{
  "kind": "unassessed-research-protocol",
  "version": "1.0",
  "publishedAt": "2026-09-19",
  "reviewDue": "2026-12-19",
  "slug": "iam-workforce",
  "segment": "iam",
  "title": "Workforce access with a clear lifecycle",
  "profile": "Employees and contractors using a defined SaaS application set, with phishing-resistant sign-in and timely access removal.",
  "critical": [
    "Required applications and authentication methods work.",
    "Termination removes access within the declared objective.",
    "Emergency access and recovery can be controlled and audited."
  ],
  "missing": [
    "The exact app roster and selected editions",
    "Lifecycle, session revocation, and recovery tests",
    "Implementation effort and complete commercial assumptions"
  ],
  "threshold": 70,
  "minimumCoverage": 0.8,
  "rubric": {
    "capability": [
      {
        "name": "Required functions",
        "weight": 40
      },
      {
        "name": "Representative effectiveness",
        "weight": 30
      },
      {
        "name": "Evidence and explainability",
        "weight": 15
      },
      {
        "name": "Required data exchange",
        "weight": 15
      }
    ],
    "operating": [
      {
        "name": "Staffing and administration",
        "weight": 30
      },
      {
        "name": "Environment and deployment",
        "weight": 25
      },
      {
        "name": "Integration maintenance",
        "weight": 20
      },
      {
        "name": "Portability and exit",
        "weight": 15
      },
      {
        "name": "Cost predictability",
        "weight": 10
      }
    ]
  },
  "products": [
    {
      "name": "Microsoft Entra ID",
      "scope": "Workforce identity; tenant, license, and required add-ons must be specified.",
      "source": "https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra",
      "status": "unassessed",
      "capability": null,
      "operating": null
    },
    {
      "name": "Okta Workforce Identity",
      "scope": "Workforce identity with Identity Engine; purchased products and tiers remain unselected.",
      "source": "https://www.okta.com/products/workforce-identity/",
      "status": "unassessed",
      "capability": null,
      "operating": null
    }
  ]
}