Critical infrastructure use case · Workday + Okta + ServiceNow
Identity access change for operations staff
Operators change shifts and roles often, and access to operational systems drifts from role. Operations staff access follows their role, with changes approved and recorded.
Architecture
One governed run
How it starts: A webhook, schedule or HTTP poll of Workday starts the run. ServiceNow requests can also start it.
Step by step
How the process runs
- 01
Context
Role and time records are read from Workday.
- 02
Policy
Rules + Code maps role to Okta groups and roles.
- 03
Case
A ServiceNow ticket records the change.
- 04
Approval
The system owner approves.
- 05
Change
Okta groups and roles update.
Control
Human decision and exception path
Human decision
Access to operational systems requires the system owner's approval.
Exception path
- Policy conflicts stop the change.
- Okta errors keep the ticket open.
- Leavers are deactivated first.
Evidence
What gets audited
- HR context.
- Ticket and approval.
- Okta operations.
Nexus runs on premises, in private or sovereign cloud, or air-gapped. Credentials stay in the vault, roles decide who can approve, and the execution record stays inside your deployment boundary.
Sovereignty and deploymentRelated
Patterns, connectors and next steps
- Workday-Okta integration
Integration pattern · Employee lifecycle changes become governed identity and access changes.
- Workday connector
66 pre-built actions
- Okta connector
42 pre-built actions
- ServiceNow connector
55 pre-built actions
- Governed self-service
Requests with policy and approval built in.
- Infrastructure alert to incident and remediation
Another critical infrastructure use case.
FAQ
Questions about this use case
- Does Nexus replace any of these systems?
- No. Each system keeps its own records. Nexus runs the process between them and records each decision.
- How does the run start?
- A webhook, schedule or HTTP poll of Workday starts the run. ServiceNow requests can also start it.
- What if a step is not covered by a pre-built action?
- It runs through an API, protocol or database call, or as Rules + Code in Python, Bash, Go, Java, .NET, PHP, PowerShell or JavaScript/TypeScript, with the same approvals and audit.
Use case review
Discuss this use case
Bring your version of the process. We will map the systems, approvals and evidence it needs.