Onetab vs Play (2026)

Stands at F, and it is now among the best-founded Int cells in the lane rather than resting on three examples. TWENTY INTEGRATIONS ARE NAMED INDIVIDUALLY, EACH WITH ITS OWN DESCRIPTION AND FEATURE LIST: Gmail, Notion, Airtable, Salesforce, HubSpot, Jira, Linear, Google Drive, Microsoft 365, Stripe, Xero, Snowflake, Zendesk, Intercom, ServiceNow, Segment, Mixpanel, Mailchimp, Figma and Workday. BREADTH ACROSS CLASSES IS NOT IN QUESTION and the spread is genuinely wide: email, knowledge bases, databases, two CRMs, two issue trackers, file storage, a full productivity suite, payments, accounting, a data warehouse, two support platforms, IT service management, a customer data platform, product analytics, marketing automation, design and an HRIS. That is most of an enterprise stack, and it is the distinction between a claimed count and documented coverage. TOOL CALLING IS BIDIRECTIONAL AND STATED PER INTEGRATION rather than in the abstract. Play triggers workflows from Gmail messages and Airtable record changes, syncs Notion docs two ways, enriches HubSpot contacts, routes Zendesk tickets with auto-escalation, automates ServiceNow change requests, queries Snowflake and triggers on data changes, and syncs Workday employee data for onboarding automation. Those are writes and reads, not read-only feeds. THE PERMISSION MODEL TRAVELS WITH THE CONNECTIONS: the vendor's framing is connecting the tools you already use WITH PERMISSIONS AND SECURITY BUILT IN, and encrypted connectors are named on the enterprise page. Credited on Sec and noted here only because it is what makes the breadth usable in the regulated environments this targets. What is not documented is a custom connector path, a webhook builder or an integration marketplace beyond the twenty named, so extension beyond the catalogue is unestablished; that question is graded on Ext.

Stands at P, re-based onto the product page, and the July basis was right that agent-level orchestration specifics are light. WHAT IS DOCUMENTED. A CUSTOM WORK APPS AND WORKFLOW BUILDER on the enterprise page, and AUTOMATED TASK DELEGATION on both product and enterprise pages, with coworkers handling task triage, follow-ups and status updates autonomously. The example prompts describe genuinely multi-step systems: a monthly close tracker with automated reconciliation and approval routing, an onboarding workflow that assigns tasks, tracks progress and sends reminders, a release hub with deploy checklists and incident tracking. Those are sequenced processes with handoffs, and STANDARDIZE PROCESSES ACROSS TEAMS is one of the four enterprise outcomes. WHY IT HOLDS AT PARTIAL. Nothing documents multi-agent coordination: there is no orchestrator, no delegation between coworkers, no agent-to-agent handoff and no shared context between agents. Coworkers are described individually, each handling its own work. Nor is control-flow vocabulary named anywhere: no branching, looping, conditional or parallel construct appears, and no visual flow surface is shown. The workflow builder is asserted rather than described. THE DISTINCTION WORTH KEEPING is that this platform orchestrates WORK, through tasks, boards, forms and dashboards in the Clarity template, rather than orchestrating AGENTS. Those are different capabilities and this axis measures the second. A work operating system with autonomous helpers attached is a coherent product and is not the same as a multi-agent runtime. CONFIDENCE MEDIUM. The application at work.play.fast is where an orchestration surface would be visible and was not read, and the help centre was not read either. Given a free signup exists, this is among the more resolvable cells on the record at lane close.

Stands at P, and the event class is now documented far better than the July basis showed, while the two other classes remain absent. THE EVENT CLASS IS BROAD AND NAMED PER INTEGRATION, which is unusual: EMAIL-TRIGGERED WORKFLOWS from Gmail, CHANGE-TRIGGERED ACTIONS from Airtable record changes, TRIGGER-BASED WORKFLOWS from HubSpot, real-time updates and process alerts from Salesforce, EVENT-DRIVEN WORKFLOWS from Intercom customer events, BEHAVIORAL TRIGGERS from Segment user behaviour, USAGE-BASED TRIGGERS from Mixpanel trends, WORKFLOWS from Snowflake data changes, and ticket routing with auto-escalation from Zendesk. Twenty integrations each naming what fires from them is a genuinely wide set of event sources. THE CHANNEL CLASS IS THIN AND THAT IS WHAT HOLDS THE GRADE. Work reaches an agent inside the Play workspace itself, and the Communicate template provides channels, threads and huddles for people. But no chat, messaging, voice or embedded surface through which a person addresses an AI coworker outside the workspace is documented. Gmail is an event source rather than a conversational channel; the agent reads mail, it does not answer as a correspondent. THE SCHEDULE CLASS IS ABSENT. No timer, cron or recurrence appears on any page reached, though example prompts reference a MONTHLY CLOSE TRACKER and summarising trends WEEKLY, which implies recurrence without documenting a mechanism. I have not credited a class from an implication. SO ONE CLASS IS RICH, ONE IS WORKSPACE-ONLY AND ONE IS UNDOCUMENTED, which is Partial. That is a coherent shape for a product whose premise is that work is centralised in one place rather than distributed across channels: consolidating the workspace is the pitch, so reaching agents from outside it is a lower priority by design. Confidence medium; the help centre was not read and would likely settle the scheduling question.

Stands at P, re-based, with the grounding source identified even though the mechanism is not. WHAT AGENTS GROUND ON IS THE WORKSPACE ITSELF, and the vendor is explicit that this is the design: CONTEXT IS ALREADY BUILT IN, DEPLOY AI COWORKERS THAT REQUIRE NO BRIEFING, THEY LIVE WHERE THE WORK HAPPENS AND ALREADY KNOW WHAT NEEDS ATTENTION, alongside CONTEXT-AWARE AI COWORKERS and a CENTRALIZED DATA HUB. Coworkers operate inside the same system holding the tables, tasks, dashboards and conversations, so grounding is proximity rather than retrieval. THE INTEGRATION LAYER FEEDS IT and is well documented: twenty connectors pull records, documents, tickets, warehouse data and customer events into that hub, so the grounding corpus is the customer's operational data rather than an uploaded document set. For the work these coworkers do, summarising reviews, drafting from notes, checking documents against guidelines, that is the right substrate. WHY IT HOLDS AT PARTIAL. No retrieval mechanism is documented anywhere reached: no vector store, no embedding, no knowledge base object, no document ingestion path, no chunking and no citation of sources in output. The persistence line is arguably satisfied by the workspace being durable, but a durable application database is not the same as a maintained retrieval structure, and treating every system of record as a knowledge layer would collapse this axis into the integration one. THE HONEST READING FOR A BUYER: an agent here knows what is in your Play workspace because it lives there. Whether it can answer from a two-hundred-page policy document you upload is not established anywhere on the site. Confidence medium. The help centre and the running application were not read, and a knowledge or document feature would most likely be documented in the former.

P>F under the accumulation route of the 31 August ruling, which the vendor states across two pages in three different forms. THE CLAIM IS ACCUMULATION, NOT SESSION STATE: SHARPER EVERY WEEK, LET YOUR AI COWORKERS LEARN FROM YOUR TEAM'S ACTIONS, ADAPTING TO YOUR PROCESSES AND GETTING SMARTER OVER TIME. Learning from a team's actions over weeks is behaviour changing as a result of what happened before, which is the ruled Full condition. THE COMPETITIVE FRAMING IS THE MOST USEFUL EVIDENCE and it is unusually direct. The enterprise page's comparison sets AI CO-WORKERS THAT LEARN YOUR BUSINESS, NOT JUST YOUR PROMPT against the alternative it names as DISPOSABLE AI WITH NO PERSISTENT CONTEXT. A vendor defining its position by the presence of persistent context is asserting it as a property rather than mentioning it, and would be contradicting its own comparison table if the state did not survive. THE THIRD FORM IS THE ONE A BUYER NOTICES: CONTEXT IS ALREADY BUILT IN, DEPLOY AI COWORKERS THAT REQUIRE NO BRIEFING, THEY LIVE WHERE THE WORK HAPPENS AND ALREADY KNOW WHAT NEEDS ATTENTION. An agent that needs no briefing is one holding state it did not receive in the prompt. CONFIDENCE IS MEDIUM AND THE LIMITS ARE REAL. This is capability claimed on product pages rather than a documented mechanism: no memory store, retention period, per-user keying, inspection surface or means of correcting what a coworker has learned appears anywhere reached. For a platform whose Obs cell rests on auditing every AI action, being unable to inspect what an agent has learned is a gap worth a buyer's question. The persistent workspace cited in the July basis is the application's data layer and is not the same thing; this cell now rests on the learning claim.

F>P. This is a reading correction on the recorded fact rather than a retrieval finding, which is why it can be made even though I could not re-reach the cited pages this pass: the question is which axis the fact answers, not whether the fact is true. WHAT THE BASIS SAYS: administrative controls govern EXACTLY WHAT DATA AND ACTIONS AGENTS MAY ACCESS. That is permission scoping. It bounds an agent's reach in advance, which is a genuine guardrail and is why this holds at Partial rather than falling further. WHY IT IS NOT FULL. Nothing in it pauses an agent mid-run pending a person's decision. Scoping what an agent MAY do and requiring a human to approve what it IS about to do are different mechanisms, and this axis asks primarily for the second. No checkpoint, approval step, pending-action queue or reviewer surface appears in any material reached across two passes. THE SAME FACT WAS ALSO CARRYING SEC, where the basis reads enterprise identity, provisioning, procurement and permissions. One access-control model was being counted twice, on the axis that measures security posture and on the axis that measures oversight of agent behaviour. Under the standing rule that one fact never works two axes, it is spent once. Sec is the more natural home for a permission model, and the residue here is what makes this Partial rather than None. THE CISO FRAMING IS POSITIONING AND IS NOT GRADED. An AI safety net that CISOs approve describes who the product is sold to, not a mechanism, and crediting it would be the governance-essay error section 7 warns against. Recorded for the lane: this is the third record this session where an access-control model presented as human oversight. The test that separates them is whether a person is in the loop at run time or only at configuration time.

Stands at P, but on a much stronger control surface than the July basis had, and confidence rises from medium to high because the absence is now observed rather than unfound. FIVE NAMED CONTROLS, EACH WITH A DESCRIPTION on the enterprise page: SSO integrating with the customer's identity provider; SCIM PROVISIONING automating user lifecycle management and keeping access synchronised; DEPLOY IN YOUR OWN VPC; ENCRYPTED CONNECTORS covering all data in transit between Play and connected applications; and PERMISSION MANAGEMENT implementing granular access controls so users see only the data and functionality their job requires. The enterprise comparison adds that permissions are SYNCED WITH YOUR IDENTITY PROVIDER, ENFORCED AT EVERY LEVEL. SCIM IS THE ENTRY THAT MATTERS MOST and is uncommon at this stage of company. Automated deprovisioning is the control that closes the orphaned-account gap, and it is the one an enterprise identity team asks about after SSO. Together with identity-provider-synced permissions it means the platform does not maintain a parallel access model that drifts from the customer's. WHY IT DOES NOT REACH FULL. The F bar is a conjunction requiring an attestation or certification alongside a named control, and no certification appears anywhere across the homepage, enterprise page, product page or footer. No SOC 2, no ISO, no trust centre, no report request path. The nearest statement is BUILT FOR REGULATED ENVIRONMENTS, PLAY'S FOUNDATION AND VERIFIABLE CONTROLS ALLOW CONFIDENT OPERATIONS IN REGULATED INDUSTRIES. Verifiable controls is not an attestation; it asserts that controls could be verified, not that anyone has. THAT IS THE HEDGE WORTH NAMING, and it belongs on the ladder below the two cases decided today: joget states ISO 27001:2022 CERTIFIED and reaches Full, altilia states ALIGNED WITH and sits at Partial, and Play states neither while shipping the deeper control surface of the three. Controls without attestation is precisely the half-conjunction the bar places at Partial. A certification would move this cell immediately, and for a company selling to CISOs it is the obvious next artefact.

P>F. The enterprise page makes a specific and unusually complete claim: FULL AUDIT TRAIL ACROSS EVERY AI ACTION, USER, AND ACCESS EVENT. THREE SUBJECTS IN ONE SENTENCE IS WHAT MAKES IT STRONG. AI action covers what the coworker did, user covers who directed it, and access event covers what data it touched. Most audit claims in this lane cover one of those. Covering all three is what lets an operator answer the question this axis exists for: not merely that something happened, but who set it in motion and what it reached. THE WORD EVERY IS DOING REAL WORK and the vendor has chosen to stake the claim without qualification. That is a strong commitment for a governed workspace sold on the promise that CISOs approve it, and the surrounding page is built around exactly that argument, contrasting the platform against SHADOW AI ADOPTED BY 40 PERCENT OF YOUR ORG WITHOUT OVERSIGHT and NO GUARDRAILS ON WHAT AI CAN ACCESS OR WHO CAN BUILD WHAT. THE ACCESS-EVENT LIMB TIES TO A REAL MECHANISM rather than standing alone: permissions are synced with the customer's identity provider and enforced at every level, so an access event is recorded against an identity the customer administers rather than against an internal service account. CONFIDENCE IS MEDIUM AND THE GAP IS NAMED. I read the claim on a product page, not a description of the artefact: no example record, retention period, export path or dashboard is documented, and the help centre at help.play.fast was not read this pass. A vendor asserting a full audit trail is a materially different position from one documenting its fields, and this is the first thing to verify if this cell is relied on. The dashboards and admin visibility cited in the July basis are reporting and are subsumed by this.

P>F. The enterprise page documents a customer-controlled deployment mechanism, which is this axis stated plainly. DEPLOY IN YOUR OWN VPC IS A NAMED CAPABILITY WITH A DESCRIPTION, not a bullet: HOST PLAY IN YOUR VIRTUAL PRIVATE CLOUD FOR MAXIMUM DATA ISOLATION AND CONTROL. That is the customer choosing where the software runs and where the data sits, which is the top of this axis, and it is repeated on the homepage security block. BUY VIA AWS MARKETPLACE IS THE CORROBORATION THAT MATTERS. A marketplace listing is a procurement route with a real operational precondition behind it, and it sits naturally beside a VPC deployment: the customer transacts through their existing AWS agreement and runs the software in their own account. Together they make the deployment claim a purchasable path rather than a sentence, which is the distinction that held ai-library and agentx at Partial earlier today. ENCRYPTED CONNECTORS COMPLETE THE DATA PATH: all data in transit between Play and connected applications is encrypted, so the integration layer does not undo the isolation the VPC provides. WHAT IS NOT DOCUMENTED is region selection within Play's own hosted offering, and no on-premises or air-gapped option is claimed. Neither is required: a VPC deployment answers the residency question for the buyers this targets, and the vendor states the platform is built for regulated environments. RECORDED FOR THE PAIRING: this cell moved because a page was read that had always been linked from the homepage. It is the clearest single consequence of the retrieval failure corrected on this record, and it is the difference between a vendor appearing to have no deployment story and having a good one.

Stands at F and clears the 31 August bar in its clearest form: a browsable catalogue, individually addressable, each entry with its own page. FIVE TEMPLATES, NOT FOUR. The July basis named Winning, Prism, Clarity and Communicate and missed INSIGHT, a keyboard-first spreadsheet for CSV imports, typed tables, grouped views, range selection, charting and shareable saved views. The full set is Insight, Prism, Communicate, Winning and Clarity, each with a page under /templates and a direct use link. EACH IS A WORKING SYSTEM RATHER THAN A SCAFFOLD, which is what separates Full from Partial on this axis. Winning is a CRM command centre for deals, contacts, accounts and reports with SEVEN READY-TO-RUN SALES TEMPLATES nested inside it. Clarity is a work operating system spanning table, kanban, gantt, calendar, form and dashboard views. Prism turns CSV or JSON into a live dashboard with computed fields and governed sharing. Communicate ships channels, threads, huddles, statuses and clean inboxes. THE ROLE ROUTING IS THE DETAIL WORTH CARRYING. The same template is offered with a role parameter, so Communicate is presented differently for sales handoffs, launch rooms, recruiting threads and support inboxes, and Clarity differently for product roadmaps, marketing campaign ops and engineering execution. One asset, contextualised per function, which is a more honest form of a departmental library than five near-identical copies. THE VENDOR'S OWN FRAMING is that customers START FROM TEMPLATES INSTEAD OF REBUILDING THE SAME OPERATING SYSTEM FROM SCRATCH, which is the adoption claim this axis asks for. One limit: these are workspace and application templates rather than packaged AI coworkers. The coworkers are created from natural-language prompts, and the example prompts shown by industry are illustrations rather than adoptable assets.

Stands at N, with confidence raised from low to high. The grade was right and the confidence understated what kind of absence this is. THE VENDOR NAMES ITS MODEL PROVIDER: the platform is built on Google Cloud with Claude from Anthropic. Under the standing convention a vendor naming a single provider is the BEST-EVIDENCED absence on this axis, because the absence is visible rather than inferred from a failed search. A buyer reading this learns what powers the product and that they do not choose it, which is exactly what the grade should convey. THAT IS A DIFFERENT AND STRONGER POSITION than the low-confidence N cells elsewhere in this batch, where nothing was named and the grade rested on not having found a picker. Here there is nothing to find: the vendor has told us. NO SELECTION MECHANISM OF ANY KIND IS DOCUMENTED: no model picker, no bring-your-own-key, no endpoint configuration, no per-agent model setting and no routing. Naming Anthropic as a technology partner in a launch announcement is a partnership disclosure, not an offer of choice. THIS IS COHERENT FOR THE PRODUCT rather than a gap, and the note should say so. Play sells a governed workspace to business teams and CISOs, with the pitch being that everything is administered together. A single vetted model is consistent with that: the customer is buying a controlled environment, not a construction kit, and offering model choice would expand the surface the security story has to cover. RECORDED AS A PAIRING FOR THE LANE: this and joget sit at opposite ends of the same axis for structurally opposite reasons. Joget reaches Full on five LLM services plus bring-your-own-key because it is an open-source platform whose premise is customer control; Play sits at None on one named provider because its premise is a closed governed environment. Neither is a defect; the grade is describing a product decision.

Stands at P, and the grade is now founded on three pages read rather than on not having found anything. WHAT IS DOCUMENTED IS A BUILDER, NOT A DEVELOPER SURFACE. The platform's extension story is a CUSTOM BUILDER with EVOLVING DATA MODELS and CUSTOM WORK APPS AND WORKFLOW BUILDER, through which a business user describes what they need in plain English and receives a working application. That is real extensibility of a kind, and it is why this is Partial rather than None: a customer genuinely changes what the platform does without waiting for the vendor. BUT IT IS THE WRONG DIRECTION FOR THIS AXIS, which asks whether the platform is callable from outside through a documented API or SDK. Building inside Play is not the same as Play being reachable from a customer's own code. A SECURE INTEGRATION LAYER is named on the product page, and the twenty connectors it refers to are inbound reach, credited on Int. THE ABSENCE IS NOW OBSERVED RATHER THAN ASSUMED. No API, SDK, MCP server, webhook builder or developer documentation appears on the homepage, the product page or the enterprise page, and there is no developer entry in the navigation or footer. For a platform selling to enterprises on identity, provisioning and VPC deployment, a published API would normally appear on the enterprise page beside SSO and SCIM. It does not. WHAT I DID NOT READ is the help centre at help.play.fast, which is the one remaining place an API reference would plausibly sit, and the running application at work.play.fast. That is the check for this cell at lane close, and it is the honest limit on a Partial that would otherwise be a well-founded None. Recorded for the pairing: this record has an unusually complete integration surface inbound and nothing documented outbound, which is the mirror image of several records reviewed this session.

Stands at N, now on an observed absence across three product pages rather than on a single unproductive pass. NOTHING IN THE PLATFORM'S DOCUMENTED SURFACE TESTS AN AGENT. No preview or sandbox, no test run, no scoring, no test set, no expected outputs, no comparison between versions and no debugging view appears on the homepage, product page or enterprise page. The build loop as described is: write in plain English what you need, receive a working system, deploy coworkers into it. ONE ADJACENT CAPABILITY RECORDED AND NOT CREDITED, because it is measurement of the wrong thing. Coworkers are said to LEARN FROM YOUR TEAM'S ACTIONS and get SHARPER EVERY WEEK, which implies an internal feedback signal. That is the platform improving itself, not a result the customer can read and compare, and under the 31 August ruling it earns its credit on Mem where it now sits rather than here. THE FULL AUDIT TRAIL CREDITED ON OBS IS ALSO NOT AN EVAL SURFACE. Recording every AI action tells an operator what happened; it does not score whether it was right, and nothing documents replaying a case or comparing outcomes. THE GAP IS SHARPER FOR THIS PRODUCT THAN THE GRADE IMPLIES, and worth carrying. Play's proposition is that non-technical people deploy autonomous coworkers into governed enterprise workflows, and its own competitive framing names the risk as shadow AI without oversight. A platform whose coworkers change behaviour week to week, with no way for the customer to establish whether last week's version was better, has an unaddressed question at the centre of its pitch. CONFIDENCE MEDIUM RATHER THAN HIGH: the help centre and the live application were not read, and a preview or test affordance inside the product would not necessarily be advertised on a marketing page.

Stands at N, and confidence rises to high because the action surface is now fully enumerated rather than merely unexamined. TWENTY NAMED INTEGRATIONS ACCOUNT FOR HOW COWORKERS REACH THE OUTSIDE WORLD, every one an API connection with a described feature set. When a vendor lists its entire connector set with per-system capabilities, absence of a browser from that list is evidence rather than a gap in my reading. THE NEAR-MISS IS THE ROLE VOCABULARY AND IT IS WORTH NAMING because it is the kind that catches a grader working from a summary. The homepage advertises creating a MARKET RESEARCHER THAT ANALYZES TRENDING PRODUCTS, a COMPETITOR MONITOR THAT TRACKS NEARBY HOTEL RATES AND PROMOS, a BRAND MONITOR THAT SUMMARIZES CUSTOMER SENTIMENT FROM REVIEWS and an SEO ANALYST THAT AUDITS PRODUCT LISTINGS. Tracking competitor pricing and reading public reviews sounds like web browsing, and on several records this session that framing turned out to be exactly that. IT IS NOT HERE. No browsing, navigation, scraping or web-access capability is documented anywhere on the homepage, product page or enterprise page, and no web search tool appears in the connector set. Those role examples describe outcomes a coworker could produce from connected systems, and the vendor does not claim the mechanism. Crediting the axis from a job title would be inference over evidence. WHAT WOULD CHANGE IT is a documented browser or web-access tool, which is plausible for the research-shaped examples advertised and is the one thing worth checking in the help centre at lane close. The absence is coherent with the design in any case: this platform's premise is consolidating work into one governed workspace with permissioned connectors, and an unscoped browser would sit awkwardly beside a pitch built on CISOs approving what the AI can reach.