The Safe Path Only

Natural-language M365 without lowering IT's guard

OpenM365 — Amplifier Meets the Enterprise

Give naive users LLM access to all of M365 — safely

OpenM365 gives non-technical users natural-language, LLM-driven access to enterprise Microsoft 365 — email, calendar, OneDrive, SharePoint, Teams, contacts, tasks, groups — by making the safe path the only path an agent can take.

The promise only counts if the reach is real. So how far does it already go?

Proof

It already reaches 8 Microsoft Graph surfaces

This isn't a concept slide. OpenM365 ships domain modules for mail, calendar, OneDrive, SharePoint, Teams, contacts, tasks and groups — the surfaces enterprise work actually happens on.

Real reach into M365. Which is exactly what makes raw access dangerous.

8

Graph surfaces: mail, calendar, OneDrive, SharePoint, Teams, contacts, tasks, groups

28,781

Lines of Python in src/

154

Source files

4,639

Test functions across 200 test files

The Danger

You can't hand an LLM raw Graph access

One bad call could delete a mailbox or leak confidential files — and IT cannot govern what has no safety envelope. That's why naive access is unacceptable to the enterprise.

So OpenM365 never exposes raw Graph. Every ask enters through one door.

Destructive by accident

A single mutating call to Graph could delete a mailbox that was never meant to be touched.

Confidential leakage

Without controls, an agent could exfiltrate sensitivity-labelled files or PII outside the tenant.

Ungovernable

IT can't approve what has no safety envelope — so the answer has been to say no.

The On-Ramp

Every request enters through an LLM Intent Kernel

Plain-English asks are classified by an LLM into one of 6 action categories, then planned into concrete steps — turning natural language into a governable, step-shaped action.

Once an ask is steps, every step can be judged. That's where the hooks come in.

QUERY

Read / look up

CREATE

Make new

MODIFY

Change existing

DELETE

Remove

DEPLOY

Roll out

ADMIN

Administrative

The Safety Envelope

8 constitutional hooks judge every step, fail-closed

Each step is evaluated by 8 hooks in fixed order #1–#8. The engine is fail-closed: any single DENY — or any hook exception, caught and treated as a DENY vote — blocks the whole action.

That governs actions before they run. But what happens when one still goes wrong?

1EntraIdentity first to evaluate every action

2RBAC

3DLP MIP labels, exfiltration, PII

4CostControl

5RateLimiting

6ToolGateway

7ApprovalWorkflow

8Audit final — always runs, votes ABSTAIN

Survivable Mistakes

Destructive steps are checkpointed for one-click rollback

Before destructive operations, CheckpointManager takes a filesystem snapshot of the workspace. Every step can carry a compensating undo, run in reverse order on failure — so a mistake can be walked back.

Snapshot plus reverse-order undo keeps the safe path safe even when an action fails.

Snapshot first

CheckpointManager creates a filesystem snapshot of workspace directories before destructive operations (EXE-004).

Reverse-order undo

On failure, PlanRunner replays each completed step's compensating rollback action in reverse order.

Preview without touching Graph

DryRunClient intercepts POST/PUT/PATCH/DELETE and passes GET through, so writes can be previewed before executing.

The Guarantee

There is no fast path around safety

“Every step goes through StepExecutor which invokes the hook pipeline. There is no mode that omits hooks. There is no fast path around safety.” Even rollbacks are re-evaluated by the same pipeline (with no rollback-of-rollback) — so IT can grant LLM access without lowering its guard.

Un-bypassable by construction. And the same discipline built OpenM365 itself.

Amplifier Meets the Enterprise

OpenM365 was built by an autonomous Amplifier dev-machine

1,965 of 1,992 commits came from the Amplifier bot over roughly 5 weeks, with 236 features tracked complete and project status healthy. The discipline that makes agents safe in M365 also built the system.

Safe agentic access to the enterprise — and a proof point of how it gets built.

1,965

of 1,992 commits from the Amplifier bot

~5 wks

Autonomous iteration (2026-03-02 → 2026-04-06)

236

Completed features tracked in STATE.yaml

healthy

Overall project status

Sources

Research Methodology Active

Data as of: last commit 2026-04-06. All figures verified against the openm365 repository; fact-check verdict: pass.

Feature status: constitutional hooks, rollback/checkpointing, intent kernel, dry-run, approval workflow, 8 Graph surfaces and Entra/OAuth all COMPLETE. Local/COM offline backend is in backlog (status: ready), not yet shipped.

Commands run:

git rev-list --count HEAD → 1,992 commits; git log --reverse --format='%ai' → 2026-03-02 to 2026-04-06 (~5 weeks)
git log --format='%an <%ae>' | sort | uniq -c | sort -rn → 1,965 Amplifier bot / 27 openm365 Monitor
find src -name '*.py' | xargs wc -l | tail -1 → 28,781 lines; find src -name '*.py' | wc -l → 154 files
find tests -name 'test_*.py' | wc -l → 200; grep -rh 'def test_' tests/ | wc -l → 4,639
ls -1 src/openm365/graph/*.py → mail, calendar, onedrive, sharepoint, teams, contacts, tasks, groups (8 surfaces)
for f in ...; do grep -A3 'def order' src/openm365/safety/hooks/$f.py; done → hooks ordered #1–#8
sed -n '1,20p' src/openm365/executor/runner.py → “There is no mode that omits hooks. There is no fast path around safety.”
sed -n '14,30p' src/openm365/intent/models.py → 6 intent categories (QUERY/CREATE/MODIFY/DELETE/DEPLOY/ADMIN)
grep -c '^- ' STATE.yaml → 236 completed features; grep 'status: healthy' STATE.yaml

Gaps: Test PASS status is NOT claimed — only test counts are grounded (pytest --co produced collection errors in this environment, likely missing runtime deps / M365 credentials). Bulk-delete limits are a policy-configurable goal, not a shipped constant. The local/COM offline backend is not yet implemented.

Primary contributors: Amplifier autonomous dev-machine bot (1,965 commits, ~99%); openm365 Monitor bot (27 commits).