April 23: Closing the AI governance gap
blog

Union Station: The Internal Platform Powering C1's Agentic Enterprise Transformation

Will Bengtson, CISO

Share

Union Station: The Internal Platform Powering C1's Agentic Enterprise Transformation

Union Station is C1's internal platform for building, deploying, and managing every internal tool and AI-powered app the company runs. Vendor reviews, employee onboarding and offboarding, vibe-coded Slack bots, AI agents, cron jobs, full-fledged applications: it all lives in one place, with shared authentication, infrastructure, and governance baked in.

Think of it as a lightweight, self-serve Heroku for the entire company. Anyone at C1 can deploy an app to Union Station without filing a ticket, wiring up DNS, or figuring out authentication on their own. The platform handles all of that. You build the thing, you ship the thing, you move on.

Here's why I built it and what it's turned into.

Selfishly, I needed a place where I could deploy automations and code. A place to move faster, enable the business, and scale myself.

I wanted Union Station to be the place people go to do anything at C1. Looking for a tool? A service? An automation? The de facto move should be: go to Union Station, see if it's there. If not, build it there.

Instead of deploying a bunch of one-off apps to solve different problems, build a single platform. Faster delivery. Consistent patterns. A familiar UX that feels like the C1 product people already know, not some new thing they have to learn.

How it started#

Union Station didn't start as a platform vision. It started because I had problems in front of me.

I was going to launch Paper Secrets there. I was going to launch the link service. Then, in one of my first weeks, people came to me with three requests for vendor reviews. So I built a vendor review as part of Union Station.

I needed to handle onboarding and offboarding, so I built that into Union Station too, with a full RBAC system so that sensitive operations like employee offboarding were locked down to the people who needed them and nobody else.

Today there are multiple tools running inside Union Station. But it all shows up as one platform.

Enter the agentic enterprise#

Then something shifted. People across C1 started building AI-powered apps. Vibe-coded tools, Slack bots, internal utilities. The energy was real. The problem was, they had nowhere to deploy them.

You could risk people spinning up their own AWS accounts and billing back. Or you could embrace where we are and make it easy for them to experiment and ship.

I chose to embrace it.

Union Station now has a Heroku-like application deployment system. You deploy your app into managed container runtimes. Authentication is handled for you. You can request a data store. You get a DNS name. Everything is self-serve, no tickets, no waiting on someone else to wire things up.

If you've heard of Backstage (built by Spotify) or Netflix's Spinnaker, it's a similar concept: a place where you can request a thing, host a thing, build an app, all within guardrails. But those systems are heavyweight. You have to learn how to use them. We needed something lighter, backed by managed services, that just works.

The security argument for saying yes#

Here's what I think a lot of security teams get wrong about vibe-coded apps: the instinct is to lock things down. But if people are building tools and you don't give them a sanctioned place to deploy, they deploy them anyway. You just don't know about it.

When I bring those apps into Union Station, I get a full inventory of everything deployed and what people are doing. I can put hooks in for security scanning, vulnerability management, and governance. I get deployment patterns and techniques that are consistent and auditable.

Versus the alternative, where someone runs their tool out of a personal account and people are using it, and you have zero insight into what's happening.

The sprawl problem is real. Union Station solves it by making the governed path the easy path. Come deploy your app here. It's faster for you, and it's safer for the company.

What people are building#

Within the first hour of announcing Union Station's app platform at our weekly all-hands, five new apps showed up. Four new developers deploying. People were clearly looking for a place to ship their work.

Even our head of people is deploying apps: a recruiting tool, an offer letter agent, performance review automation. This isn't just engineering tooling. It's company-wide.

What's next#

The vision is to keep lowering the barrier. The workflow becomes: come in, say I need to deploy my app, select which MCPs you want, and behind the scenes Union Station connects everything, via C1. You're off and running.

Get security out of the way of being the middle person. Stop blocking people from their own success.

That's what an agentic enterprise actually looks like. Not just building AI products for customers, but using AI internally to make every team faster, more autonomous, and more capable than their headcount alone would suggest.

This post is part of a series on how C1 is building the agentic enterprise from the inside out. More from the team coming soon.

Stay in touch

The best way to keep up with identity security tips, guides, and industry best practices.

Explore more articles

Governing AI at Enterprise Speed: Announcing C1 integrations for Claude, OpenAI, and Cursor

Governing AI at Enterprise Speed: Announcing C1 integrations for Claude, OpenAI, and Cursor

AI Access Management: Your Questions, Answered

AI Access Management: Your Questions, Answered

From Risk Signal to Governance Action: Introducing C1 + CrowdStrike Falcon Next-Gen Identity Security

From Risk Signal to Governance Action: Introducing C1 + CrowdStrike Falcon Next-Gen Identity Security