Okta Cross App Access (XAA)

A dated reading of what is claimed, reported, and independently verified in the current evidence.

Current reading

Readiness band and full integer triple

AI-assisted assembly · derived results

Readiness band

Ready

Primary summary from verified readiness

Evidence strength Strong

Decision

Human editorial judgment · 2026-07-27

Track; not yet

Why: XAA replaces static AI-agent API keys/standing OAuth consents with centralized, logged, IdP-scoped delegation and is now embedded as a 'stable' official MCP extension (Enterprise-Managed Authorization, 2026-06-18) backed by 25+ vendors including Anthropic, Cloudflare, and Atlassian -- but the core protocol is still an IETF Internet-Draft, Okta's own rollout is Early-Access/gated (no self-serve since 2026-06-30), and MCP-adjacent tooling (e.g. ToolHive) still lacks implementation, so it is not yet safe to depend on outside an Okta-anchored shop.
Next: Re-evaluate for broader adoption once draft-ietf-oauth-identity-assertion-authz-grant reaches RFC status and/or self-service Okta enablement returns; in the meantime, pilot only inside an existing Okta + Claude Enterprise setup against XAA-supporting resource apps (Atlassian, Slack, Asana, Supabase) rather than building custom integration against the still-draft spec.

Constraints

No named blocker is present in the current public projection.

Evidence summary

AI-assisted assembly

Counts and dates only. Raw signals, private excerpts, trust records, and internal corpus material are not published here.

Publication record

Initial public reading