Assessment pathway
Creating a repeatable security route for Codex and MCP adoption.
Structured current and target-state review across architecture, identity, data movement, connected tools and human oversight—then shaped risk-based Fast-track, Standard and Enhanced assessment routes.
Architecture triageApproval gatesEvidence modelRisk-based routing
Integration assurance
Examining enterprise AI integration with Microsoft 365.
Analysed SharePoint, Teams and Outlook data flows, Microsoft Graph permission scope, connector actions and pilot safeguards to surface the decisions needed before broader enablement.
Data-flow analysisPermission scopeConnector actionsPilot guardrails
Identity governance
Improving evidence for inactive-user and leaver reviews.
Distinguished lifecycle removal from inactivity-based review, identified tooling constraints and clarified how a reliable population and defensible review evidence could be established.
Review populationLeaver controlsTool constraintsAssurance evidence
Third-party AI risk
Turning provider claims into decision-ready assurance.
Assessed external AI and data-platform use cases for verified contractual protections, retention, training restrictions, audit rights and incident notification evidence.
Data handlingContract evidenceRetentionIncident obligations
Security control baseline
Defining control expectations for a managed platform.
Developed an assessment baseline spanning managed identities, MFA, Conditional Access, least privilege, privileged access, lifecycle and access reviews—clearly separating assumptions from verified controls.
MFA & accessManaged identitiesPrivilegeLifecycle review
Engineering governance
Assessing GitHub and AI skill-sharing patterns.
Explored repository use and shared AI capabilities through platform, team and governance risk lenses to support safer collaboration without overstating administrative or implementation ownership.
Repository trustSkill provenanceTeam boundariesGovernance pattern