How to Run an AI Directory & Identity Agent with OE Runtime

Search, audit, and manage users in Active Directory or LDAP with natural language. OE Runtime connects directly to your directory server, checks account health, and surfaces stale or misconfigured accounts — no IT ticket required.

What You Need

• Node.js 18+ installed, or the OE Runtime binary from openenthrium.com/runtime
• An API key from OpenAI, Anthropic, or any supported LLM provider
• An LDAP or Active Directory server with read credentials (host, bind DN, password)
• A text editor — nothing else

Create the Project Folder

Create a folder called directory-identity/ and add these two files:

The Skill Files

Create SKILL.md inside a directory-identity/ directory. This is the portable skill — it follows the agentskills.io format and runs unchanged on Claude, Cursor, Windsurf, or OE Runtime:

---
name: directory-identity
description: Search and manage users in LDAP or Active Directory
license: Apache-2.0
metadata:
  author: Open Enthrium
  version: "1.0"
---

You are a directory services agent. Search for users, list groups,
retrieve account details, and manage entries in LDAP or Active Directory.
Always confirm before making any changes.
Complete all steps fully before writing your report.

## Step 1: Search Users
Search Active Directory for all user accounts created or modified in the last 30 days.
Retrieve: display name, email, department, account status (enabled/disabled), and last login date.

## Step 2: Check Account Health
From the retrieved accounts:
- Identify any accounts that are disabled but still have group memberships
- Identify accounts with no login in the last 30 days
- Flag accounts with missing email or department fields

## Step 3: Report
Produce a directory health summary:
- Total accounts found
- Number of enabled vs disabled accounts
- Accounts flagged for review (disabled with memberships, stale logins, incomplete profiles)
- Recommended actions for each flagged account

Create agent.yaml in the same directory to wire the skill to your connector:

name: Directory Agent
description: Search and manage users in LDAP or Active Directory
connectors:
  - connection_name: Active Directory
    connection_type: ldap
skills:
  - path: ./
    trigger_type: auto

The Config File

Create oe-config.json in the same directory:

{
  "llm": {
    "provider": "openai",
    "model": "gpt-4o",
    "apiKey": "YOUR_OPENAI_API_KEY"
  },
  "server": {
    "enabled": false,
    "port": 3333,
    "apiKey": "your-secret-api-key"
  },
  "connectors": [
    {
      "connection_name": "Active Directory",
      "connection_type": "ldap",
      "url": "ldap://192.168.1.10:389",
      "bindDN": "cn=admin,dc=example,dc=com",
      "bindPassword": "YOUR_LDAP_PASSWORD",
      "baseDN": "dc=example,dc=com"
    }
  ]
}

Replace the url, bindDN, bindPassword, and baseDN with your Active Directory or LDAP server details. Use a read-only service account for safety when running audit queries.

Download OE Runtime

Run the Agent

From the parent folder containing your skill directory:

1 npx recommended

npx -y @openenthrium/oe-runtime@latest ./directory-identity

2 Windows

oe-runtime-win.exe ./directory-identity

3 macOS

chmod +x oe-runtime-macos
./oe-runtime-macos ./directory-identity

First run blocked? System Settings → Privacy & Security → Allow Anyway.

4 Linux

chmod +x oe-runtime-linux
./oe-runtime-linux ./directory-identity

5 API Server integration

Add a "server" block to oe-config.json, then start with --serve:

{
  "llm": { ... },
  "server": { "enabled": true, "port": 3333, "apiKey": "your-secret-key" },
  "connectors": [ ... ]
}

npx -y @openenthrium/oe-runtime@latest --serve --config oe-config.json

Run with inline YAML:

curl -X POST http://localhost:3333/run \
  -H "Content-Type: application/json" \
  -H "X-API-Key: your-secret-key" \
  -d '{"yaml": "...", "params": {}}'

Or run from a file on the server:

curl -X POST http://localhost:3333/run-file \
  -H "Content-Type: application/json" \
  -H "X-API-Key: your-secret-key" \
  -d '{"file": "/path/to/agent.yaml", "params": {}}'

Use Cases

• Access auditing — Identify which users belong to privileged groups such as Domain Admins, VPN users, or finance system roles. Run the agent before a quarterly security review to produce a ready-made access report without querying the directory manually.
• Offboarding verification — Confirm that departed employees have been fully removed from all Active Directory groups and that their accounts are disabled. The agent checks for the common offboarding gap where accounts are disabled but group memberships are left intact.
• Stale account detection — Surface user accounts that have not logged in for 30 days or more and are still enabled. These represent a security risk — the agent lists them with their last login date so IT can review and disable them.
• Onboarding validation — Verify that new user accounts have been correctly provisioned with the right department, email, and group memberships. Run the agent after each onboarding batch to catch provisioning errors before the new hire starts.
• HR self-service lookups — Let HR teams query colleague contact details, department assignments, and reporting lines without needing direct AD access. The agent translates plain English questions into LDAP queries and returns formatted results.
• Compliance reporting — Generate user access reports for ISO 27001, SOC 2, or internal audit requirements by listing all accounts with access to specific systems or groups. The agent produces the report in minutes rather than requiring IT to run manual queries.
• Group membership management — Audit the membership of critical security groups to ensure only authorised users are included. The agent lists every member with their account status, making it easy to spot unexpected additions.
• Incomplete profile remediation — Find accounts missing required fields like email address, department, or phone number. The agent produces a list of affected accounts with recommended updates, reducing the manual effort of keeping the directory clean.