Enterprise work
Enterprise CMDB
A global CMDB and Discovery rollout at Dun & Bradstreet
Infrastructure data was spread across teams and tools, with no consistent discovery, identification or ownership. I led the rollout that replaced it with the organization's first reliable automated global inventory: discovery coverage, credential architecture, a distributed MID Server design, identification and reconciliation rules, and CI certification.
By my measure at the time, a 98% increase in CMDB accuracy and completeness.
Read the case study →
~/lab
Where I find out what AI agents need before you can trust them.
The discipline I bring to a ServiceNow CMDB — one source of truth, clear ownership, nothing trusted without checking — applied to AI agents doing real work on infrastructure I run. Everything here is running unless it says otherwise.
running · librarian
CI certification, applied to AI agents
When a task closes, an agent re-verifies the record for whatever it touched and stamps who verified it and why. A person still approves the work before it starts. It's a lightweight CMDB I run in git, not ServiceNow — the discipline is the point.
real run · 24 Sep · abridged
cmdb/services/workflow-engine.md
- last_verified: 2026-09-08
+ last_verified: 2026-09-24
- verified_by: operator
+ verified_by: librarian
+ source_cards: [the task that changed it]
+ change history: entry added
How it works →
running · zti
Never take an agent's word for it
ZTI — Zero Trust Intelligence — started as lab work on one question: how do you govern an AI coding agent you can't take at its word? The gate re-runs the repository's own checks itself instead of trusting the agent's claim. On this site that's a link audit; on a code repository, it's the test suite.
a real run on this site
$ git commit
✗ refused: 2 broken links
$ git commit # after the fix
✓ re-checked · allowed
How it works → · IETF draft
Also running
Other projects in my AI lab
| Project | What it does | Status |
|---|
| agent-platform | One agent scopes the work, another builds it, a guard enforces the boundary | running |
| rulebook | Agents must acknowledge the current revision before they can claim work | running |
| mail-intake | Turns inbound email into tracked tasks: rules first, a model only on the exceptions | running |
| agent-metrics | GPU, model and token spend for the agents, on a wall | running |