Evidence from someone who doesn't run the systems.

When the team that runs identity also produces the evidence that identity is under control, the evidence marks its own work. Assay is a separate, read-only check. It doesn't administer the tenant, the governance tool or the vault, so its findings don't depend on them being right.

What the evidence shows

• Each finding with its source. Which system said what: Entra ID, SailPoint, Saviynt or CyberArk, and where they disagree.
• Dates, every day. Each run is dated, and the digest says what changed since the last one.
• What was not checked. A check that could not run is shown as "not checked" with the reason, never as passed.
• Accepted risks, on the record. Each one names the owner, the reason, the mitigation, the person who accepted it and an end date at most a year ahead. After that date the finding counts again on its own.
• New checks are held for review. When the underlying checks are updated, new ones are listed separately until the customer approves them, so an update never looks like a change in the tenant.
• Control references. Checks are mapped to ISO/IEC 27001 Annex A and the NIST Cybersecurity Framework.

What it is not

Assay doesn't replace your audit or your client's own controls. It gives you consistent, dated evidence about identities, admin rights and AI agents to test against.