Bring your own agent/slave/worker machine.
If you implemented CCI-I-709, then from there, additional privileges could be added for CCI to launch machines in private accounts. CCI still runs the master servers, but the agent/slave/worker could run in customer's account which would also allow access to internal services that a customer may not want to give external access (security checks, code analysis tools, artifact storage, etc.) The customer becomes responsible for machine costs and items like additional memory, etc. are a burden on the customer, but the customer doesn't need to maintain a master/onprem version.