C1 Identity Security Platform (formerly ConductorOne)

C1 Identity Security Platform governs access for human, non-human, and AI agent identities. It connects to an organization's applications, cloud services, and directories, builds a map of who and what has access to which resources, and runs access requests, access reviews, and joiner-mover-leaver provisioning against that map. The vendor's documentation states that it is "an identity security platform for governing access across your human, non-human, and AI identities."

Audience

Identity and access management teams, IT administrators, security engineers, and compliance and audit teams. The developer tooling is aimed at engineers who build connectors and automate the platform through code.

Name Change Notice

C1 was sold as ConductorOne before the rebrand to C1.ai and C1.

Key Capabilities

• C1 Identity Governance: The vendor's pricing page groups three modules under this name.
  • C1 Lifecycle: Joiner, mover, leaver (JML) automation.
  • C1 Access: Self-service access requests and just-in-time access with role-based access control (RBAC).
  • C1 Comply: User access review automation with separation-of-duties checks, evidence, and remediation. The vendor states that AI reduces routine review work, and role mining proposes roles from current access.
• Identity graph and findings: The platform overview names an identity graph, findings, decoys, and visibility into non-human identities and agents. I could not read the detail pages.

• C1 Connectors: The vendor states more than 400 identity connectors, and its documentation states that connectors run where the environment requires. Its connector library covers:

  • cloud: AWS, Azure, and Google Cloud
  • identity providers: Okta, Microsoft Entra ID, and PingOne
  • HR systems: Workday and BambooHR
  • IT service management: ServiceNow
  • directories: Microsoft Active Directory and LDAP
  • data platforms and developer tools

  Configuration-driven connectors can be built for REST APIs, SCIM, and SQL. The library lists a SAP SuccessFactors SCIM connector.

• C1 SSO and C1 Application Authorization: The vendor states that C1 redirects to the customer's existing identity provider and issues its own OIDC tokens to the application.
• C1 MCP Servers, C1 MCP Gateway, C1 LLM Gateway, C1 Agents, C1 Vault, C1 AppHub, C1 Egress: The vendor names these as platform products or components, with solutions for shadow AI discovery, secrets management, agent single sign-on and runtime governance, and custom agents. The vendor states more than 3,000 MCP (Model Context Protocol) servers. I read no technical documentation for these.

Technical Specifications

• Connector model: The Baton documentation states that a connector can list resources, define entitlements, and emit grants. The sync step reads these, and the provision step writes grants, revokes grants, creates accounts, and deletes resources. The documentation calls this a reconciliation loop. A connector binary is self-contained.
• Baton SDK: A Go SDK, open source under Apache-2.0, for building custom connectors. The older conductorone/baton repository was archived on May 14, 2026, and its README says active development moved to ConductorOne/baton-sdk. The README lists CLI commands for resources, entitlements, grants, principals, and access diffs.
• Developer tooling: The documentation lists a REST API with an OpenAPI specification, a Terraform provider, and a command-line tool, cone, with commands such as cone search users and cone task approve. I did not read the API or Terraform reference.
• Security: The vendor states TLS 1.2 or later in transit, mutual TLS internally, and API keys and secrets encrypted with AWS KMS symmetric keys. It states SOC 2 Type II, with the report on its trust site. The security page states there is no public bug bounty program. The pricing page mentions commercial, regional, and federal hosting paths without naming any certification.
• Not established: Whether customer sign-in supports SAML, the exact connector count, and the supported on-premises connector platforms.

Pricing and Licensing

The vendor offers two models and lists no prices. Platform pricing is SKU-based and starts from 1,000 managed identities, with two levels: Pro, and Advanced, which adds on-premises integrations and connectivity. Flex pricing charges for billable events that consume C1 Tokens, billed monthly. Pricing is scoped through a demo.

Pending Acquisition by Workday

On October 13, 2026, at Workday Rising, Workday announced that it signed a definitive agreement to acquire C1.ai. As of the pages I read, the deal has not closed. The press release gives no price and expects closing in the fourth quarter of Workday's fiscal year 2027, which ends January 31, 2027, subject to customary closing conditions. The release states that Workday "will become the identity governance layer for people, money, and agents" and will build on its Workday Agent System of Record. It does not say whether the C1 brand or a standalone product will continue after closing. Plans in the announcement are not features of the current product.