01
Install and scope the connection
Connect over OAuth or an app install and choose exactly what Asana shares — you can revoke it on your side at any time
Asana is wired in twice: connect it over OAuth and an action opens a task in the project you choose, then follows it back into devguard as your team completes it. Read-only checks with a personal access token confirm the token is valid, verify which workspaces it can reach, and produce access-governance evidence for the people and guests in them.
3 read-only checks, run on a schedule. Each failure becomes a finding linked to a control — every check is listed, none are “coming soon”.
Confirms the Personal Access Token authenticates and resolves the current user via GET /users/me (HTTP 200).
token-connectivity
Scoping check: confirms the authenticated user is a member of at least one Asana workspace/organization (the non-paginated `data.workspaces` array on /users/me is non-empty), so access reviews have a workspace to scope to.
workspace-membership-present
Access-governance check: exhaustively enumerates workspace memberships via GET /workspaces/{workspace_gid}/workspace_memberships (paginated with the `offset` cursor) and fails if any member is an external guest (`is_guest` is true). The guest flag is the only real access-governance signal Asana's public API exposes. Also fails closed if no memberships are returned.
no-workspace-guests
Bring your current platform's test list — we'll map it against these checks, gap by gap
Open tasks in the Asana project you choose for remediation work, and devguard tracks each one as your team completes or reopens it, connected over OAuth to your own Asana account.
Setup is minutes, not a migration project — and every step stays on your side
Connect over OAuth or an app install and choose exactly what Asana shares — you can revoke it on your side at any time
The first run starts right after connecting, then repeats on a schedule. Results are timestamped, so your evidence has a history, not a snapshot.
Passing results attach as evidence to the controls they support; failures become findings you triage. When the audit comes, the proof is already connected.
Open any page for its full check register.
You create and scope every credential yourself, and you can revoke it at any time. Checks only read; results and evidence are stored in Switzerland and stay exportable.
Yes. The checks authenticate with a credential you create and scope yourself, and only ever read configuration. devguard holds no write access to Asana and remediates nothing silently.
A failed check becomes a finding linked to the control it supports, with the evidence attached. You decide the treatment — nothing pages your engineers and nothing is auto-remediated.
Checks run from Swiss infrastructure, and results and evidence are stored in Switzerland. Everything is exportable — your evidence stays yours.
20 minutes on how you run certification today. Bring your current test or control list and we'll map it against these checks — honestly, gap by gap.