How to request AI tools

Connect your AI client to C1, request access to governed AI tools, and start using them.

Activation required. AI access management must be enabled for your tenant before you can use it. To get started, an admin from your organization must contact the C1 support team for a walkthrough.

If your IT or Security team has rolled out AI access management with C1, follow this guide to learn how to:

1. Connect your AI client (such as Claude, ChatGPT, Cursor, or Copilot) to C1 so it can call governed tools.
2. Find the AI tools you need and request access to them from C1.
3. Use those tools in your AI client and know what to do when something gets denied.

You don’t need an admin role — anyone with a C1 account can do this.

Connect your AI client to C1

C1 governs AI tool access by sitting between your AI client and the underlying tools (Salesforce, GitHub, and so on). Once you connect, your client sees only the tools your IT team has approved for you.

Step 1: Get the C1 MCP URL

1. In C1, go to your profile menu and click AI & API.

2. On the AI connections tab, copy the MCP server URL.

Step 2: Add C1 MCP to your AI client

The exact steps depend on your client:

• Claude Desktop — Settings > Connectors > Add connector, then paste the MCP URL.
• Claude Code — Add the URL via claude mcp add or in .claude/settings.json. See the Claude Code MCP docs for syntax.
• ChatGPT / Copilot / Cursor — Follow your client’s documentation for adding an MCP server connection.

Step 3: Authenticate

The first time your client tries to use C1 MCP, you’ll be redirected to C1 to sign in. After signing in, you’ll see a list of the C1 tools your access profiles grant you.

If your AI client offers a way to test the connection, run a “list tools” prompt — you should see C1 tools appear.

When a tool needs your own credentials (per-user OAuth)

Some downstream services (Google Workspace, GitHub, Salesforce, and so on) require your personal credentials, not a shared service account. Go to your profile menu and click AI & API > MCP connections > Connect to authorize your account before using tools from one of these services.

What happens if your access is revoked or expires

• Mid-session revocation — if your access is revoked while you’re using a tool, the next tool call returns a denied error. In-flight calls finish.
• Access expires — if your access profile has a JIT expiry, the same denied error appears once the clock runs out. Submit a new request to renew.
• Your AI client is closed by inactivity — re-authenticate from your client to get back online.

In all three cases, no data on your machine is deleted — only your ability to make new tool calls is affected.

Find and request AI tool access

Access profiles containing toolsets appear in the C1 catalog. Browse to find what’s available, then submit a request from the web or Slack.

Browse the catalog

1. In C1, click Requests.

2. Access profiles containing tools appear in the catalog alongside app entitlements. Each item shows what toolset it grants, what tools are in the toolset, and what the approval policy is (auto-approve, requires approval, or JIT with an expiry).

Submit a request via the web UI

1. Click the access profile you want.

2. Click Request access.

3. Fill in a justification if required.

4. Click Submit.

You’ll see the status on your My requests page.

Submit a request via Slack

If your org has the C1 Slack integration:

1. Run /c1 request (or message the C1 bot).

2. Search for the access profile.

3. Click Submit.

The same approval flow runs whether you submit from web or Slack.

Check request status

• Web — My requests.
• Slack — the C1 bot DMs you when status changes (approved / denied / more info needed).
• Email — same notifications by email if your org has email notifications enabled.

Use AI tools in your client

This section covers how approved tools appear in your client and what to do when a tool call is denied.

Where the tools come from

Once your access is approved, the tools in your toolsets appear in your AI client’s tool list automatically — usually after a refresh of the connection. You don’t have to install anything per tool.

What an access error looks like

If a tool call is denied, your AI client will get back an error like:

Access denied: tool `salesforce_query` is not in your current tool list.

Common causes:

• Tool isn’t in any of your access profiles — request access from the catalog.
• Tool is disabled or under a kill switch — your admin has paused it; contact your admin.
• Your AI client is closed by inactivity — re-authenticate.
• Your downstream OAuth (per-user) has been revoked — your client will re-prompt you to connect.

If you see a denial you don’t expect, contact your IT or Security team.