Financial services use case · Workday + Okta + ServiceNow + Microsoft 365
Identity changes for regulated staff
Regulated roles need demonstrable access control, but changes are spread across HR, identity and ticketing. Access changes for regulated roles carry a case record, approval and full evidence.
Architecture
One governed run
How it starts: A webhook, schedule or HTTP poll of Workday starts the run. ServiceNow can start request-driven changes.
Step by step
How the process runs
- 01
Context
Role changes are read from Workday.
- 02
Case
A ServiceNow ticket or change records the access change.
- 03
Approval
The access owner approves against policy.
- 04
Identity
Okta users, groups and roles change.
- 05
Notify
Staff and managers are informed through Teams and email.
Control
Human decision and exception path
Human decision
Every regulated role change requires named approval recorded on the case.
Exception path
- Policy conflicts stop the change.
- Okta errors keep the case open.
- Leavers are deactivated first.
Evidence
What gets audited
- HR context.
- Case and approval.
- Okta operations.
- Notifications.
Nexus runs on premises, in private or sovereign cloud, or air-gapped. Credentials stay in the vault, roles decide who can approve, and the execution record stays inside your deployment boundary.
Sovereignty and deploymentRelated
Patterns, connectors and next steps
- Workday-Okta integration
Integration pattern · Employee lifecycle changes become governed identity and access changes.
- Microsoft 365-Okta integration
Integration pattern · Identity changes and collaboration follow-up happen together, under policy.
- Workday connector
66 pre-built actions
- Okta connector
42 pre-built actions
- ServiceNow connector
55 pre-built actions
- Microsoft 365 connector
45 pre-built actions
- Compliance evidence
Evidence produced by the work itself.
- Lead to account and ERP handoff
Another financial services use case.
FAQ
Questions about this use case
- Does Nexus replace any of these systems?
- No. Each system keeps its own records. Nexus runs the process between them and records each decision.
- How does the run start?
- A webhook, schedule or HTTP poll of Workday starts the run. ServiceNow can start request-driven changes.
- What if a step is not covered by a pre-built action?
- It runs through an API, protocol or database call, or as Rules + Code in Python, Bash, Go, Java, .NET, PHP, PowerShell or JavaScript/TypeScript, with the same approvals and audit.
Use case review
Discuss this use case
Bring your version of the process. We will map the systems, approvals and evidence it needs.