Skip to content
Talk to an architect
Identity and access

The device is part of the access decision.

Device Access brings the endpoint into the authentication decision, so a login can require a known, compliant device rather than only a known person. Our work is policy design and the exception paths that decide whether it survives contact with contractors.

Device Access extends identity to the endpoint, so who is asking and what they are asking from are one decision rather than two.

What it is

Device Access brings the endpoint into the authentication decision, so a login can require a known, compliant device rather than only a known person.

What it does

Device as a factor

Access conditioned on a known endpoint rather than on the credential alone.

Where it fits

L1, identity and access. It narrows the gap between a credential and a person. Where an estate has strong authentication but no device signal, a stolen credential still works from anywhere.

L4

Agents and Automation

Rovo, Agents in Jira, Forge, MCP with Claude and Copilot, agent lifecycle, usage and cost governance.

Atlassian Anthropic
L3

Governance and Change

Permission architecture, audit and compliance, ITSM and change control, change management, strategic reporting and budgets.

Atlassian Guard Jira Service Management Strategy Collection Jira Align
L2

Platform and Migration

Migration of every kind, tool consolidation, licensing, standardization, the system of work.

Atlassian Miro AWS Azure
L1

Identity and Access

Human and non-human identity, SSO, SCIM, least privilege, access reviews, Guard cleanup, Agent SSO readiness.

Atlassian Guard Okta

load-bearing, bottom to top

What we do with it

Policy design

Which populations require a managed device, and what the exception path is.

Exception handling

Contractors and unmanaged endpoints are the real design problem, not the managed fleet.

Running it

Enrollment, exceptions, and drift handled as an operation.

Where it earns its place

An organization with contractors on unmanaged devices

The policy is easy for employees and hard for everyone else, which is where it needs design.

An estate hardening privileged paths

Requiring a managed device for administrative access is a high-value, narrow first step.

Questions we get

What about people without a managed device?
That is the design question. A policy with no workable exception path gets disabled within a month.

Okta's own page for Device Access, opens in a new tab

Find out who can reach what.

Fixed scope. The assessment starts at the identity layer: human and non-human access, the accounts nobody owns, and what has to be true before an agent gets one. You get the findings, the ownership gaps, and the order to close them in.

Get an agent readiness assessment

By sending this you agree to our privacy policy.

Not ready? Talk to an architect