We are also using Okta for SSO, and it has definitely made our life easier for enforcing identity based access. But the issue is Okta is only involved at session setup. We want to model our access based on google beyondcorp recommendations. But from your post, looks like you don't think there is anything out there currently, that can help us architect that kind of access model? What do other readers think? Seems too extreme to me.