ConductorOne (C1) vs Lumos vs Zluri: SaaS access governance compared

Both govern human, non-human and AI identities with access reviews that revoke, Slack requests, time-boxed grants, HRIS-driven lifecycle and ITSM ticketing. C1 documents approvals in Microsoft Teams, just-in-time access to AWS and GCP, 400+ connectors with an open-source SDK, and an MCP Gateway in front of agent tool calls with risk-graded approvals. Lumos says it is built for companies of 200 employees and up, runs reviews and JIT grants through its Identity Agent Force, and since September 2026 enforces tool-call policy through a hook in Claude Code and Codex, which it states is not a gateway. Neither documents an EU hosting region; C1's sub-processors are in the United States.

C1 starts from identity governance and infrastructure: JIT access to cloud accounts, requests from the web, Slack, Teams, the CLI or MCP, and an MCP Gateway for agents. Zluri starts from SaaS management: discovery from eight sources, licence and spend optimisation, Slack requests and certifications. Zluri's own comparison credits C1 with JIT access to cloud infrastructure and describes its own time-bound access as a policy condition rather than a dedicated JIT workflow. Pick C1 for engineering-led, infrastructure-heavy access and agent tool calls; pick Zluri when spend and the SaaS apps outside SSO are the main problem.

It depends on whether access or spend leads. Lumos auto-revokes rejected access through its integrations, runs grants from 2 hours to 90 days and syncs requests with Jira or ServiceNow; it says it targets companies of 200 employees and up. Zluri adds licence and spend optimisation and a browser extension for discovery; its review remediation runs after an admin concludes the review, and its notifications are documented in email and Slack. Neither documents approvals inside Microsoft Teams or an EU region with a French-language product.

Requests go through the Lumos AppStore, Slack or an MCP server. Grants last from 2 hours to 90 days, or unlimited, and are revoked automatically, and a Just-in-Time agent is part of its Identity Agent Force. The ITSM integration creates a Jira or ServiceNow ticket per request, routes it to an approver group, syncs status both ways and provisions on approval. Lifecycle runs from Workday, BambooHR, Rippling, ADP Workforce Now or Oracle HCM. Lumos does not publish prices.

The products most often compared with Lumos are C1 (formerly ConductorOne), Zluri, Torii, Okta Identity Governance and SailPoint; Lumos publishes its own comparison pages for C1 and Zluri. On this page, C1 documents infrastructure JIT, Teams approvals and a gateway for agent tool calls, and Zluri documents SaaS spend management and a browser extension. Lutril governs employees and AI agents in one policy layer, with requests in Slack, Teams and the app UI, an MCP proxy with prompt DLP and hosting in France.

Oleria describes itself as a usage-aware identity security platform: adaptive identity governance, ISPM, NHI and AI agent governance and ITDR, with usage data down to resources such as files. C1 describes itself as the identity platform built for the AI era, with lifecycle, access, JIT, an LLM Gateway and an MCP Gateway. Oleria is not scored in the matrix above. Compare them on whether you need usage-level visibility into resources or policy enforced on each agent tool call.