Push vs Nudge vs ScopeMantle

Three ways to govern OAuth, without a fake bake-off

Buyers lump "OAuth security" into one category and then get angry when the demos disagree. There are at least three designs: intercept consent (push), persuade the employee (nudge), and inventory the IdP (what we do). You can run more than one. You should not pretend they are the same control.

I will not invent Push Security or Nudge Security list prices, win rates, or customer counts. Those change and I do not have their contracts. I will describe the design, where it is strong, where it fails after Drift-scale replay, and what ScopeMantle publishes: $5 / $6, no seat min, custom 500+, 30-day trial via /demo, Entra labelled Beta, HIPAA not attested.

If you want the thesis behind the inventory camp, read third-party identity attack surface.

1. Push-style: stop the grant at birth

Push models sit in the consent path. Employee clicks Allow, something in the browser or endpoint asks for approval, grant completes only if policy says yes. Strength: you prevent the bad token from existing. That is the cleanest prevention story in the category.

Limits you should test in a POC, not take on faith:

• Historical grants. Yesterday's Allow is already in a vendor vault. Intercept does not rewind Drift.
• Coverage. Personal devices, missing browser extension, PAC exceptions, and unmanaged Chrome profiles punch holes. Push is only as good as enrollment.
• Vendor-side storage. Even a perfectly gated consent still sends a refresh token to a multi-tenant vault. You prevented some future grants. You did not move the vault.
• DSAR. Consent firewalls do not build a processor list with clocks.

ScopeMantle's consent firewall / grant-time prevention is Roadmap. We say that on pricing and integrations. If you need intercept this quarter, evaluate a push tool and stack inventory anyway. Do not wait for our roadmap item and call it a control.

2. Nudge-style: ask the human to clean up

Nudge models notify employees about risky apps and hope they revoke. Strength: culture. People see the consent screen twice. Some of them learn. That is not nothing.

Limits:

• Scale. Thousands of grants. Nudge fatigue is real. Marketing will ignore the tenth toast.
• Authority. Employee self-remediation is not a CISO revoke. After a disclosure you need client-ID bulk action, not 400 individual clicks.
• Evidence. "We sent a nudge" is a weak CC9.2 story. "Here is the revoke timestamp" is a strong one.
• Terminated users. They will not click the nudge. Their tokens are the finding.

Keep nudges as an awareness layer if you like them. Do not make them the system of record.

3. Inventory-first (ScopeMantle)

We sync Google Workspace and Okta read-only. No endpoint agent. Every grant gets a score (scoring), an attestation path, and a revoke button (governance). The same list feeds DSAR. Bulk revoke by client ID when a vendor discloses. Minutes, not a weekend of Admin clicking.

Limits we will say out loud:

• We do not yet intercept consent (Roadmap).
• Entra is Beta. Multi-IdP Microsoft-heavy estates need a manual export until GA.
• We do not see Salesforce Connected Apps that never touched Google or Okta. Export those yourself. See Drift.
• We do not see warehouse keys. See Snowflake.
• SCIM cascade revoke is Beta. HRIS-triggered deprovision is Roadmap.

A comparison you can actually use

TCO that is not a calculator lie

We publish a ROI calculator that models review hours and DSAR hours from your inputs. It is a model. It is not a case study. The IR hours you do not spend on a Friday Admin archaeology session are the number CISOs actually feel. I will not invent a median save across customers we have not named.

Verify competitor pricing yourself. If a seller will not show a number, that is information.

What to tell a procurement bake-off

Ask all three camps the same four questions: How do you list historical grants? What happens when Salesloft discloses at 16:00? Where is the DSAR list from? What is labelled Beta? Write the answers in a grid. Discount demo theater. Discount our demo theater too.

What to do this week

1. Export Google Admin apps. If a push or nudge tool is already deployed, diff their list against Admin. The delta is the meeting.
2. Time a manual client-ID revoke in a test OU. That is your baseline.
3. Read CC9.2 mapping so the bake-off includes evidence, not only UX.
4. Trial ScopeMantle next to whatever you already pay for. We expect to stack, not to ransack your stack.

POC plan (three weeks, all camps)

Week 1: export Admin as ground truth. Install or already-have the push or nudge agent if that is in the bake-off. Diff their inventory against Admin. Write the delta in a shared doc. Week 2: inject a test OAuth app in a sandbox OU. See who notices, how fast, and whether historical grants from week 1 got any attention. Week 3: tabletop a vendor disclosure. Who can revoke by client ID in one motion? Who needs 400 employee clicks? Who produces a DSAR list?

Score the POC on those questions, not on UI polish. I will lose some UI bake-offs. I will not lose a Friday revoke bake-off against a nudge inbox.

Stacking, not swapping

Push plus inventory is coherent: prevent new, clean old. Nudge plus inventory is coherent: culture plus authority. Push plus nudge without inventory is a feeling. After Context.ai, feelings do not revoke tokens.

Consent firewall on our Roadmap would put us into the push column for new grants. Until it ships, we will keep the label. Buy a push tool if that is the hole. Do not wait and call waiting a control. Pricing page lists Roadmap items in the open.

What we will not say on a joint call

• A fake win rate.
• Their list price, unless they published it and you verified today.
• A customer logo they have and we do not.
• That intercept makes historical grants safe.
• That nudges satisfy CC9.2 terminate-access.

Field guide: the bake-off scorecard

Print the six questions from this article. Score 0 to 2 each. Historical grants, Friday revoke, DSAR list, Beta honesty, price transparency, refresh-path honesty. A push tool can win prevention and lose historical. A nudge tool can win culture and lose revoke. We should win historical plus DSAR plus public price. If we lose those, something is wrong with the POC, not with the category.

Consent firewall remains Roadmap. Do not let our seller pretend otherwise. $5 / $6, no seat min, custom 500+. No fake win rates. Pricing. Trial.

Mistakes I keep seeing after the first workshop

People export once and call it culture. People revoke by display name after a rebrand. People promise Entra completeness. People put OAuth rows in the user-access matrix. People send DSAR mail without a case ID. People treat a CASB invoice as grant inventory. People change a score threshold the night before audit. People staff an MSSP sprint with someone who cannot read a scope string. Each of those has a fix already on this page. The failure is skipping the fix because the demo looked polished.

Write the one thing you will not skip this week. Put it on a calendar. If you want the inventory to stay current, the 30-day trial is the productized version of the export. Five dollars per employee per month billed annually, or six dollars monthly. No seat minimum. Custom terms at 500+ employees. Microsoft Entra stays labelled Beta. HIPAA is not attested. Templates stay operator-reviewed. No fabricated customer counts on the customers page.

If you are evaluating us next to a GRC tool, keep both jobs honest. If you are evaluating us next to a consent-intercept tool, stack prevention and inventory. If you are an MSP, register the deal before the demo and keep the counsel gate in the SOW. If you are writing a board slide, use last quarter as the only benchmark we will stand behind. That is enough program for a quarter. The next quarter is whether the leftover-grant count actually moved.

A note for the evaluation committee chair

Score historical grants, Friday revoke, DSAR list, Beta honesty, price transparency, and refresh-path honesty. A pretty agent that misses last year's tokens is a pretty hole. Consent firewall is on our Roadmap, written on the pricing page. Verify everyone else's price yourself. We publish $5 / $6. We do not publish win rates. Stack tools if you can. Do not pick a religion.

What you can do without buying anything

Export the IdP list. Deduplicate on client ID. Revoke three rows you cannot explain. Write the CC9.2 versus CC6.7 sentence for your auditor. Add OAuth grants equals zero to offboarding. Put an extension allow-list in one OU. Schedule a Friday tabletop with a fictional client ID. Hash a file and put it in GRC. Those steps do not require ScopeMantle. They do require a calendar and a human who will not skip them.

When those steps start to rot (and they will, usually by week six), the productized version is daily Google and Okta sync, scores, attestation expiry, bulk revoke, and DSAR snapshot on the same inventory. Price is public. Beta labels stay on the page. We will not invent a case study to make the last paragraph feel finished. Start the trial if the calendar is already losing.

Send the six bake-off questions in writing. Anyone who will not time a client-ID revoke is selling a dashboard. Anyone who invents our customer count is done. Verify their price on their site the morning of the readout.

Related reading stays on the internal paths already linked above: platform, integrations, demo, and the companion resources or blog posts for this topic. Use those links when you brief a colleague so they get the same product truth: public $5 / $6 pricing, no seat minimum, custom at 500+, Entra labelled Beta, DSAR templates operator-reviewed, no HIPAA attestation, no invented logos. That is the briefing. Everything else is the procedure you can run this week.

Start the trial from /demo when the manual export starts to rot. That is usually week six, not week one.

Two extra sentences so the page stays useful: write the decision down, then run the next export on a calendar.