CS-P01 · Anchor world
The IT desk that says no.
CallCamIT is a Windows AI support desk that lives in the tray as an assistant called Cam. It runs a local model by default, talks to Microsoft Graph for Azure tenants, and handles ticketing with runbook retrieval. What makes it enterprise software is what it refuses to do — and that refusal lives in the code path, not in a settings dialog somebody can switch off.
£250 / month ex VAT · £300 inc VAT · per organisation, unlimited devices and users on the domain. Not sold self-service — every rollout starts with a call, because a tool with these permissions should not be bought blind.
Ask it to do something it must not
These are its real guardrails, not a marketing list. Pick a request and see what happens.
cam >
BLOCKED
What it guarantees
Customer data does not leave the machine
The local model is the default for exactly this reason. The hosted path is opt-in and must be an explicit enterprise decision — enforced where the call is made, not where the checkbox lives, because that config is also written by managed policy and by hand.
No destructive tenant actions
Tenant, company, database, subscription, user, group, site and backup deletion are all blocked outright.
Read-only internet
Research is GET-only, domain-allowlisted and redirect-restricted.
Off-site is judged by destination
Not by provider name. A remote Ollama host is off-site; a loopback OpenAI-compatible endpoint is not.
Scoped admin rights
Self-install to domain machines uses the narrowest permissions that actually work, and break-glass accounts are protected from the automation entirely.