Archived demo. ES ONE ran against live Okta, ServiceNow & Databricks instances; those integrations are disconnected and no longer maintained. The interface and governance flow remain here to walk through — live actions will not complete. More about this project →
ESONE
← Solutions
How it works Policy
The AI control plane for your stack

ES ONE

A vendor-neutral runtime governance layer for AI agents — least-privilege, human approval, and a tamper-evident audit on every action an agent takes across Okta, ServiceNow & Databricks. Defense against OWASP LLM06: Excessive Agency.

Live
⚡

AI Action Governance

Least-privilege, approval & audit on agent actions.
  • Onboard & offboard across every system
  • Access reviews & cost recovery
  • Scoped to the operator's authority
  • Hash-chained audit of every action
Open →
Live
🔧

Implementation Studio

Build & configure ServiceNow from a prompt.
  • Assess a live instance vs. best practice
  • Review the exact build plan, then approve
  • Deploy governed config — and tear it down
  • Methodology-driven & reversible
Open →
Soon
🔗

Integrations

Connect your platforms during setup.
  • Wire Okta ↔ ServiceNow ↔ Databricks
  • SSO, provisioning & data flows
  • Governed, documented, reversible
On the roadmap
Real, governed connectors · nothing simulated.

Govern access for people and AI agents.

Provision least-privilege access across real systems (Okta, ServiceNow, Databricks), then watch an AI agent get stopped when it reaches beyond its scope. Everything you provision here auto-reverts in 10 minutes — a policy we call Scheduled Governance — so the demo is always clean and nothing is left behind.

1

Provision a person

An administrator requests access for a new Sales Rep. Governance checks it against least-privilege policy, then deploys it across all three systems.

2

Provision an AI agent

Give a support AI agent the scoped access it needs to do its job — read customer records only. It is deliberately not granted finance / purchase data.

3

Test the agent’s boundary

Tell the agent to pull purchase data it doesn’t have access to. Governance intercepts and asks you to decide — grant it permanently, grant it once, or deny.

Live systemsOktaServiceNowDatabricks
Advanced — type your own free-form request ▾

Govern what your AI agents can do.

Describe an action in plain English — it's checked against policy, then allowed, sent for approval, or denied, before it runs.

Your requestplain English
→
Governanceallow · approve · deny
→
Your systemsOkta · ServiceNow · Databricks
→
Audittamper-evident
Or see an AI agent get blocked when it reaches beyond its access:
ES ONEAI ORCHESTRATOR
reads your prompt · runs the systems
🔑
Identity
Okta
🛠️
IT Service Mgmt
ServiceNow
⚖️
Decision Engine
ES ONE
📊
Data Warehouse
Databricks
Governance & audit ▾

Governed actions

TimeActionTargetDecisionResult

Agents — non-human identities grant / revoke · risk ceiling

Access graph — who has what

Refresh to load live entitlements.

Implementation Studio

Assess a customer's ServiceNow against our methodology, review the exact build plan, approve, and deploy — governed and reversible.

Credentials are held in your browser for this session only, sent over HTTPS, and never stored on the server. (Prototype auth — a production build would use OAuth + a secret vault.)

Deployed by ESONE

Nothing deployed yet.

How it works

Least-privilege, approval, and a tamper-evident audit on every action — whether taken by a person or an AI agent — across real systems. The actor proposes; the governance disposes.

The Decision Engine
Actor requestsperson or AI agent
→
evaluate()Decision Engine
→
Decisionallow / deny / approve
→
record()hash-chained audit
ALLOWlow / medium risk — execute + audit
NEEDS_APPROVALhigh risk — pause for a human
DENYcritical risk — stop + explain, no action
BLOCK + ALERTagent exceeds its own scope — excessive agency
Connected systems
🔑

Okta

Identity
  • Create / deactivate users
  • Grant & revoke group / app access
  • Least-privilege membership
🛠️

ServiceNow

ITSM / Workflow
  • Users, roles, tickets, CMDB assets
  • In-platform enforcement: a business rule calls the engine before a grant and aborts on deny
📊

Databricks

Data
  • Governed SQL queries
  • Automatic PII redaction
  • Workforce write-back
Workflows
OnboardingLeast-privilege access across Okta + ServiceNow — each grant governed and audited, cost/asset/ticket handled in the same flow.
OffboardingRevoke access everywhere in one governed action; the record is preserved.
Access reviewDetect over-provisioned / excessive access against role and peers, with the $ reclaimable.
Privilege escalationAgent reaches for admin → denied (critical) and logged, before it executes.
Agent over-reachAgent attempts an action beyond its scope → blocked + alerted. Excessive agency, caught.
Human-in-the-loopHigh-risk action pauses for approval → executes only on human sign-off.
Governed data accessLeast-privilege query with automatic PII redaction and a full audit trail.
Scheduled Governance (JIT)Grants carry an expiry and auto-revoke — access is time-boxed, nothing lingers. The demo reverts every grant after 10 minutes.
In-platform enforcementServiceNow asks the engine before acting — the policy travels into the platform, aborting the action at the source.

Policy

Deterministic rules enforced on every action — read live from the running policy. Authored (AI-assisted), human-reviewed, version-controlled; out of reach of the runtime agent.

Risk → outcome
Action risk tiers
ActionRiskOutcome
Entitlement overrides
EntitlementForced riskEffect
Least-privilege role map
Agent scope
Human authority