Shannu.
← Back

03 / The Work

Internal IT, Asset And Budget Platform

Assets · Tickets · Password Vault · Budget · Knowledge Graph · MCP For Claude · Live

Built At Antz →

The Problem

IT used to live on HR's plate, on top of everything HR already carries. As it piled up, I volunteered to take it over. What existed was a spreadsheet, no clean support pipeline, and no real audit trail. That gap had consequences for a company pursuing ISO 27001. So I built the tool that should have already existed.

The Decisions

Kill The Spreadsheet

Replaced an Excel-based IT workflow with a tracked, auditable system: assets, custody history, service records, tickets, and budget in one place, each change attributed to someone.

Least Privilege By Default

Three roles. A regular user sees only their own assets. No custody history, no passwords, no invoices. Identity comes from Entra sign-on; the app decides what you're allowed to touch.

Secrets Encrypted, Revealed On Demand

Per-asset credentials live in an encrypted vault, shown only when someone actually needs them, never in plain text in a sheet.

Bends Without A Redeploy

Asset types are admin-managed, so a new kind of hardware or a new SaaS seat to track is a form entry, not an engineering ticket.

Let Claude Read It

A knowledge graph over everything in the platform, exposed through an internal MCP server. Anyone with access can ask Claude about assets, spend or tickets from whichever Claude app they already use.

How It Works

  1. 01Sign in with your work account. What you can see and touch is decided by your role (admin, HR, or a regular user), not by who trusts you.
  2. 02Every laptop, monitor, router, display: who holds it, since when, what's been repaired, what it cost. Tracked, not remembered.
  3. 03Credentials live in an encrypted vault and are revealed only when someone actually needs them. Never in plain text in a shared sheet.
  4. 04New kind of hardware to track, or a SaaS seat to log? Add it in the app. No engineering ticket, no redeploy.
  5. 05Need a number fast? Budget and quick metric dashboards sit on top, and a knowledge graph ties all of the data together.
  6. 06It has its own MCP server, deployed internally, so Claude can query it from the web app, desktop, mobile, the browser extension and Claude Code.

High-Level Design

External SSO (identity)App authorizes (RBAC)AdminManagerUserscope: all + configscope: all · limited writesscope: self onlyassets · assignments · service · vault · tickets · budget · configUser sees own records only: no vault, no history
// sanitized · generic role model, not the real permission matrix

The Outcome

Live, in phased use, and the reason I was named secondary ISO 27001 contact with actual authority to reject improperly signed-off requests. It has kept growing since: dashboards, a knowledge graph, and an MCP server that plugs it into Claude. The tool became the job.

3 roles · 15 data models · 16 API resources · knowledge graph · internal MCP server

Named It Myself. Still Not Sorry.