Macktez
Our WorkCase Studies

Technology & Software

Operationalizing AI Across Every Department

How Macktez deployed Claude at every level of the business — with the identity, governance, and architecture to do it safely

Macktez (internal)AIIdentitySecurity
A human conductor leading an orchestra of humanoid robots — orchestrating AI agents across the business.

At a Glance

Client
Macktez (internal)
Problem
Move beyond using AI as a chat assistant to deploying it as a genuine operational layer across the business — able to act inside real systems, automate real work, and do it all under the same identity and governance controls that protect everything else.
Approach
A structured Claude rollout built on managed identity, least-privilege role-based access, custom MCP servers, and audit governance enforced at every endpoint.
Outcome
AI agents that operate across the business's systems through natural language — authenticated, permissioned, and audited like any other user — automating work and augmenting the team across every department.

The Opportunity

Beyond the chat window

Most organizations' experience with AI stops at the chat window: a person types a question, gets an answer, and copies the result somewhere useful. That's valuable, but it's a fraction of what's possible. The larger opportunity is to let AI act — to read from and write to the actual systems a business runs on, and to automate or assist with the work that today requires a human to log in, click through, and carry data from one place to another.

The obstacle isn't the AI's capability. It's everything around it: identity, permissions, security, and governance. An agent that can act inside your business systems is only safe if it's subject to the same controls as a human employee — authenticated through your identity provider, scoped to only what it should access, and audited so every action is attributable. Without that scaffolding, agentic AI is a liability. With it, it's a genuine operational capability.

We built the scaffolding first, then rolled out the agents. This is how.

Identity

Agents are users too

The foundation of the entire rollout is a simple principle: an AI agent is treated as a managed identity, exactly like a person.

Each agent is a JumpCloud user. It has its own identity, its own role-based access controls at Google, Microsoft, and the other platforms it touches, and its own scoped permissions — granted and revoked centrally, the same way we manage human staff. Every agent is provisioned according to the principle of least privilege: it gets access to exactly what it needs to do its job and nothing more. An agent responsible for documentation has access to the documentation systems and nothing else. An agent that handles invoicing is permissioned for the accounting platform, not HR records. Because these are real managed identities, every action an agent takes is attributable to that identity, and access can be revoked instantly if anything looks wrong.

This is the difference between "we gave the AI an API key" and "we onboarded the AI like an employee." The second is governable. The first is a breach waiting to happen.

Governance

Every action audited

There is no gateway in front of the agents’ access to business systems, and none is needed. Every MCP endpoint checks the caller’s JumpCloud group membership itself and refuses by default: no group, no access. Alongside that gate, the MCP fleet writes its own audit trail of every tool call and every authentication event, recording who called what and when.

Governance is enforced at each endpoint rather than centralized at a chokepoint, so there is no single path that everything has to squeeze through and no single point whose failure opens everything. AI activity across the business isn’t a black box — it’s a reviewable audit trail. For any organization that has to answer questions about who, or what, accessed a system and when, this is the control that makes agentic AI defensible rather than reckless.

Architecture

Custom MCPs as the connective tissue

What lets the agents actually do things is a set of custom MCP servers — the standardized way modern AI models connect to external tools and systems.

We host these at mcp.macktez.com, one endpoint per system, and every Team Member adds each endpoint to their own Claude as its own connector. Signing in goes through JumpCloud using OIDC, so an agent connects with revocable, identity-bound authorization rather than a static credential buried in a config file. The result is that the business becomes addressable in natural language: a monitoring dashboard, a business record, or a network controller can be asked — in plain language — to check, retrieve, or analyze, under a governed identity.

How the platform is built, how access to it is gated at each endpoint, and why the same layer turned out to run a monitoring program with no AI in it is the subject of its own case study.

In Practice

What the agents do, across every department

With identity, governance, and connectivity in place, the agents take on work across the business, all of it on the same governed foundation:

  • Time tracking — capturing and recording time against work without manual entry.
  • Documentation — generating and maintaining technical and operational documentation that historically went stale because no one had time to keep it current.
  • Network analysis and troubleshooting — querying network monitoring systems in natural language, surfacing issues, and assisting with investigation.
  • Monitoring — watching systems and surfacing what matters to a human operator, augmenting the team rather than replacing the human in the loop.
  • Sales and marketing — supporting outreach, content, and pipeline work.
  • Invoicing and accounting — moving financial data through the systems that handle it, reducing manual reconciliation and entry.
  • HR and compliance — assisting with the recurring administrative and compliance work that consumes staff time.

In each case the pattern is the same: work that used to require a human to log in and operate a system can now be initiated in natural language and carried out — or accelerated — by an agent operating under its own permissioned, audited identity.

The Results So Far

What the foundation has produced since May

The foundation paid for itself quickly. In the months since we put Claude to work on it (the timeline below has the dates), the same identities, connections, and working practices have carried one piece of production work after another, each starting from what the one before it had left behind:

  • A custom MCP server for every platform we manage, 29 connections at mcp.macktez.com, each checking the caller’s group membership and writing its own audit trail.
  • support.agent, a digital colleague with its own identity that reads our ticket queue every 30 minutes and hands a Team Member the evidence before anyone opens the ticket.
  • Macktez Monitor, a monitoring platform that reuses those same connections to snapshot every client’s network, server, and backup health around the clock, with no AI in the collection loop.
  • This website, designed, built, and maintained with Claude Code: every page, case study, and service description written and deployed through conversation, behind single sign-on, and reviewed on a private copy before going live.
  • A knowledge harvest that turned about 226,000 records of client history into 174 checked reference documents for 46 clients, read before every investigation and corrected by the Team.
  • The AI assisted ticket flow, which took support.agent from network tickets to support, service requests, and security, with scripts and a small classifier deciding which tickets need an investigation at all.
  • A security toolkit, a read-only security evaluation plugin the Team runs for clients, which went from version 1.0 to 2.13 in its first ten days.
  • operations.agent, a second AI Team Member, built on a shared core with support.agent so that each agent has its own identity and its own permissions.

Most of them have their own case study: Meet support.agent: Our First Fully Autonomous Digital Employee, Macktez Monitor: Building on Our AI Foundations, Vibe Coding, Done Right, Putting Past Work to Work, and AI Assisted Ticket Flow.

None of it would have come together this fast without the identity, permission, and audit layer described above, and none of it needed a second one. That is the point of building the foundation first: the second project is cheaper than the first, and each one after that is cheaper still.

Release Timeline

How it came online, day by day

None of this arrived at once. Each connection came online when the one before it had proved the pattern, the foundation under them grew as we needed it, and the systems we built on top followed. This timeline starts on the first day of our Claude rollout, and we’ll keep adding to it.

58 releases in 161 days.

May 8 to October 15, 2026. One Team Member built nearly all of it, with a vacation at the start of August; from late September the agents began committing code of their own. Keep scrolling and the run plays out left to right, one release at a time. Select any card to read its note.

29
platforms connected
9
systems built and in use
2
security programs approved
46
days with a release
2,493
commits
  • A system we built goes live
  • A security program approves us
  • A connection, a first, or foundation work
  • Commits that day, under the line

May 8, 2026

Day 1

0
platforms reachable
0
systems live
1
releases so far
0
commits so far

Day by day

Each release in order, with its day number, its date, and what changed.

The Throughline

One foundation, many kinds of work

On the surface those systems have little in common: a marketing website, a monitoring dashboard, an agent that reads a ticket queue, a process that reads a year of records. What they share is everything underneath. Each one signs in through the same directory, reaches systems through the same connections under the same permissions, and writes to the same audit trail. That's why none of them needed an architecture of its own, and why the next one won't either.

AI, deployed properly, isn't a single tool. It's a capability: once the identity, governance, and connective layer exists, it extends from how you build a website to how you run a back office. For most of our clients that layer is the one we already run as their managed service provider, which is where we start when a client asks what AI could do for them.

Outcomes

What we built.

  • AI agents provisioned as managed JumpCloud identities, with least-privilege RBAC across Google, Microsoft, and other platforms
  • Access gated at every MCP endpoint by JumpCloud group membership, fail-closed, with the fleet writing its own audit trail of every tool call and authentication event
  • Custom MCP servers hosted at mcp.macktez.com, one per tool/system
  • OAuth-backed MCP authentication via JumpCloud OIDC — identity-bound, revocable authorization, no static credentials
  • Natural-language operation across business systems through the MCP layer
  • Agentic automation and augmentation across time tracking, documentation, network troubleshooting, monitoring, sales and marketing, invoicing and accounting, and HR/compliance
  • The Macktez website itself, built with Claude Code on the same identity backbone
  • One production system after another since May 2026, each built on the connections and practices the one before it left behind

Deploy AI Department-Wide

Ready to roll AI out past a single pilot team?

Let’s map where AI can actually move the needle across your departments, and build the identity and security guardrails to do it safely.

Let’s Talk

Related

To plan a rollout like this for your own team, see:

AI Assessment & EnablementView Service

For the fundamentals behind the identity and security side of this rollout, see our University guides:

Understanding AI: From Hardware to AgentsRead ArticleThe Principle of Least PrivilegeRead Article

For more AI work in practice, see these case studies:

Meet support.agent: Our First Fully Autonomous Digital EmployeeRead Case StudyAI Assisted Ticket FlowRead Case StudyMacktez Monitor: Building on Our AI FoundationsRead Case Study