The 3-year IAM TCO envelope for a 2,000-employee mid-enterprise absorbing the agent-runtime identity class lands at roughly USD 1.5M to USD 3.05M, decomposed across five cost components (license, integration, operations, migration, exit) and three identity classes (human workforce, managed service accounts, agent-runtime); the platform-fee headline (Okta enterprise pricing per okta.com/pricing/) accounts for roughly 25-35% of the envelope, the remainder distributing across federation seam build-out, SCIM provisioning, OIDC/SAML configuration, audit-event format alignment, identity-operations team additions (typically 0.5 to 2.5 FTE), and the periodic-review cadence redesign for sub-hour credentials; three line items reliably unpriced in the year-one budget are the agent-runtime credential issuance integration (USD 100K-250K of first-year engineering recovered as year-two overage), the identity-operations team capacity uplift (USD 100K-200K annual), and the access-review redesign tooling or process work (USD 50K-150K).

Anchored on (a) Okta enterprise pricing reference at okta.com/pricing/ for the Workforce Identity Cloud baseline with Adaptive MFA, Universal Directory, Lifecycle Management, SSO; (b) CyberArk 2024 State of Non-Human Identity Security 45:1 NHI-to-human baseline and projected 80:1 at agent-heavy 2026 deployments; (c) specialist NHI vendor pricing tier observations from 2025-2026 procurement-team interactions (Astrix Security, Apono, Britive, Aembit, Andesite, P0 Security typically adding USD 75K-200K annually at the 2,000-employee scope); (d) integration cost calibrated from federation seam build-out experience across 2,000-employee enterprise deployments (typical USD 200K-400K first year). The line item ranges presented are buying-committee planning bands rather than measured industry averages; published independent (non-vendor-funded) audit data at this granularity is not available, so the model is the procurement-team observation rather than survey output. 60-day review cadence (26 Jul 2026). Trigger conditions: (1) Okta or Microsoft Entra announcing structural pricing-model change (per-user to consumption, bundling change for workforce-plus-NHI tier) materially shifts license envelope and moves toward Partial; (2) specialist NHI vendor achieving workforce-tier integration parity closing AM-176 federation-seam costs reduces integration cost line; (3) NIST AI RMF, ISO 42001, or sector-specific guidance prescribing periodic-review cadence for agent-runtime identities changes operations cost line; (4) CyberArk 2026 State of NHI Security report (anticipated) refreshing 45:1 baseline calibrates class-two cost line. Sibling AM-176 covers Okta-vs-specialist vendor matrix this model is the cost-side companion to; AM-167 covers contract-side procurement clauses; AM-174 covers security-platform TCO sharing asymmetric-cost framing.