It also obscures the actual trust relationships in the architecture as deployed. A lot of Okta's clients may be structured to have zero trust in their networkin

It also obscures the actual trust relationships in the architecture as deployed. A lot of Okta's clients may be structured to have zero trust in their networking infrastructure -- but as they've delegated identity management to Okta, they have total trust in Okta itself. (If a hostile third party takes contol of Okta, that party can then act as anyone -- and therefore, with any role -- they like.)