Regarding Access Request Workflow, when a user requests an app - he can also include a message to the approver. But you can also designate an approver group.
In an agentless DSSO (Desktop Single Sign-on) scenario Okta is the one decrypting the Kerberos ticket, finds then the user name, authenticates the user and passes back a session to the browser.