IT Service Desk · Agent blueprint · validated with 6 team members

Ticket Triage Assistant

Reads each new ServiceNow ticket in the unassigned queue and proposes a category, priority and assignment group using the team's rules. An analyst approves the proposal in one step before the agent writes it to the ticket. P1, security and VIP tickets are flagged for the analyst.

84readiness · Standardize first

3–9 hback per week, of 20 h now

$10K–25Ka year

3–5 wkto build · size M

Build this after the team follows one procedure (see the training guide). Today too many cases take different paths for an agent to follow reliably.

Trigger

A new ticket appears in the ServiceNow unassigned queue, from email or the portal.

Done when: Category, priority and assignment group are all set and the ticket has left the unassigned queue.

Needs: Ticket short description and full description; Requester details (name, department, location, VIP status once defined); Impact and urgency values, if present on the ticket; Category-to-group mapping: Access to Service Desk, Software to App Support, Hardware to Desktop Support, Network to Netw; Impact/urgency priority matrix (thresholds still to be supplied); List of VIP requesters and the senior desk group (still to be supplied); Security-incident indicators (still to be supplied)

What the agent does

1
Detect new ticket in the unassigned queue · ServiceNowapi
Poll or use a business-rule trigger on new incidents with no assignment group.
2
Read description, requester details and any existing impact/urgency · ServiceNowapi
3
Propose category from the requester's description · ServiceNowai
Choose among Access, Software, Hardware and Network. Give a confidence score and flag multi-issue or unclear tickets.
4
Propose priority from impact, urgency and whether it is an outage · ServiceNowai
Apply the impact/urgency matrix. Outages are P1.
5
Flag security incident and VIP requester · ServiceNowai
Security goes to the security team and VIP to the senior desk, overriding the category mapping. Detection rules are still open.
6
Derive assignment group from category, then apply security and VIP overrides · ServiceNowai
Fixed mapping, not model judgment, except for the override flags.
7
If information is missing, draft a request-for-information email · Outlookai
Only for tickets the agent cannot classify confidently.
8
Approve the drafted email before it is sent · Outlookperson
Policy: no unattended messages to people.
9
Send the approved email to the requester · Outlookconnector
10
Review the proposed category, priority and group; approve, edit or reject · ServiceNowperson
One-step approval. The analyst sees the reasoning and any P1, security or VIP flag.
11
Write approved category, priority and assignment group to the ticket · ServiceNowapi
Runs only after approval. The ticket leaves the unassigned queue.
12
Phone the on-call engineer for P1 tickets · ServiceNowperson
Assigning is not enough for P1. The agent cannot phone, so the analyst does.

Decisions the agent makes

Decide	Rule	Source
Category	Choose from what the requester describes: login problems are Access, laptop problems are Hardware. Software and Network follow the same description-based approach, but the team gave no examples for them.	The team
Priority	Use the impact and urgency matrix; outages are P1 (Critical). In practice about 60% of tickets are Moderate, about 29% Low and about 10% High. Thresholds for each level are not known yet: ask the team.	The team
Assignment group	Follow the category: Access to Service Desk, Software to App Support, Hardware to Desktop Support, Network to Network Ops. Observed data agrees at 89–98% per category.	Team, confirmed by data
VIP override	VIP tickets go to the senior desk. The team does not apply this consistently in its answers, and how a VIP is identified is not known yet: ask the team.	The team
Security incident	Skip the unassigned queue and go straight to the security team. How to recognize one is not known yet: ask the team.	The team
P1 escalation	In addition to assignment, phone the on-call engineer.	The team
When to ask the requester for more information	Not known yet: ask the team. Everyone says 'missing information' without saying which information.	Not known yet

Where a person signs off

Analyst approves the proposed category, priority and assignment group before anything is written to ServiceNow.
Analyst approves any email to a requester before it is sent.
Analyst personally handles the P1 phone call to the on-call engineer.

Exceptions

When	What the agent does
Security incident (rare: about half of respondents say almost never)	Flag it for the analyst with a proposal to send it straight to the security team. Apply only after approval.
VIP requester (frequency not stated)	Propose the senior desk instead of the category group. Apply only after approval.
P1 priority (High is about 10% of tickets; P1 share not stated)	Flag as P1 and remind the analyst to phone the on-call engineer after the assignment is applied.
Missing information in the ticket, which the team blames for rework (about 11% re-edit fields, about 7% redo steps after a pause)	Draft a request-for-information email and hold the ticket for analyst approval. If confidence is low, put it in the analyst queue with what was found.
Ticket pauses after assignment or after a Quick Assist session (about 7% of cases, median 1.1 h; cause unclear)	Do nothing automatically. Show the ticket in a 'paused' view for the analyst and log whether the group was changed afterwards.
Ambiguous or multi-issue ticket, or low model confidence	Do not propose a group. Route to the analyst queue with the candidate categories and the reasons.

Build with

Copilot Studio: Classification and priority proposal, confidence score, drafting the request-for-information email
Power Automate: Queue trigger, routing rules and overrides, approval flow, ServiceNow updates, Outlook send
ServiceNow: Source of tickets, home of the approval task, and target of the field updates
Outlook: Emails to requesters after approval

Skills: Copilot Studio, Power Automate, ServiceNow API and business rules, Prompt design and testing against historical tickets

Before building

ServiceNow service account with API rights to read incidents and update category, priority and assignment group
Copilot Studio and Power Automate licenses, with the ServiceNow API and Outlook connector available
Written routing guide covering the priority matrix, VIP list, security criteria and Software/Network cues (readiness verdict is 'standardize')
Sample of historical tickets with final category, priority and group, to test accuracy
Shared mailbox or sender identity for requester emails
Defined on-call contact process for P1

Risks

Misclassification sends tickets to the wrong group. The approval step and confidence thresholds reduce this, but analysts may approve without reading.
Priority thresholds are undefined, so priority proposals may be inconsistent until the matrix is written down.
The VIP and security rules are unclear, and these tickets carry the highest cost if misrouted.
The required approval step limits time saved (estimated 35–55%).
The cause of the 7% pauses and the rework is not understood. The agent may not remove them if they come from outside the ticket data.

How we'll know it worked

Median handling time per ticket (baseline 3.1 min; 318 cases and 19.9 team hours per week)
Share of tickets with a re-edited field, mainly assignment group (baseline 10.7%)
Share of cases that pause or redo steps (baseline 6.9% waiting, median 1.1 h; 6.6% redone after a pause)
Share of proposals approved unchanged by the analyst (new; no baseline)

Still to answer before building

What specific information is missing from tickets, and how is it requested from the requester today?
What approval is being waited on after assignment, and who gives it?
How is a VIP identified (list, title, ServiceNow field), and what exactly is the senior desk?
What impact and urgency thresholds define each priority level, other than outages being P1?
How are Software and Network tickets recognized from the description?
Which tickets that don't match the category-to-group mapping (about 6–11%) are explained by VIP or security handling, and which by other causes?
How is a security incident recognized, and who owns the security queue?
Can ServiceNow notify the on-call engineer automatically, or must a person always phone?

Where the team disagrees

Settle these first: an agent needs one rule, and new hires get mixed answers today.

Assignment group: some say it simply follows the category, others add that VIP tickets go to the senior desk. These are probably compatible but the VIP rule is not applied consistently in the answers.

Evidence

too many different paths for an agent to follow reliably; the training guide comes first
87% of cases follow the same steps
20 team hours a week
17% of cases redo steps

Observed main path (87% of cases): Incident (ServiceNow) → Edit Category → Edit Priority → Edit Assignment group

Handover spec for the builder (text) →

Designed by AI from how the team did this work (2026-10-19 to 2026-10-23), the company's tools and its rules. A starting point for the builder: confirm system access and approvals before building.