps for days or weeks, and the company kept paying for their seats.

Now, when HR marks someone as hired, StitchOps creates their identity in Okta, provisions email, and sets up all 20 birthright apps, including apps with no API or a broken one, because StitchOps works anywhere a person can log in and act. When HR marks someone as terminated, every account is disabled across all 23 systems within minutes. Employees reset their own passwords across every app without opening a ticket.

The value, by our estimate

Risk reduction is not in that number. It sits beside it: no orphaned accounts left behind by turnover, every provisioning and deprovisioning action logged for SOC 2 or SOX audits, and access reviews that pass instead of generating findings.

In each case, the agent or workflow operates under the organization's identity policy, and the execution reaches the systems that would otherwise need a person.

Thomas wrote about why this matters on LinkedIn.

Identity decides who. Execution decides whether the work actually happens.