IT and identity operations automation

Problem

Small teams running IT carry recurring, error-prone chores. Service-account credentials have to be rotated in many separate SaaS and infrastructure tools, each with its own password rules and admin interface, and the results have to reach the operator without passing through chat or email. Operational alerts sent by text to company phone numbers reach only whoever holds the phone. And when staff report that some emails are going missing, nobody can say what was lost or why.

Goal

Turn each chore into a safe, repeatable tool: one command to rotate credentials across every service with a record that holds no secrets; a secure, real-time inbox for company text alerts, limited to verified company accounts; and an evidence-based investigation that finds where mail disappears without changing anything on the live system.

My role

Sole designer and developer of the credential rotation orchestrator, the real-time message inbox (designed, built, deployed and later hardened) and the mail-delivery diagnostic toolkit (investigated the problem and wrote the tooling).

Solution

A credential rotation orchestrator: a Python command-line tool with one plug-in adapter per service behind a shared interface and per-service password policies. It applies the change through an admin API where one exists and falls back to verification plus guided manual steps where it does not, hands credentials over through an expiring one-time link, and keeps an audit record with no passwords in it.

A real-time message inbox: a signature-verified webhook stores each incoming message exactly once, and a real-time web app limited to verified company accounts shows it instantly.

A mail-delivery diagnostic toolkit: read-only scripts against the mail platform's admin APIs that rule out per-mailbox causes, mine delivery logs for the common cause behind the failures and produce a prioritised list of messages to follow up.

How it works

Rotation orchestrator.

The operator names the target account and, optionally, a subset of services. Dry-run and status modes preview everything without changing anything.

An adapter registry loads; every adapter implements one abstract interface (rotate, status check, first-time setup).

For each service, a generator builds a password from a cryptographically secure source that satisfies that service's length and character rules.

The adapter sets the credential through the service's admin API and, where supported, signs out active sessions. Services with no usable API fall back to an access check plus step-by-step manual instructions.

Results are normalised into one structure (service, outcome, notes), and the new credentials are packaged into a single expiring, view-limited one-time link shown with a QR code.

A JSON audit record captures outcomes and timestamps for every run but never the passwords.

Real-time message inbox.

The SMS provider posts each incoming message to a serverless HTTPS webhook, which validates the request signature and fails closed if the signing secret is missing.

The message is stored under the provider's own message identifier, so provider retries can never create duplicates.

A single-page app signs people in; database security rules allow reads only to verified accounts on the company domain, and no client can create or delete messages.

The app listens in real time and shows each new message with a read flag.

Mail-delivery diagnostics.

A local script completes an installed-app OAuth flow through a listener on the local machine with a state check and stores the refresh token in the operating system keychain; a shared helper mints and caches access tokens.

A settings sweep reads, for every mailbox, the settings that can silently drop or redirect mail: filters, forwarding, POP and IMAP access, send-as aliases and auto-replies.

Log mining pages through the admin audit and delivery activity logs, groups the failures by where in the delivery chain they happened (including parsing rewritten bounce addresses) and deduplicates by message identifier.

Triage classifies affected messages by subject into priority categories (finance, vendor, customer) and exports a follow-up list. Only read calls are made throughout.

Technical challenges

One interface that expresses full automation, partial automation and guided manual work across services with very different admin capabilities.

Credentials that never persist in logs or the audit trail, and a handover that avoids chat and email.

Webhook authenticity and idempotent writes under provider retries.

Access control enforced in database rules rather than in the user interface.

Proving a negative in an investigation (ruling out mailbox settings before looking further down the delivery chain), large log volumes, and a strictly non-invasive approach on a live mail tenant.

Capabilities

Multi-service credential rotation from one command
Per-service password policies
Session sign-out where supported
Guided manual fallback
Expiring one-time handover link with QR code
Dry-run and status modes
Audit log with no secrets
Signed webhook intake from several company numbers
Duplicate-proof storage
Domain-restricted sign-in
Real-time list with read status
Tenant-wide mailbox settings audit
Delivery-log mining and failure grouping
Priority classification and follow-up export

Technology

Impact

Credential rotation became a single guided command with a secret-free record and a handover that avoids chat and email. Authorised team members saw incoming company messages within seconds instead of depending on one person's phone. And a vague "emails are missing" complaint became a root cause and a prioritised list of lost messages so senders could be contacted, with nothing changed on the mail tenant during the investigation. No metrics are claimed.

Skills demonstrated

Identity and access lifecycle automation
Plugin and adapter architecture
Secure credential handling
Command-line tool design
Integration across heterogeneous admin APIs
Audit logging and dry-run safety
Serverless development and webhook security
Idempotent data design
Database security rules
Incident investigation and email infrastructure
Log analysis
OAuth