A monthly sweep of Google Workspace safety basics — two-step verification, admin counts, third-party app grants, dormant accounts — reported as what changed, not a wall of green.
Monthly to Nish, deltas only: what changed since last month. A stable posture is a two-line email.
Nobody audits workspace security on a rhythm — it gets audited when something scares us. First live run: 95% two-step coverage (39/41), zero dormant accounts, admin counts as expected, one account in the root OU to relocate, and ~118 third-party app grants now baselined for future diffs.
First Sunday
2SV, admins, tokens, dormancy, OUs
Only changes surface
Two lines when stable
Hardening actions run as their own approved tasks
For implementers and the technically curious. The full build sheet — verified queries, thresholds, and build notes — lives on the specs page.
| System | Role in this loop |
|---|---|
| GAMWorkspace admin CLI | The established admin tool for tenant operations — used here in read-only mode for the sweeps. |
| Hermesagent runtime on our server | The scheduler that wakes the loop up. Each loop is a cron job under a Hermes profile; the planned bizops profile will host the business digests (IT loops run under vpsops). |
| Healthcheckshealthchecks.huxapps.com | The dead-man's switch. The loop pings it only after a clean run — if the loop dies or errors, the ping stops and Healthchecks raises the alarm independently. This is how 'never silent' is enforced by machinery, not promises. |
| Email renderer + gwsrender_email.py | All digests pass through one shared renderer: Huxberry-branded HTML, tables for repeated rows, a coral 'needs your response' box when the loop has questions, and an arrow link on every record. Sent from the loops mailbox via the Google Workspace CLI. |
| Loop chassisloop_common.py | Shared plumbing every loop reuses instead of reinventing: state files, run-over-run diffing, Metabase drill-down link building, quiet-on-green notify logic. |
| Model / brain | What it does here |
|---|---|
| None at run timedeterministic script | A normal cycle is a plain Python script — no AI tokens are spent unless a diagnosis or judgment step is actually needed. AI wrote the script; the script does the rounds. |
| GPT-5.5 via Codexthe bulk-work model | Wrote and maintains the mechanical parts — SQL, diffing, digest assembly. Effectively free on our existing subscription, so routine cycles cost almost nothing. |
The monthly posture snapshot: per-user 2SV, admin list, token grants — diffs come from here.
Monthly email, deltas only.
Read-only admin credential path; individual account details stay out of the public digest (aggregates only).