C1 Identity Platform

Access review campaigns in which reviewers attest to or revoke access for workforce and workload identities, including AI agents, down to the entitlement level. Certifications are event-triggered (a transfer, a risk change, a new entitlement) as well as scheduled, and risk context and recommendations are surfaced so reviewers act on exceptions instead of rubber-stamping every line.

Self-service access request catalog with configurable, policy-driven approval workflows.

Applies predictive and prescriptive analytics and AI assistants to governance decisions: recommends approvals and certification outcomes, proposes role and policy models from access patterns, flags anomalous access for review, and answers natural-language questions about who has access and why. Distinct from Identity Analytics and Risk Scoring, which supplies the descriptive risk scores these recommendations build on.

Automated fulfillment of access changes to target systems through prebuilt out-of-the-box connectors (for example SAP, Workday, Microsoft 365), purpose-built custom connectors for homegrown platforms, and standards-based provisioning (SCIM 2.0), with ITSM ticket-based manual fulfillment as the fallback for applications no connector reaches.

Continuously discovers entitlements across applications and systems, reconciles them against what is actually granted in each target, and enriches each entitlement with a description, owner, and risk level so requesters and reviewers understand what they are approving. Fine-grained runtime entitlements are covered by Fine-Grained Authorization Policy Orchestration.

Descriptive and diagnostic analytics over identity and access data: scores each identity's risk from its entitlements, peer-group outliers, orphaned and dormant accounts, and SOD exposure, and feeds those scores into certification prioritization and remediation. Predictive and prescriptive recommendations belong to AI-Assisted Identity Governance.

Automated joiner, mover, and leaver processes for workforce and workload identities, including AI agents, that create, change, and revoke identities and their access across connected systems, correlating identity and application data from multiple authoritative sources (HR, directories, contractor systems) into one identity record.

Role mining, modeling, and administration to standardize access through roles.

Defines static segregation-of-duties rules as conflicting roles and entitlements, blocks toxic combinations at request time, and continuously monitors for SOD violations with alerts and mitigating-control tracking. Static SOD became a mandatory IGA capability in 2026; predictive dynamic SOD analysis is a separate feature.

Governs workload identities (service accounts, applications, containers, RPA bots, and AI agents) and their accounts through the same lifecycle, ownership, certification, and policy controls as workforce identities: assigns a business sponsor and technical owner, records purpose, and removes the identity and its access when it is no longer justified.

Provisions and resets credentials as part of the identity lifecycle: self-service password management and reset for workforce identities, and integration with workload secrets managers so the credentials of governed workloads and AI agents are issued, rotated, and revoked under the same lifecycle and policy as their access.

Delivers cloud infrastructure entitlement management out of the box: discovers IAM roles, policies, and permissions across AWS, Azure, and GCP, detects excessive or unused cloud entitlements, and governs them through the same request, certification, and remediation workflows as application access.

Uses AI-enabled connectors, browser plug-ins, and APIs to discover disconnected applications and identity sources and to build and maintain their integrations automatically, cutting application onboarding from weeks to days and keeping connectors current without professional services.

Produces audit evidence mapped to specific regulatory mandates (NIS2, DORA, SOX, GDPR, HIPAA): automated regulation-specific reports, scheduled and ad hoc exports, and immutable audit trails that demonstrate continuous audit readiness rather than point-in-time evidence collection. Basic access reporting is table stakes; assign only when controls are mapped to named regulations.

Grants entitlements for a defined, limited period and automatically revokes or re-reviews them when the period expires, so temporary, project-based, and elevated access does not accumulate as standing entitlements.

Lets administrators build and modify governance workflows (approvals, certifications, lifecycle events, remediation) in a low-code or no-code designer, so process changes do not require vendor professional services or custom code.