like it would be used by okta to make a decision of whether to grant the user a token or not?