Zero-Access Agent
My flagship open-source project — ask your endpoint fleet anything in plain English, the way you would a copilot, but with zero access to any live system. Answers come from read-only snapshots, never a live connection.
Give the AI the reports, never the systems
Scheduled read-only jobs export sanitized, pre-aggregated snapshots. The agent answers only from those — the permission boundary is enforced by architecture, not by asking a model to behave.
- ✓ Read-only by construction — the agent holds no tenant scopes and no keys.
- ✓ Run the whole pattern with zero tenant access, using a synthetic fleet generator.
- ✓ Ten real read-only collectors, each with a plain-language teardown.
Everything I ship, in one place
Posts, scripts, reports and the flagship project — all in the open.
The blog
Deep-dives into what the portal actually fires against Graph — and the permission each call needs.
ReusableScripts library
Read-only PowerShell for Intune, Entra and Graph — each script standalone, each explained.
ReportingPower BI reports
Endpoint reports built on the sanitized snapshots — screenshots, templates and how they're wired.
WhoAbout me
What I work on, how I work in the open, and how to get in touch.
Latest writing
Eleven deep-dives — each the story behind a read-only script or report on this site. Ten collectors, and the one agent they feed. New here? Start with the flagship.
The read-only AI agent that can't touch your tenant
Ask your whole endpoint fleet in plain English — from an agent that holds zero access to Intune, Graph or any live system. This is the capstone the ten read-only collectors feed.
Which setting actually failed?
Intune says Not compliant — but not which setting, at scale. The read-only collector that names it, per device.
One row per device
Device, Entra location, OEM warranty and Defender health — joined into one sliceable inventory row.
Who's running Ollama?
Copilot, local LLMs and shadow-AI tools across the fleet — inventoried read-only, before they surprise you.
The ten read-only collectors that feed the agent
Let's build endpoint tooling that's honest about how it works
Honest, first-hand endpoint tooling — reproduced before it's published. Follow along on GitHub and LinkedIn.