Joiner, mover, leaver
The mover case is where it earns its keep. A joiner gets a checklist and a leaver gets urgency; someone changing team quietly keeps both sets of access forever. A scheduled session finds those and drafts the revocations.
Solutions·IT
Нужно и запускать, и approve. Оба — честно.
Access reviews, joiner-mover-leaver, очередь service desk, runbook, который умеет только один человек. IT получает от agent platform больше большинства команд — и это та команда, которая должна сказать yes первой. Здесь обе половины.
RunbooksMarkdown in your repo, not in a head
ReachGranted per agent, never inherited
Every actionAllowed, gated, or blocked
DeploymentCloud, your VPC, or on-prem
The handoff
The queue, and the runbook only one person can execute.
IT work is unusually well suited to this: it is procedural, it is written down somewhere already, and the cost of it not happening is invisible right up until an audit or an incident.
The access review that actually gets done
Who has what, how long they have had it, and when they last used it. It produces the review with a proposed action per row rather than a spreadsheet that gets forwarded twice and approved unread.
Service desk triage and first draft
It reads the ticket, classifies it, finds whether your own documentation already answers it, and drafts the reply with the article linked. The ones it cannot answer get routed with the diagnosis already attached.
The runbook that lives in one person’s head
Write it down as a skill file and a session can execute it. That is the durable version of “ask Marta” — it survives Marta being on holiday, and improving it is a change request rather than a corrected memory.
Licence and seat reconciliation
What you pay for against what is assigned against what was opened this quarter. It writes the reclaim list per tool with the last-used date on every row.
Configuration drift, reported not fixed
It compares what your documentation says is configured against what is actually configured, and reports the difference. Reporting drift is safe and useful. Silently correcting it is neither, and it will not.
The output
A review with a recommendation on every row.
The artifact IT actually needs is not a dashboard. It is a list, with a defensible reason attached to each line, in a state where approving it does something.
Agents are principals too
Neuro OS has a real account, member, group and role model with per-resource permissions for people and for agents. An access review that covers your humans and not your automation is half a review.
A recommendation, with the reason on the row
Revoke because they moved team. Keep because it is in the release path. A review you can approve in ten minutes is one where the reasoning is on the line, not in a separate document.
It reports; it does not silently remediate
Revocation is a write, and writes are where you set a gate. The default configuration for a review session should be read-everything, change-nothing, and propose.
Where it reaches
Your estate, reached the way it is actually reachable.
IT tooling is the least uniform stack in the company. Connect what is in the catalogue; define the rest yourself. Either way the credential is decrypted server-side and never enters the machine.
Google Workspace and Microsoft 365
Accounts, groups, mailboxes and calendars — the substrate most joiner-mover-leaver work runs against. Read and write are separate actions with separate answers.
GitHub
Repository and organisation membership is access too, and it is the access that most often outlives the reason for it. It reads the org state and reports what does not match your documented roles.
Your service desk
The mainstream helpdesk products are in Easy connect behind their own OAuth screens. Read the queue, draft the reply, and update the ticket where you have allowed it to.
Everything with an API and no catalogue entry
This is most of an IT estate. Point Neuro OS at an OpenAPI or Postman description, a GraphQL endpoint, a bare HTTP base URL, or a remote MCP server. It turns each operation into a tool with its own Allow, Ask or Block.
A machine you already run
A computer connector opens a tunnel to a host you control, so a session can reach something that was never going to be exposed to the internet — without that host being on the public network.
What not to pretend
We are not going to claim your identity provider, your MDM and your network vendor are all one click away. For an IT estate the direct connector types are usually the real path.
How it runs
Answer the ticket now. Run the review every quarter.
The same session machinery started three ways. IT is the function where the scheduled mode does the most good, because the work that gets skipped is the work with no deadline attached.
The question in the help channel
Someone mentions the bot in the IT channel. The thread becomes a session, the session reads your documentation, and the answer lands back in the same thread with the source quoted.
It stops before it changes access
Set every write against an identity or an entitlement to Ask. The run holds at the call with the exact change in front of you, and resumes from that point when you approve. Set the irreversible ones to Block instead.
The review nobody schedules, scheduled
A cron trigger opens the quarterly access review and the monthly licence reconciliation. Triggers name the agent they run as, so the unattended session has exactly the reach the attended one has — no more.
Control
The part where you review us.
You are also the team that has to approve this. Here are the answers, including the ones that are less flattering than the version you usually get on a page like this.
One isolated machine per session
Every session runs on its own disposable Linux machine on its own branch. Sessions do not share a filesystem or a working tree, and the machine is thrown away. What we will not tell you is that egress is controlled at the network — nothing implements that, and you should assume outbound access from a sandbox.
Approval gates are off by default
The shipped default is permissive: an action runs unless you have said otherwise. This is the single most important sentence on this page for you. Set Ask and Block explicitly, per action or with a pattern rule.
Merge is default-deny
Work reaches main through a change request. An agent cannot merge unless an admin has granted it in a versioned config file — so widening it is itself a reviewed change rather than a setting that quietly moved.
Two kinds of credential, and they behave differently
A connector credential is brokered server-side and never enters the sandbox. A runtime secret you grant a session is a real environment value inside it and is readable by any command the agent runs. Both are correct designs for their job.
Identity, audit and where it runs
Single sign-on is SAML 2.0. Every tool call is written to an audit record. Deployment is your cloud, your VPC, or on-prem — open source, so you can read what you are running. For an isolated topology, talk to us.
The same platform
The other teams
One project, one set of connectors, one memory that compounds. Each team writes the skills for its own work; nobody stands up a second system.
SalesResearch, drafts and CRM hygiene, held for your approval
MarketingЧерновики, потом yes, потом пост
AI Search AnalyticsЧто отвечает AI — и что менять
OperationsRoutines run checklists; humans handle exceptions
FinanceThe close, with the working shown
SupportAround-the-clock triage with named escalations
EngineeringReproduce it, patch it, open the change request
HRThe coordination — never the decision about a person
Data ScienceAn analysis you can re-run — with the query attached
DesignКартинки, слайды и бренд-борды как задачи
LegalДела, цитаты и workflows, которыми вы владеете
Personal AssistantИИ для личной жизни — Telegram, голос, напоминания
“You have to run it, and you have to approve it. Both, honestly.”
Сначала security page, потом pitch.
Любая модель, ваши ключи. Neuro OS в вашем cloud, VPC или on-prem.