HBX vs. an OT-native vendor
Whose identity provider decides which agent gets in.
With HBX the decision stays in your own identity provider, on open published standards, so it survives a vendor swap. Proprietary fabrics keep that decision inside their own product.
What it costs you
Your access policy stays yours if you change vendor.
With HBX, replacing the access vendor doesn't mean rebuilding your policy.
If the agent identity is proprietary
The vendor's fabric becomes the authority on which agents exist and what they may do. Your own identity provider only feeds it user records.
It works. It also means the policy lives in the vendor's model, so moving it is a migration, not a reconfiguration.
What HBX does instead
Your identity provider makes the decision, as a signed statement in an open standard (ID-JAG, a way for one identity provider to vouch for an agent). It says which agent enters, on whose behalf, and for how long.
HBX authorizes against that decision. A connector inside your network creates a temporary login on the target system and removes it when the window ends.
What HBX is
HBX decides who gets in and on what authority. It isn't an OT appliance.