Zero-Access Agent
Ask your endpoint fleet anything in plain English, answered from read-only snapshots with zero access to any live system.
Give the AI the reports, never the systems
The permission boundary is enforced by architecture, not by asking a model to behave. The agent holds no tenant scopes and no keys.
- ✓ Run the whole pattern with zero tenant access, using a synthetic fleet generator.
- ✓ Ten real read-only collectors, each with a plain-language teardown.
Everything I ship, in one place
Posts, scripts, reports and the flagship project, all in the open.
The blog
Deep-dives into what the portal actually fires against Graph, and the permission each call needs.
ReusableScripts library
Read-only PowerShell for Intune, Entra and Graph, each script standalone, each explained.
ReportingPower BI reports
Endpoint reports built on the sanitized snapshots, screenshots, templates and how they're wired.
ProfileAbout
What I work on, how I work in the open, and how to get in touch.
Latest writing
Eleven deep-dives, each the story behind a read-only script or report on this site. Ten collectors, and the one agent they feed. New here? Start with the flagship.
The read-only AI agent that can't touch your tenant
Ask your whole endpoint fleet in plain English, from an agent that holds zero access to Intune, Graph or any live system. This is the capstone the ten read-only collectors feed.
Who's running Ollama?
Copilot, local LLMs and shadow-AI tools across the fleet, inventoried read-only before they surprise you.
One row per device
Device, Entra location, OEM warranty and Defender health, joined into one sliceable inventory row.
Which setting actually failed?
Intune says Not compliant, but not which setting, at scale. The read-only collector that names it, per device.
The ten read-only collectors that feed the agent
Let's build endpoint tooling that's honest about how it works
Honest, first-hand endpoint tooling, reproduced before it's published. Follow along on GitHub and LinkedIn.