# Who runs IT-AI, and for what

> Three fits for IT-AI: internal IT teams with mixed fleets, small MSPs, and edge and robotics fleets behind CGNAT, plus where IT-AI is the wrong tool.

Canonical page: https://glick.run/it-ai/use-cases.html

IT-AI fits teams that want an AI to do real work on their machines without handing a vendor, or the AI itself, standing power over the fleet. Three groups fit best.

## Internal IT at a technical company

**Who:** IT and platform teams with roughly 20 to 500 mixed Windows, macOS and Linux devices, who already use Claude Code or a similar agent.

**What they do with it:**

- Ask Claude about a machine and get a read-only diagnosis: `list_devices`, `system_report`, `compliance_posture`, `screenshot`.
- Fix it with a write token and the deny-list on, or through the hub assistant's Apply button.
- Grade disk encryption, firewall, antivirus and OS updates across the fleet with `fleet_compliance`.
- Give a developer admin rights on a Windows laptop for an hour instead of forever, with the hub removing them when the hour is up.

**Why IT-AI:** the hub, the audit log and the AI key stay on your infrastructure, and the AI's reach is set by the token you mint.

## Small MSPs (1 to 10 technicians)

**Who:** small managed service providers looking after several small clients.

**What they do with it:**

- Give each technician their own account and enrollment token. On a hub with identity configured, each one sees and drives only the devices they enrolled.
- Run the same check or community script across every device (`fleet_report`, `run_script_fleet`).
- Push installers with `push_file` and install software with winget, brew or apt.

**Why IT-AI:** self-hosting is free, with no per-endpoint or per-technician fee. **Where it falls short:** there is no PSA, ticketing, billing or backup, and no patch rollout policies. An MSP that needs those should keep a full-suite RMM.

## Edge and robotics fleets

**Who:** teams running Linux devices, such as NVIDIA Jetson boards, on networks they do not control: behind CGNAT, on a customer's site, on cellular.

**What they do with it:**

- Reach a device with no inbound port and no public address, because the agent dials out.
- Get a shell, start a long job and follow its log, pull a file, or take a camera photo.
- Turn a device into a **WireGuard VPN exit** through the hub's UDP relay, so a pass holder can browse from the site's own network. The built-in userspace WireGuard runs on kernels without the WireGuard module, including a Jetson Orin's.

**Where it falls short:** IT-AI is not an over-the-air image updater. It updates its own agent, not your root filesystem or containers.

## When IT-AI is the wrong tool

- You need phone and tablet management (MDM) or mobile viewer apps.
- You need patch rings, maintenance windows and per-patch approval at scale.
- Your contract requires a SOC 2 report or OS-code-signed agents today.

See the [comparison](https://glick.run/it-ai/compare.html) for tools that cover those.