How Monarch automated onboarding, offboarding, and AWS access with C1.ai

The challenge: Govern access for a company that builds with AI

Monarch runs on AI. The company trains every team to use it, from engineering to the people and accounting teams. Employees build custom apps, workflows, automations, and agents. That means more builders, more systems, and more access to govern.

Elle Longwell, IT Manager at Monarch, owns software, licensing, identity, and hardware with a small team. Access reviews were split across disconnected platforms, and onboarding meant manual request checklists, while offboarding meant working through every system by hand. Monarch had tried several just-in-time (JIT) tools, but none offered the granularity or automation to handle requests on time. An approval could take up to a week.

The solution: One access plane for 200+ apps

Monarch chose C1.ai for the depth of the platform: visibility into entitlements and resources, and the granularity to govern them. Today Monarch manages more than 200 apps in C1.ai, from widely used SaaS apps to internal tools the team built itself.

Onboarding moved fast. In two months, Monarch went from implementation kickoff to access requests live company-wide, after two all-hands trainings.

Onboarding and offboarding, handled automatically

C1.ai now runs the joiner and leaver steps that used to take manual work, through JML automation. When someone leaves, C1.ai deprovisions access across every connected system, so offboarding is secure and final. When someone joins, access profiles grant the right tools on day one. A new member of the accounting team gets the accounting stack up front, without filing a dozen requests.

JIT in AWS: From a week to minutes

Monarch uses C1.ai JIT access for its AWS infrastructure. Engineers request the permissions they need, and C1.ai routes each request to the right approver with context, including whether the engineer is on call and what their role is. Most requests are completed in minutes, and some are auto-approved when policy allows.

JIT also changed how Monarch audits AWS. C1.ai shows who has which permissions, for how long, and why, along with the full history of every request, making the process faster, easier, and more efficient. Instead of combing through individual logs in AWS, Longwell can look in one place: C1.ai.

Visibility: Tighter privileged access and simpler reviews

As Monarch grew, privileged accounts spread across a growing number of systems, which made them harder to see in one place. Now the team sees every privileged entitlement and keeps that access limited to the people who need it, in line with least privilege access. Access reviews run in one place, and reviewers get a clear picture of what they're approving.

Extending C1.ai with its own tools

Monarch's builder culture reaches IT too. The team built its own app-owner portal and app-onboarding tool on C1.ai's APIs, shaping the platform around how Monarch works. Learn more about the Extensibility Platform.

The outcome: More time for the work that matters

With a few hundred employees making requests every day, routing alone used to eat IT's time. C1.ai sends each request to the right owner, so Elle no longer chases approvals between stakeholders. The time goes back to building tools and solving problems.

Results at a glance

• Minutes: AWS access approvals, down from up to a week
• 200+: Apps governed in C1.ai, from SaaS to internal tools
• Day one: New hires get role-based access through access profiles