Atomicwork vs Siit (2026)

Coworkers act in outside systems through native integrations and MCP tools, including SharePoint, Microsoft Teams, Azure Active Directory, Intune, Okta, ADP, Workday, Slack, ServiceNow, Jira Service Management, JumpCloud, Entra ID and Salesforce. They provision and deprovision access, refresh stale tokens and run RCAs, and every tool call runs under deterministic execution policies scoped to named capabilities.

Sourceatomicwork.com/features/ai-workforceread 2026-09-08

More than 100 ready to use integration providers come as a plan entitlement. Named systems span HRIS (Workday, BambooHR, Rippling), device management (Kandji, Jamf, Microsoft Intune), identity (Okta, Microsoft Entra ID, Google, JumpCloud, Active Directory), ticketing (Jira Service Management, Zendesk) and documentation (Notion, Confluence, Google Workspace). Siit writes into systems it does not own.

Automated app access management lets a customer define who can request each app, routes approvals automatically and provisions access through the identity provider, with an audit trail on every request. Time based deprovisioning grants access for a set duration and revokes it automatically when it expires, so temporary access never lingers. Siit grants and revokes access to third party SaaS apps through the customer's identity provider, unattended and on a timer.

App discovery works the other way, filling the app list by connecting Google, Okta, Entra ID or JumpCloud. Siit's own API can add a user to an application and remove one, with the deprovisioning state shown in the response. Equipment, Application, Date, People and Request workflows each act on connected systems, and Custom Webhooks send real time data from Siit to other systems to trigger actions instantly.

Sourcesiit.io/pricing feature matrix, with developer.siit.io API referenceread 2026-09-12

Multi-coworker swarms investigate, act and close together. Smart routing tags in and hands off work across IT, HR, Finance and Legal, every handoff carries the full history, and humans are escalated in with the full picture. In a typical handoff the Device Ops coworker pulls in Network Ops, or the Incident Manager pulls in the Access Manager. The Business and Enterprise plans add multi-agent orchestration, and AI workflows come on every plan.

Sourceatomicwork.com/features/ai-workforceread 2026-09-08

Work is composed across systems and object types.

A no code automation engine with approval logic and fallback routing runs five workflow families, sold as separate plan entitlements (Equipment, Application, Date, People and Request), so a single onboarding flow can create a user, grant application access through the identity provider, assign equipment from inventory and open the requests that need human hands, each acting on a different object in a different system. Routing is conditional and stateful.

It can go by availability, so nothing lands with an admin outside working hours, by round robin, to level load across an inbox, or by group assignment to a team inbox. Escalation and reassignment are built in, and the API can update assignees as long as the assignee admin belongs to the assignee inbox. Flows pause for people and resume.

Request Approvals ask a manager or stakeholder to validate, and automated app access management routes approvals before provisioning, so the flow holds mid execution and continues on a human decision. The service model follows ITIL. Incident, Change and Problem Requests are separate named types, each a process with stages: Change Requests plan, track and implement IT changes with minimal risk, and Problem Requests find the root causes of recurring issues.

Each request has distinct participants, namely the requester, the admin who resolves it, approvers who are managers or stakeholders, followers kept informed, team inboxes acting together, and on the Pro tier the AI agent that resolves requests on its own. Workspaces let several teams run their own flows on one account.

Sourcesiit.io/pricing feature matrix, with developer.siit.io API referenceread 2026-09-12

Coworkers run on schedules for nightly cleanups, weekly reviews and monthly audits, and on events. An Incident Ops Engineer detects and triages incidents before humans are paged, an Incident Manager monitors third-party SaaS incidents, and ticket-event workflows act on ticket activity, so a reply classified by sentiment on an open ticket can trigger escalation or closure. Channels are chat, voice, email and portal on every plan, with Slack, Teams and a browser extension.

Sourceatomicwork.com/features/ai-workforceread 2026-09-08

Workflows run on triggers based on requests or people, from request created or service assigned to start date, birthday or work anniversary, which makes two event triggers and three date triggers. Workflows also come in five families named for the object that fires them, Equipment, Application, Date, People and Request. Alerts are a separate mechanism.

Custom Alerts are notifications triggered by conditions like SLA breaches or inactivity, so they fire on the absence of an event as well as its presence, and SLA Management monitors response and resolution times. Time based deprovisioning revokes access when a grant expires, a scheduled action with no person present. Custom Webhooks send real time data from Siit to other systems to trigger actions instantly, so Siit is an event source as well as a consumer.

Every plan, including the entry tier, has a Slack Bot, a Microsoft Teams Bot, an Email Channel and a Self-Service Portal where employees browse the service catalog, and Broadcasts send targeted messages on Slack or by email. Routing on arrival is conditional, with availability based routing sending work only to admins inside their working hours and round robin spreading it across an inbox.

Sourcesiit.io/pricing feature matrixread 2026-09-12

Each customer's knowledge sits in a self-hosted vector database in its own tenant, and customers control what is crawled and indexed across knowledge sources and conversations. Access control lists are inherited from the source systems or configured in Atomicwork. Coworkers are grounded in the customer's policies, people, assets and history through retrieval-augmented generation over knowledge base content and IT asset metadata, querying a persistent, permission-aware index.

Sourceatomicwork.com/securityread 2026-09-08

Alongside reading other systems, Siit keeps its own knowledge store. The API manages articles through a full lifecycle, listing, creating, retrieving, updating, publishing, unpublishing, archiving and unarchiving them, and List Categories returns top level categories and subcategories with a parent field to rebuild the hierarchy. Publish and archive states give editorial control, and the category tree keeps the store curated. Synced content joins the same corpus.

The knowledge base is a central place for articles from Siit or connected systems like Confluence and Notion, with related data, on every plan including the entry tier, and Google Workspace is named alongside. The assistant draws on Notion, Confluence and Google Workspace together with Siit's own articles. Retrieval is proactive, since AI Article Suggestions scans the knowledge base and recommends relevant articles to employees before they submit a request. People records, the app inventory and the equipment inventory also give the agent structured context about who is asking and what they hold, from the customer's own application data.

Sourcedeveloper.siit.io article endpoints and siit.io/pricing feature matrixread 2026-09-12

Persistent memory is a component of each coworker's agent harness alongside goals, permissions, tools and guardrails, scoped to that coworker, and handoffs carry the full history between coworkers. Atomicwork does not state how long memory lasts, where it is stored or how a customer deletes it, and no state carries over between sandboxed executions.

Sourceatomicwork.com/blog/ai-workforce-launchread 2026-09-08

There is no agent memory. One platform holds employee records, assets, permissions and request history so every request carries full context, but that is the customer's application data. It sits under Data Management as people records with employee details, request history and linked assets, an app inventory of SaaS applications with linked people, and an equipment inventory of hardware and its assignees.

These are asset and HR registers, which persist because they are a database, as in a CRM or ERP. Siit says institutional knowledge compounds with each interaction, which describes the corpus filling up as tickets are answered, and it does not say that what compounds can be retrieved, scoped, inspected or tied to a run.

The AI features are exactly three, AI Article Suggestions, Agents and AI Agent Analytics, and no plan item names memory, retained context, agent state or personalization carried between requests.

The agent keeps no requester preference to reapply, no correction that carries to the next ticket and no decision trace across sessions, Siit gives no scope or lifetime for agent state, and there is no way to inspect, edit, export or purge it apart from the people, asset and request records.

Sourcesiit.io/pricing feature matrix, with developer.siit.io resource listread 2026-09-12

Sensitive actions pause for human sign-off before executing. A coworker that hits its spend cap pauses for review until a manager approves more credits, reassigns it or retires it. Each coworker carries a defined scope, standing rules and an escalation plan that hands off to a human with full context, and deterministic execution policies restrict what a coworker can read and modify. Access provisioning, suspension and employment-related decisions include human review before they are acted on.

Sourceatomicwork.com/features/ai-workforceread 2026-09-08

Approvals are a product object with their own API. On every plan, including the entry tier, a request can trigger validation from a manager or stakeholder, and approvals can also be built into automated workflows. The API can request an approval, list approvals across all requests the user can access, list the approvals for one request and retrieve an approval. The approval sits in front of the consequential action.

Automated app access management lets a customer define who can request each app, routes approvals automatically and provisions access through the identity provider, with an audit trail on every request. The approval stands between the request and the provisioning call, and the decision is recorded against the grant. Time based deprovisioning bounds what an approval can grant, so approved access cannot outlive its window. Siit also describes clean handoffs when the agent escalates, and rapid approvals with fallback rules.

On the Pro tier the agent resolves requests on its own and hands off with context when a request needs judgment, through group assignment to a team inbox, followers who keep stakeholders informed, availability based routing so the handoff reaches someone on shift, and satisfaction ratings on how the request was handled. There is no review step for the AI agent's own replies to employees before they are sent. Approvals cover access provisioning and workflow actions, the operations that cannot be undone.

Sourcesiit.io/pricing feature matrix and developer.siit.io approval endpointsread 2026-09-12

Atomicwork holds SOC 2 Type I and Type II, ISO 27001, 27017, 27018, 27701 and 42001, CSA STAR Level 1, Microsoft 365 and CASA Tier 3 certifications, and has announced a SOC 2 Type 2 renewal. Its privacy policy still describes ISO 27701 and 42001 as in progress, though SOC 2 Type II and ISO 27001 appear in both the policy and the certification list.

Access runs through SSO with the customer's enterprise IAM, and customers can bring their own identity provider. Role-based access control applies, content ACLs are inherited or configured, coworkers inherit the requesting user's identity and roles with no standing elevated access, and comprehensive audit logs are kept.

Sourceatomicwork.com/securityread 2026-09-08

Siit holds SOC 2 Type II and is GDPR compliant, and both link to a Trust Center at trust.siit.io. SOC 2 Type II compliance is listed on every plan, and Siit describes itself as GDPR compliant and SOC 2 Type 2 certified. Siit says it ensures data confidentiality, integrity and availability. Every plan includes role based access control, which assigns roles and permissions, and SSO with Google, Microsoft and Okta using company credentials.

The API enforces the permission model. Request listings are scoped to what the API key owner can see, requests outside that scope return 404 instead of being filtered, and an assignee admin must belong to the assignee inbox. Workspaces, team inboxes and group assignment give the model its shape.

The wider program covers logical tenant separation, encryption in transit at TLS 1.2 and 1.3 and at rest with AES-256, a web application firewall and DDoS protection, regular vulnerability scanning, network and perimeter protection, incident monitoring, vendor risk management, and security education and awareness training. There is a trust center and a public status page. No SCIM provisioning is named, and the SOC 2 report's scope and date are not published.

Sourcesiit.io/security and siit.io/pricing feature matrix and FAQread 2026-09-12

Every coworker run is logged with a full audit trail and is explainable. Comprehensive audit logs detail who accessed what and every operation performed within the platform, every answer links back to its source, and continuous monitoring tracks coworker performance. Audit logs are retained for 12 to 24 months, and they are kept on the same platform the coworkers run on.

Sourceatomicwork.com/securityread 2026-09-08

Two things show what the agent did. AI Agent Analytics, its own line item in the AI group and separate from the request dashboards, gives real time and historical insight into IT agent performance. An audit trail covers the agent's most consequential work, since automated app access management keeps an audit trail on every request. Access grants and revocations are the irreversible things Siit does, and each carries a record.

Through the API the trail can be read and attributed: approvals can be retrieved for each request, messages and private notes are listed, status and assignee changes have their own endpoints, and archive and unarchive are recorded transitions. Data exports download dashboard reports in several formats to share or analyze offline, beside an Analytics Dashboard covering requests, assets and performance. A public status page at status.siit.io covers service availability.

Enterprise grade reporting tracks resolution rates, costs, SLA performance and bottlenecks, and every service request is logged. Those measure the customer's support operation, not the agent. AI Agent Analytics sits on the Pro plan alongside the agents it measures. Siit does not publish the audit trail's fields, retention or detail for individual agent runs.

Sourcesiit.io/pricing feature matrix, with developer.siit.io API referenceread 2026-09-12

Customers choose where coworkers run and where data sits. They can bring their own execution infrastructure, model endpoints and vault, each customer's data sits in a self-hosted vector database in its own tenant, and enterprise applications are reached through a self-hosted iPaaS. The Enterprise plan carries custom data residency, data residency options exist in approved regions, and LLM and cloud sub-processors apply by the customer's region. Atomicwork does not name the regions.

Sourceatomicwork.com/securityread 2026-09-08

Delivery is SaaS on AWS, with no region named and no hosting choice. Siit runs on AWS with network and perimeter protection. It names no region, residency choice or customer hosted option on any plan, including the Custom enterprise tier.

There is no self hosting, hybrid worker, single tenant deployment or bring your own cloud, and Siit names logical tenant separation, which describes a multi tenant architecture.

Siit S.A.S is a French company selling GDPR compliance to European customers, including named EU customers, and it publishes no EU hosting commitment, so a customer with a data localization requirement has nothing to work from.

Sourcesiit.io/security and siit.io/pricing feature matrixread 2026-09-12

Seven named coworkers shipped at launch, the Device Ops Engineer, Network Ops Engineer, Cloud Ops Engineer, Access Manager, Incident Manager, SecOps Engineer and HR Ops Specialist. Every plan includes four prebuilt coworkers, the ITOps Support Engineer and the Access, Workflow and Service coworkers, and a catalog lists them by role, each owning a distinct role. Skills are packaged as portable units, and customers can also build custom coworkers.

Sourceatomicwork.com/blog/ai-workforce-launchread 2026-09-08

Siit ships reusable structures that the customer fills. A service catalog, a structured list of services for employees with categories that help admins manage requests, backs a self service portal where employees browse the catalog and submit requests. Service Forms gather the right details for each type of request. Three ITIL request types (Incident, Change and Problem) ship as structured models instead of blank tickets, and the API can create and update Services. The catalog holds the customer's own services, forms hold fields the customer defines, and the request types are process shapes, not working units.

Siit publishes no ready to run content of its own, with no library of prebuilt workflows, no starter automations for common IT tasks and no agent presets. Agents are one capability on the Pro plan, not a set to choose from, and there is no catalog of prebuilt agents. The five workflow families (Equipment, Application, Date, People and Request) are listed separately, but Siit does not say whether they are prebuilt bundles a customer installs or trigger categories a customer builds within.

Sourcesiit.io/pricing feature matrixread 2026-09-12

Customers can bring their own model endpoints, including endpoints under their own enterprise DPA, and the Enterprise plan adds custom models, harnesses and runtime. Atomicwork uses three LLM sub-processors, Microsoft Azure OpenAI Service, Anthropic and AWS Bedrock, applied by the customer's region and configuration. Within a coworker's configuration the platform routes each job to a lightweight or advanced model automatically, beneath whatever model the customer has chosen.

Sourceatomicwork.com/securityread 2026-09-08

The assistant is AI powered, but the underlying model is not disclosed and the customer has no choice of model. Siit names AWS as its cloud provider and names no model provider or AI subprocessor. No plan, including the Custom enterprise tier, offers a model, provider, routing or bring your own key option, and the AI features are three, AI Article Suggestions, Agents and AI Agent Analytics.

Siit connects to MCP compatible AI tools like Claude or Cursor, but that is the customer's own assistant calling Siit, and choosing that assistant does not choose the model that runs Siit's triage, article suggestions or agent resolution. Siit does not say it routes across more than one model internally either.

Sourcesiit.io/pricing feature matrix and siit.io/securityread 2026-09-12

Atomicwork's native MCP server lets Claude, Codex, Cursor and any MCP-compatible client connect to the customer's Atomicwork tenant to query tickets, create incidents, manage service requests, look up users and browse the service catalog. There is no public API or SDK documentation for the platform itself.

Sourceatomicwork.com/pricingread 2026-09-08

Siit offers a public, versioned REST API and an MCP server. The base URL is api.siit.io with a /v1 suffix, resources carry prefixed UIDs, the rate limit is 60 requests per minute with X-SiitApi-Limit, X-SiitApi-Remaining and X-SiitApi-Reset response headers, and Authentication, Pagination and Errors each have their own page. An OpenAPI specification is published at /api-reference/openapi.yml. The API reads and writes, and the writes reach consequential actions.

Full CRUD covers Applications, Articles, Departments, Equipment, Legal Entities, Office Locations, Requests, Services, Teams and Users. Add a User to an Application and Remove a User from an Application provision and deprovision application access, and a user stays listed while their app_access origin carries status waiting_deprovisioning. Alongside them are Update status, Update assignees, Send a message, Send a private note, Request an approval, Archive and Merge User, and Publish, Unpublish and Archive an Article.

An outside caller can grant someone access to a SaaS application through this API. The MCP server has its own documentation page, and MCP connectivity is a plan line item that connects Siit to MCP compatible AI tools like Claude or Cursor, with access scoped to the features and permissions in the customer's plan. The API is available during the trial and on the Standard and Pro plans, Open API Access is a tiered entitlement, and the 14 day free trial reaches it without a card.

Sourcedeveloper.siit.io API reference and llms.txt index, with siit.io/pricingread 2026-09-12

Coworkers get evals and feedback loops after deployment, with a review cycle that can run weekly because the data is already in the system, and Atomicwork tunes the coworkers themselves. Performance reporting and tuning for custom coworkers come on the Business and Enterprise plans. Atomicwork does not describe the evaluation harness itself, and the evaluations and red-teaming in its privacy policy are its own engineering practice, not a feature customers use.

Sourceatomicwork.com/pricingread 2026-09-08

Agent performance is measured, but nothing tests a change before it goes live. AI Agent Analytics, a Pro plan entitlement, gives real time and historical insight into how the IT agent performs. Satisfaction ratings collect feedback on request handling, and knowledge gaps are found automatically as the AI learns which questions lack good answers, which shows where the agent falls short.

There is no test environment, sandbox, dry run, holdout, A/B comparison, evaluator or scored verdict on agent behavior, and no versioning of agent configuration or workflow definitions. The API returns workflows read only, with no create, update or version endpoint. A change to a workflow or the knowledge base takes effect at once, with no gate before it goes live and no readable comparison of before and after. There is no formal agent testing framework.

Sourcesiit.io/pricing feature matrix, with developer.siit.io workflow endpointsread 2026-09-12

Coworkers act through MCP tools and native integrations inside sandboxed execution, without browser, desktop or computer control. The Universal AI Coworker resolves issues with voice and vision AI, a browser extension and screen share, through which Atom reads the user's on-screen context and walks the user through a fix.

Sourceatomicwork.com/securityread 2026-09-08

Siit acts through system integrations and power actions, not by driving a browser or a computer. It always works through an API. Access is provisioned through the identity provider, app inventories fill by connecting Google, Okta, Entra ID or JumpCloud, and Siit's own API can add a user to an application and remove one. Across more than a hundred connectors the pattern is authenticated service to service calls, and outbound events go out as webhooks.

Nothing in the product reads a rendered page, so a connected SaaS app changing its interface does not affect it. There is no hosted or local browser, desktop session, remote or local computer control, RPA or recorder. The equipment inventory tracks devices as records and does not operate them, and app discovery reads identity provider directories. The Slack and Teams bots work inside another vendor's chat client as first party apps on documented platform APIs, invited by the customer and speaking through published endpoints.

Sourcesiit.io/pricing feature matrix, with developer.siit.io API reference and siit.io/securityread 2026-09-12