Diogo Fernandes

Context. Sword Health's device and identity data lived in six systems with no unified view: asset register (Snipe-IT), MDM (Kandji, JumpCloud), identity (Okta), Google Workspace, and endpoint security (SentinelOne). Compliance was checked if someone checked, if it was needed, and if there was time: manually pulling and cross-referencing exports from each system.

The problem under the problem. The sources disagreed with each other. Across ~3,400 device records, each system saw a different fleet: devices existing in the asset register but not in endpoint security, managed devices unaccounted for, devices belonging to people who had already left. Any compliance answer built on a single source was wrong by construction.

Approach.

• Established the asset register as the single source of truth and reconciled every other system against it by hardware serial, with conflicts flagged for human resolution, never silently merged
• Built a live dashboard unifying all six sources: per-device security coverage, encryption, management state, ownership, and data freshness, with every non-compliant device traceable to the specific gap and source
• Made cross-system blind spots first-class citizens: dedicated views for devices missing from each system, devices assigned to departed users, and devices unseen for 7/14/30+ days
• Delivered implementation through AI coding agents under my direction and review, with architecture decisions locked in writing before any build

Next phase (in staging, launch pending). A second-generation platform extends the same visibility from compliance into spend and lifecycle: full audit trail with exportable evidence packs for ISO/SOC-style reviews, likely-machine-swap detection (a device quiet for months while its user actively works on a replacement: unrecovered hardware made visible), and seat-level SaaS cost tracking with waste detection and renewal tracking, fed by automated directory and seat feeds. Cost findings will be published here once real data has flowed.

Context. Sword Health's managed Mac fleet had drifted across macOS versions, with no enforced update baseline. Target: bring the fleet to macOS 26.5.2, the last version supporting Intel hardware, without disrupting a fully remote workforce.

The problem under the problem. No single trustworthy device list existed. The asset register and the MDM each held partial, conflicting views of the fleet. Enforcing updates against either alone would hit the wrong devices or miss real ones.

Approach.

• Merged asset and MDM data by hardware serial into one verified enforcement list, surfacing and resolving conflicts between sources rather than assuming either was right
• Scoped deliberately: whitelist of deployed-status devices only (US and Portugal), excluding small blueprint groups where enforcement risk outweighed value
• Phased rollout: canary batch of ~50 devices, then two primary waves (~737 and ~426), with compliant and excluded devices tracked separately
• When the approval window slipped past the original plan, corrected the enforcement configuration before the primary waves rather than shipping a stale one
• Wrote end-user communication templates and the recipients workbook, so every affected user knew what was coming and when

Context. When a remote employee leaves Sword Health, their laptop and equipment have to come back by courier. The process was a manually sent email template asking the leaver for their address, contact, pickup date, box count, whether they even had boxes, and whether they could print shipping labels, with the answers scattered across reply threads.

The problem under the problem. A process built on free-text email fails in expensive ways. Real failure case: a leaver without boxes for all items meant the company had to ship boxes out first; a lost shipping label then got the courier pickup refused, triggering a cycle of reschedules. Every failure extends the window where company hardware sits unrecovered with someone who no longer works there, and nothing about an email thread tracks where in the process each return actually is.

Approach.

• Replaced the free-text email with a structured return form, so every required detail is captured once, completely, in a format automation can act on
• Designed the flow as four focused stages rather than one monolith: sending the form, processing the submission, chasing non-responders automatically, and reconciling after pickup that what came back matches what was assigned
• Pre-filled each leaver's assigned equipment from the asset register, so the person confirms a list instead of remembering one
• Standard case fully automated end-to-end: submissions create pickup tickets directly on the shipping team's board (a cross-team handoff designed and agreed with that team), so no IT touchpoint sits between form and pickup
• Exception case routed for human handling: submissions flagging missing boxes are surfaced to IT before any pickup is booked, since boxes must ship out first
• Scoped v1 deliberately: shipping labels stay manual, and the trigger stays manual, with HR-system integration reserved for v2 once the core flow proves itself