What Is a Secure Outcome? Avatier's Unit of Identity Work

A Secure Outcome is Avatier's term for a completed, verified, policy-compliant identity activity, such as a password reset, an account unlock or a lifecycle change. It is the unit of identity work in Avatier Identity Anywhere 2027™: the thing that gets recorded, the thing that becomes audit evidence, and the thing customers pay for.

Avatier founder and CEO Nelson Cicchitto frames the idea in one line: "Stop paying for identity software and start paying for identity Secure Outcomes." In his words, Identity Anywhere 2027 "changes the unit of value from software ownership to verified identity work." To understand the platform, start with that unit.

The three tests in the definition

Avatier defines Secure Outcomes as "completed, verified, policy-compliant activities." Read as a checklist, the definition sets three tests, and an identity activity has to pass all three.

1. Completed. The work finished. A reset that ran to the end is an outcome; an available feature or an abandoned attempt is not the same thing.
2. Verified. The activity is tied to a known identity and authority. In Identity Anywhere 2027, every AI assistant request "must invoke an approved Avatier capability and remain subject to authentication, authorization, delegated authority, policy enforcement, and audit controls."
3. Policy-compliant. The activity ran under the customer's rules. Avatier's September announcement puts it this way: the outcome "runs through the customer's existing policies, approvals, and roles; nothing bypasses governance, because the assistant is the interface, never the authority."

The third test is what keeps an AI assistant in its place. Per the launch announcement, "Avatier determines whether an identity action is permitted and records what occurred." The person, or the agent, asks. Policy decides.

The categories of Secure Outcome

Avatier's launch announcement names seven examples of Secure Outcomes. The plain-language descriptions in the table are general guidance on what each category covers.

Category	In plain terms
Authentication	Proving a person or agent is who they claim to be at sign-in
Password resets	Replacing a forgotten or compromised password
Account unlocks	Restoring access to a locked account
Identity verification	Confirming the identity of someone asking for help or access
Access approvals	Granting a request for access or a role under policy
Policy enforcement	Applying an identity rule to an action as it happens
Lifecycle changes	Joiner, mover, rehire and leaver changes to an identity

The seven Secure Outcome examples Avatier names, each one a completed, verified, policy-compliant activity rather than a feature.

The September launch of Avatier Actions lists the outcomes themselves. Actions exposes "more than 50 outcomes across eight modules": Password Management, Help Desk, Lifecycle Management, User Management, Group Management, Access Governance, Workflow Approval and Reports. The named actions include unlock, forgot password, change password, assisted unlock, quick and full assisted reset, verify user, request and remove access and roles, rehire and transfer. Each is a unit of work with a defined end.

For self-service resets and unlocks, see Password Portal. For the broader credential program, see Credential Governance.

The six fields every Secure Outcome records

A Secure Outcome is more than a completed task, because it carries its own record. According to Avatier's launch, "Each Secure Outcome records the identity involved, initiating agent or experience, authorization context, policy applied, action taken, and final result."

The six fields Avatier says every Secure Outcome records, shown as one itemized receipt for one completed action.

Each field answers a question an auditor or an executive is likely to ask. The questions in the right-hand column are general guidance.

Recorded field	The question it answers
Identity involved	Whose account, access or credential changed?
Initiating agent or experience	Who or what started the action, and through which channel?
Authorization context	Under what authority did it run?
Policy applied	Which rule allowed it?
Action taken	What actually ran?
Final result	How did it end?

Avatier CISO Dr. Sam Wertheim explains why those fields matter now. In his view, auditors "want to know which human or AI identity touched a regulated system, what authority it used, what policy was enforced, and where the evidence is." His position is that "if an organization cannot audit an AI-initiated identity action, it does not fully control it." He adds that Identity Anywhere 2027 "generates that evidence with every completed identity action."

As an illustration, consider an account unlock requested through an AI assistant. The six fields would capture the employee whose account was locked, the assistant and the person who asked through it, the authority the request ran under, the unlock policy that applied, the unlock itself, and whether it completed. For a deeper look at the record, see AI Agent Audit Trail: How Avatier Ledger Records Identity Actions.

How Avatier Ledger turns outcomes into evidence

Avatier Ledger, one of two Model Context Protocol (MCP) connectors Avatier announced on September 24, 2026, is where Secure Outcomes become usable evidence. It "turns every outcome into evidence and every report into a question," and through Persona Briefings it tailors the answer to the person asking.

Wertheim describes Ledger as recording "who asked, what ran, under whose authority, and what policy allowed it — for every action, human-initiated or agent-assisted." Those four questions map onto four of the six recorded fields. The announcement's summary of the result: "Same evidence, three audiences, no analyst weeks in between."

The briefings frame that evidence three ways. The CISO receives compliance frameworks blended with identity and password statistics, with remediation highlighted in 0–30, 30–90 and 90-plus-day windows. The CFO receives the same underlying data focused solely on cost and breach prevention, including "identity spend reconciled to completed actions." The security team receives exposure, dormant and orphaned access, privileged activity and the vishing surface at the help desk. For more on the three briefings, see Identity Reporting for CISOs and CFOs.

Why the Secure Outcome is the billable unit

Because each Secure Outcome is completed and carries its own record, it can also be the unit of charge. Avatier's pricing model is Pay Per Identity Action™: "customers pay only for completed, verified, policy-compliant outcomes." The announcement ties pricing and evidence together directly: "every charge is an outcome that completed, and every completed outcome already carries its receipt."

That is outcome-based identity in practice: customers pay for identity outcomes "rather than traditional user or module licenses." Avatier calls the broader model Secure Outcome-Driven Identity™. Pricing is "based on environment size, expected usage, security requirements, and the Secure Outcomes deployed." For the full model, see What Is Pay Per Identity Action™?, and for the finance view, see Outcome-Based Software Pricing: A CFO's Guide.

The commercial terms are built around the same idea. Customers are protected by the Avatier Secure Outcome Guarantee™: "If a customer is not satisfied within the first 45 days of paid service, the customer may request a refund." Getting started is free, and deployment services are included at no additional cost.

What Avatier ships toward this pattern

Avatier Identity Anywhere 2027, announced on August 4, 2026, is the AI-native identity platform built on MCP in which Secure Outcomes are defined.

Avatier Actions exposes the Identity Anywhere action set as MCP tools: more than 50 outcomes across eight modules. An employee or manager asks in Teams, Outlook, Claude or Copilot, and the outcome runs through existing policies, approvals and roles. Setup is one administrator connection, with permissions inherited from Microsoft Entra ID, Active Directory, Okta and Ping.

Avatier Ledger turns each outcome into evidence and answers questions with Persona Briefings.

Avatier's September announcement reports that a healthcare organization with more than 100,000 identities is running the platform. Full commercial terms are available to qualified organizations in the invitation-only preview.

For the platform and its live demonstration, see the Avatier Identity Anywhere 2027 site. For the company, see avatier.com. For security and compliance documentation, see the Avatier Trust Center.