This page assumes AI access management is enabled for your tenant.
Replace standing credentials with Agent SSO
For MCP servers that support it, enterprise-managed authorization (EMA) exchanges a signed-in user’s identity for a short-lived, scoped token addressed to that one server — built on the open Cross-App Access (XAA) standard, using an ID-JAG token. It’s single sign-on for agents: the same identity governance already applied to people, applied to whatever’s acting on their behalf. Tokens expire in minutes, carry only the granted scopes, and the agent’s access is requested, approved, reviewed, and revoked through the same workflow as any other C1 access — revoke the grant and the next token request is denied. See Enable enterprise-managed authorization to set it up.Authorize every tool call
Not every MCP server supports the XAA standard yet. For those, the AI access management (AIAM) gateway is the other path: the agent routes its calls through C1, which evaluates the caller’s identity, delegated scope, the requested tool and target, and policy on every single call before forwarding it. Enterprise-managed authorization and the AIAM gateway are governed under one set of entitlements, one policy engine, and one audit trail — many tenants run both, choosing per server based on what it supports.Enforce runtime guardrails
Tool call hooks intercept a governed call before it reaches the target, after it returns, or before a response chunk leaves the process — and can inspect, rewrite, or deny outright. Built-in patterns cover a lot of ground: PII field redaction, credit-card blocking, a link filter that mitigates markdown-image exfiltration, a sensitive-file guard, and write-authorization rules that can block a classification of call outside business hours. Three more — secrets masking, an encoded-content guard for smuggled instructions, and a prompt-injection scan scored by C1’s AI-governance judge — exist in the API today; they’re not yet in the admin UI’s pattern picker. Hooks are fail-closed: if one errors or times out, the call is denied, not allowed through.See what each agent can reach
Every registered AI client — Claude Desktop, Cursor, a custom agent, whatever connects — shows up with its type, owner, state, last-used timestamp, and the toolsets currently accessible to it through the owning user’s access profiles. A suspected-compromised client can be killed immediately from its detail panel, revoking all its tokens on the spot. For a broader view across all your access data, not just AI clients, access explorer queries cover orphaned accounts, standing high-risk privileges, and inactive accounts — the same visibility security teams use for human access, applied here to agents too.Route risky actions for response
A hook can allow a call, hold it, or block it outright — that’s the first line. For anything that needs a person or a downstream system to act, findings can route to a webhook, a Function, or an automation via routing rules, so a detection doesn’t just sit in a queue. Every call — allowed, mutated, or denied — is written to the audit log with full identity context, and conversations can be reviewed end to end, including the policy steps evaluated along the way.Findings is an early-access capability — check current coverage before relying on it for a specific finding type.