How Built onboarded 200+ apps in two days and automated birthright access with C1.ai

The challenge: Advanced automation, limited visibility

Built is an AI-native company, and its IT team runs a more advanced identity setup than most companies its size. Ty Kelley, Associate Director of Enterprise IT, and his team built birthright access and joiner, mover, leaver automation directly in Okta. For many employees, the entire access journey at Built was automated.

The hard part was seeing that access and changing it. The team couldn't easily visualize the full breadth of a person's access or adjust the access profiles behind it. Reorgs made the gap impossible to ignore. Each one meant re-architecting birthright access and where it was assigned.

AI raised the stakes. Alice Lovett, IT Engineer, describes Built's AI culture as "fast and furious," and the team is open to experimentation. Governing that pace alongside every existing human identity wasn't scaling. Built also needed a way to govern its growing number of AI tools and agents, which is the focus of AI agent security.

“We were basically having to juggle this AI era and new frontier alongside all of our existing human identities and access. And it was becoming an untenable situation, and it was not scalable for our company at the time.”

— Ty Kelley, Associate Director of Enterprise IT, Built

Built went looking for a platform to solve its entitlement governance problem and chose C1.ai.

The solution: 200+ apps in two days with C1.ai's AI

Thomas Lyon, Built's IAM Engineer, led the implementation. On an early call, Thomas heard he could use C1.ai's AI tools to set up the platform. He decided to try setting up everything that way.

He started by using Codex to turn what he knew about Built's Okta environment into context he could hand to C1.ai's AI. Then he tested, building a workflow where C1.ai's AI received that context along with the information it needed to make each change. Once the workflow held up, onboarding became repetition.

“Within two days, I was just copying and pasting prompts essentially, and I was able to build out all of our 200+ applications.”

— Thomas Lyon, IAM Engineer, Built

Thomas credits the fact that the AI lives inside the platform it's configuring.

“C1.ai's AI made it easy. It’s really helpful because it has all the contextual information that it needs.”

— Thomas Lyon, IAM Engineer, Built

Thomas's playbook for onboarding 200+ apps

1. Prepare. Get into your current environment (for Built, Okta), work out the details, and extract them, so you're ready to give C1.ai the information it needs to set up each app.
2. Test. Run initial tests to confirm the AI does what you expect. Thomas set up a few things wrong early and corrected them before scaling.
3. Verify. Check that what was built matches what you intended.

“Really just coming with the information that you already know and getting it to C1.ai in a way that it can understand and set up those applications was helpful.”

— Thomas Lyon, IAM Engineer, Built

Matching every entitlement without the manual work

Onboarding the apps was step one. Built also wanted the entitlements in C1.ai to match what it already had in Okta. Thomas asked C1.ai's AI how specific configurations worked and what they looked like, details that had been hard to find before. He then fed those answers into Claude through an MCP connection to push the changes.

“It was so intuitive to me to be able to ask C1.ai's AI, hey, how does this work? What does this configuration look like? It was able to figure out all of those little configuration changes that would have taken a lot longer for me to go through and manually update for over 200 apps.”

— Thomas Lyon, IAM Engineer, Built

A custom Okta MCP, and an AI that builds the app

One of Alice's first projects at Built was a custom Okta MCP server written in Go. It returns a text payload with Built's full Okta configuration: groups, application assignments, group membership, and roles.

That payload became the input for C1.ai. Alice hands it to C1.ai's AI, or uses the C1 MCP server inside Codex, with a simple instruction: emulate this, and set up the app.

“I would just be like, this is the payload we're trying to emulate on this side. Help me set up the app. And it would just boop, boop, and build everything. So pretty sick.”

— Alice Lovett, IT Engineer, Built

Alice has set up two apps to Thomas's 200, but the AI also changed how fast she learned C1.ai. Instead of reading developer docs to work out what an access policy or an entitlement is, she asked, and C1.ai's AI condensed the layers into a single answer.

“C1.ai's AI really enabled me to understand it at a deeper level way faster than I would've if I were just reading development docs.”

— Alice Lovett, IT Engineer, Built

Joiner, mover, leaver: Right access from day one

Much of Built's birthright access now runs in C1.ai through JML automation. It's automated, so new hires get access from their first day, and the team has a clearer handle on how users are added and removed.

Separating authorization from authentication

Before C1.ai, Built's roles were tied to Okta groups, so one system handled both who someone is and what they can access. Built broke authorization out into C1.ai. With access policies and request flows in C1 Access, the team can customize access flows, which has also let Built ease its procurement process.

Alice's advice for teams weighing the same move:

The outcome: One of IT's biggest pain points, solved

Built's IT team moved the work into C1.ai: onboarding hundreds of apps, matching entitlements, and getting new hires the right access. App onboarding now runs on prompts. New hires get the right access on day one. And the team is already building what comes next, starting with agent access.

“C1.ai has enabled me to continue enjoying what we're able to do by taking one of our biggest pain points and offering a robust system that is intuitive and lets us really streamline our access policies, the way that people request access.”

— Alice Lovett, IT Engineer, Built

Thomas also credits the C1.ai account team for keeping pace, even with requests that land at the end of the day. His advice to peers is short:

“If someone was looking into getting onboarded to C1.ai, do it because it's great.”

— Thomas Lyon, IAM Engineer, Built

Results at a glance

• 200+: Apps onboarded with C1.ai's AI
• Two days: To onboard all 200+ apps
• 10 minutes: Per app with C1.ai's AI, vs. 30 to 60 minutes manually
• Day one: New hires get birthright access automatically