RichardHam.co.uk Blog

Blog

  • What 2024 Taught Me About Turning AI Work Into Infrastructure

    s

    2024 was the year AI stopped feeling like a side experiment and started feeling like part of the working stack.

    The biggest change was not speed. It was structure.

    What changed

    • routine work got easier to delegate
    • review became part of the workflow instead of an afterthought
    • local execution mattered more than hype
    • security thinking moved earlier in the process

    The numbers were useful, but the bigger shift was behavioural. I spent less time wrestling with one-off tasks and more time building repeatable paths.

    What worked

    The pattern that kept showing up was simple:

    1. keep the sensitive bits local when possible
    2. make the outputs reviewable
    3. use the repository as the record of truth

    That combination did more for consistency than any single tool choice.

    What I would change

    If I were doing it again, I would write more of the operating rules earlier. The systems worked better once the guardrails were explicit.

    That is usually how these things go. The tech is rarely the hard part. The hard part is deciding how much freedom the workflow should really have.

  • CrewAI Launch: Building Secure Agent Crews

    s

    When multi-agent tooling matured in late 2024, it solved one problem and exposed another. Coordination got easier. Risk did too.

    A system that can research, draft, test, and propose changes is useful. A system that can do all of that without a clear approval path is a liability.

    The basic shape

    Agent orchestration
-> local inference
-> secret handling
-> human approval

    That setup sounds obvious now. It did not feel obvious at the time.

    The first production uses were straightforward: security reviews, repetitive checks, and content drafting. The output was good enough to save time, but only when the guardrails stayed in place.

    Lessons that stuck

    • Give each agent the minimum access it needs.
    • Log outputs before anything changes state.
    • Test for prompt injection and bad assumptions early.

    Those three habits did more for reliability than any naming convention or framework choice.

    What changed

    The real shift was mental. I stopped thinking about agents as clever helpers and started treating them like junior team members. Useful, yes. Trusted by default, no.

    That distinction matters. A junior teammate can ask questions and escalate. An unchecked automation chain just keeps moving.

    The safest systems are boring in the right ways. They make decisions visible. They make mistakes recoverable. They let a human step in before the wrong thing becomes the permanent thing.

  • How I Stopped AI Workflows From Sprawling

    g

    By mid-2024 I was juggling several AI tools at once. The work was useful, but the coordination started to eat the time I was trying to save. Every extra prompt, every follow-up, every half-finished idea added friction.

    So I changed the shape of the work. Ideas became GitHub issues. Research happened first. Code changes went through review. Nothing moved forward without a human looking at it.

    The workflow

    Idea -> GitHub issue -> research -> code -> review -> deploy

    The important part was not the diagram. It was the discipline around it.

    • Every item carried a priority and a budget.
    • The review step stayed human.
    • The system ran overnight so I could review the output in the morning instead of reacting in real time.

    What it changed

    The main win was not speed for its own sake. It was clarity. I spent less time babysitting the process and more time making decisions that mattered.

    A rough summary of the difference:

    Metric Before After
    Code hours per week 20h 4h
    Monthly token spend £120 £12
    Projects shipped per month 1 4
    GitHub commits per month 45 200+

    What made it work

    1. Keep the routing local when you can.
    2. Keep write access scoped.
    3. Treat the repository as the source of truth.

    That combination is what made the setup durable. Not the tools, really. The rules.

    I still think that is the part people miss. AI does not remove the need for process. It makes process more obvious.

  • Why Zero-Trust Thinking Matters in AI Systems

    Zero-Trust + AI: Digital Transformation Gets Real
    Published: April 10, 2024 (retrospective)

    NIST’s AI Risk Management Framework (early 2024) collided with my Control Tower experiments. For years, I’d preached zero-trust to clients. Now I had to apply it to my own AI stack. Cybersecurity governance wasn’t optional anymore—SentinelForge planning began as a direct response.

    Governance Stack Emerges

    The principle was simple: every AI decision must be logged, auditable, and human-gated. The architecture:

    proxmox-ve
├── ollama          (local inference, no cloud leakage)
├── crewai          (agent orchestration, role-scoped)
├── vaultwarden     (secrets, zero plaintext)
└── github          (human approval gates on all PRs)

    This wasn’t theoretical. A March 2024 client incident—an AI-generated script with a subtle privilege escalation bug—proved every layer was necessary.

    Zero-Trust Applied to AI

    Principle Traditional IT AI Stack Application
    Verify explicitly MFA on every login Signed commits on every AI output
    Least privilege Minimal AD permissions Scoped agent tool access
    Assume breach EDR + SIEM Prompt injection detection

    Lessons

    1. Treat AI agents like privileged users—same controls, same audit trails.
    2. NIST AI RMF is practical, not theoretical; map it to your stack early.
    3. Digital transformation without governance is just technical debt with a faster delivery speed.

    Need a zero-trust AI framework for your business? Let’s talk.

    Next: Control Tower blueprints go live (Jul 2024).

  • M365 Copilot GA: Auditing in the AI Era

    t

    When Microsoft 365 Copilot arrived, the immediate question from clients was not “Can it help?” It was “Is it safe to turn on?”

    My answer was simple: not without a proper permissions review.

    AI does not remove tenant risk. It makes existing risk easier to surface.

    What I kept finding

    Across multiple audits, the same issues kept coming back:

    • over-permissive app consents
    • mailbox forwarding rules that nobody had reviewed in months
    • Intune drift that had crept in quietly

    None of that was exotic. It was just the usual gap between default settings and an actual security posture.

    Why the audit mattered

    The useful part of the process was not the reporting template. It was the discipline.

    I needed a way to check the tenant, explain the findings clearly, and keep the evidence somewhere traceable. That made the audit easier to repeat and a lot harder to hand-wave away.

    The lesson

    If Copilot is going to sit on top of the tenant, the tenant needs to be in decent shape first.

    That means permissions, logging, and a clear view of who can do what. Otherwise the tool just gives people faster access to a system they do not actually understand.

  • GitHub AI Boom: 65k+ Projects Spark My Homelab

    l

    In late 2023 the pace of AI tooling changed fast. The cloud options were exciting, but they also made the cost and privacy trade-offs impossible to ignore.

    So I started moving experiments into a local homelab.

    The setup

    The early setup was basic:

    • a GPU-backed VM
    • local model storage
    • simple monitoring from day one

    That was enough to prove the idea.

    What I learned

    Local inference was not perfect, but it was good enough for a surprising amount of work. The bigger models stayed useful for harder reasoning tasks, but a local model could handle a lot of the boring stuff cheaply.

    That changed how I thought about the system. The cloud stopped being the default. It became the exception.

    The real lesson

    Once you run a few workflows locally, the shape of the problem changes. Privacy becomes easier to reason about. Costs become predictable. And you start writing down the routing rules because the routing rules themselves become valuable.

    That was the start of a much longer shift for me, but the important bit was simple: the local stack made the work feel more deliberate.

  • ChatGPT Enterprise: My First Steps into AI-Assisted IT

    ChatGPT Enterprise: My First Steps into AI-Assisted IT
    Published: September 25, 2023 (retrospective)

    2023 marked my pivot from 25+ years of pure IT/cybersecurity scripting to blending AI into daily workflows—starting with OpenAI’s ChatGPT Enterprise launch in late August. As a fractional IT Director managing M365 environments and Proxmox homelabs, I was sceptical: could AI handle PowerShell automation without hallucinating disasters? This post recaps those early experiments, wins, and the spark that ignited my AI journey.

    The Catalyst: Enterprise AI Goes Live

    ChatGPT Enterprise dropped on August 28, 2023, promising admin controls, data privacy, and unlimited GPT-4 access—perfect for SME cybersecurity without the free-tier limits. I spun it up immediately for real client work: generating Intune policies, parsing M365 audit logs, and drafting Bash scripts for QNAP backups. No more hours tweaking regex—AI nailed 80% on first try.

    Early tests:
    – Converted manual PowerShell M365 mailbox audits to reusable functions
    – Automated DD-WRT router configs for client VPNs
    – Brainstormed cPanel/WHM hardening checklists

    Key Wins and Pitfalls

    Q3 Milestones:
    – September: First AI-generated Intune deployment script—deployed live, zero errors. Saved 4 hours per client.
    – October: Ollama early access teased local runs, but cloud GPT-4 crushed complex queries.
    – November: GitHub’s generative AI repos tripled to 65k+, inspiring my first LocalLLM-Router sketches.

    Experiment Time Saved Issues Found
    M365 Audits 4h/client Overly verbose outputs
    Intune Policies 2 days/project Needed fact-checking
    Backup Scripts 3h/setup Hallucinated syntax (fixed iteratively)

    Pitfalls taught resilience: AI excelled at boilerplate but flopped on edge cases—my cybersecurity instincts always double-checked outputs.

    Lessons from the Frontlines

    1. Start small: Use AI for scripting grunt work, not strategy.
    2. Local potential: Ollama’s October buzz hinted at cost escapes from cloud tokens.
    3. Governance early: Even then, I logged prompts/outputs for audit trails—foreshadowing SentinelForge.

    ChatGPT Enterprise wasn’t a replacement; it amplified my expertise, prepping 2024’s Control Tower orchestration.

    Ready for AI-secured IT? Contact me for M365 audits or homelab setups.

    Next: GitHub AI Boom and My Homelab Shift (Nov 2023).

Powered by