Tier-one ticket triage
Classify, try the runbook, escalate only with full context. The bulk of identity tickets close themselves rather than queueing for a human.
The 65% of tickets that should never have queued
Identity tickets are the highest volume category, and roughly sixty-five percent of them are runbook-trivial: password reset, app access request, SSO failure on a known cause, MFA reset, conference-room laptop driver. The platform that closes those before they queue is the platform that gives the IT team back the bandwidth to handle the cases that actually need a human.
What triage looks like inside ServiceNow or Jira Service Management
The agent reads the inbound ticket, classifies it against the runbook library, and either runs the runbook (reset, request, troubleshoot) or escalates with the full context attached. The customer never sees a separate tool because the work happens inside the service catalog they already use. Status updates write back to the ticket. Escalations attach the runbook attempts the agent already ran so the human picks up where the agent left off.
What the runbook library looks like
Every customer's runbook library starts from a baseline of the most common identity workflows (Workspace, Slack, GitHub, Okta, Microsoft 365, AWS, 1Password) and expands as the customer adds runbooks. Custom runbooks live alongside the baseline and execute the same way. The library is owned by the customer's IT team; the agent is the executor.
Frequently asked
What does the agent escalate to?
The standard tier-two queue inside the customer's service catalog (ServiceNow, Jira Service Management, Zendesk). The escalation includes the runbook attempts the agent already ran so the human does not start from scratch.
Can the agent run a custom runbook we wrote?
Yes. The runbook authoring surface lets the IT team write runbooks the agent can execute. The format is human-readable plus an executable manifest.
Related use cases
Joiner, mover, leaver across every system
One trigger from the HRIS fans out to every identity, productivity, engineering, and security system, including license recovery on exit.
Continuous access review
Monthly scan across every connected app. Orphan accounts, stale admins, over-provisioned licenses. Recovery ticket files itself.
Sixty | second termination revoke
One terminate call. Fourteen systems revoked in parallel. Risk summary per adapter. Symmetric rehire reactivation when the same person comes back.