When using Okta as a 3rd Party IdP with Workspace ONE, which party owns the entitlement of resources

When using Okta as a 3rd Party IdP with Workspace ONE, which party owns the entitlement of resources in Workspace ONE?

A. Workspace ONE

B. Okta

C. SAML

D. OAuth