How to Run an AI Directory & Identity Agent with OE Runtime

Search, audit, and manage users in Active Directory or LDAP with natural language. OE Runtime connects directly to your directory server, checks account health, and surfaces stale or misconfigured accounts — no IT ticket required.

The Agent YAML

Create a file called agent.yaml inside a directory-identity/ directory:

name: Directory Agent
description: Search and manage users in LDAP or Active Directory
instructions: |
  You are a directory services agent. Search for users, list groups,
  retrieve account details, and manage entries in LDAP or Active Directory.
  Always confirm before making any changes.
  Complete all steps fully before writing your report.
steps:
  - name: Search Users
    content: |
      Search Active Directory for all user accounts created or modified in the last 30 days.
      Retrieve: display name, email, department, account status (enabled/disabled), and last login date.
  - name: Check Account Health
    content: |
      From the retrieved accounts:
      - Identify any accounts that are disabled but still have group memberships
      - Identify accounts with no login in the last 30 days
      - Flag accounts with missing email or department fields
  - name: Report
    content: |
      Produce a directory health summary:
      - Total accounts found
      - Number of enabled vs disabled accounts
      - Accounts flagged for review (disabled with memberships, stale logins, incomplete profiles)
      - Recommended actions for each flagged account
connectors:
  - connection_name: Active Directory
    connection_type: ldap

The Config File

Create oe-config.json in the same directory:

{
  "llm": {
    "provider": "openai",
    "model": "gpt-4o",
    "apiKey": "YOUR_OPENAI_API_KEY"
  },
  "server": {
    "enabled": false,
    "port": 3333,
    "apiKey": "your-secret-api-key"
  },
  "connectors": [
    {
      "connection_name": "Active Directory",
      "connection_type": "ldap",
      "url": "ldap://192.168.1.10:389",
      "bindDN": "cn=admin,dc=example,dc=com",
      "bindPassword": "YOUR_LDAP_PASSWORD",
      "baseDN": "dc=example,dc=com"
    }
  ]
}

Replace the url, bindDN, bindPassword, and baseDN with your Active Directory or LDAP server details. Use a read-only service account for safety when running audit queries.

Download OE Runtime

Run the Agent

Windows

# Run the agent
oe-runtime-win.exe directory-identity/agent.yaml --config directory-identity/oe-config.json

macOS

# Make executable (first time only)
chmod +x oe-runtime-macos

# Run the agent
oe-runtime-macos directory-identity/agent.yaml --config directory-identity/oe-config.json

Linux

# Make executable (first time only)
chmod +x oe-runtime-linux

# Run the agent
oe-runtime-linux directory-identity/agent.yaml --config directory-identity/oe-config.json

Running as an API Server

Add --serve to start OE Runtime as an HTTP server on port 3333:

oe-runtime-win.exe --serve --config directory-identity/oe-config.json

Then send a request:

curl -X POST http://localhost:3333/run \
  -H "Content-Type: application/json" \
  -d '{"yaml": "directory-identity/agent.yaml", "params": {}}'

Or import the Postman collection (download above) to test all endpoints visually.

Use Cases

• Access auditing — Identify which users belong to privileged groups such as Domain Admins, VPN users, or finance system roles. Run the agent before a quarterly security review to produce a ready-made access report without querying the directory manually.
• Offboarding verification — Confirm that departed employees have been fully removed from all Active Directory groups and that their accounts are disabled. The agent checks for the common offboarding gap where accounts are disabled but group memberships are left intact.
• Stale account detection — Surface user accounts that have not logged in for 30 days or more and are still enabled. These represent a security risk — the agent lists them with their last login date so IT can review and disable them.
• Onboarding validation — Verify that new user accounts have been correctly provisioned with the right department, email, and group memberships. Run the agent after each onboarding batch to catch provisioning errors before the new hire starts.
• HR self-service lookups — Let HR teams query colleague contact details, department assignments, and reporting lines without needing direct AD access. The agent translates plain English questions into LDAP queries and returns formatted results.
• Compliance reporting — Generate user access reports for ISO 27001, SOC 2, or internal audit requirements by listing all accounts with access to specific systems or groups. The agent produces the report in minutes rather than requiring IT to run manual queries.
• Group membership management — Audit the membership of critical security groups to ensure only authorised users are included. The agent lists every member with their account status, making it easy to spot unexpected additions.
• Incomplete profile remediation — Find accounts missing required fields like email address, department, or phone number. The agent produces a list of affected accounts with recommended updates, reducing the manual effort of keeping the directory clean.