# Ticket Triage Assistant

Agent blueprint, validated with 6 team members · Task: Triage and route incoming tickets · IT Service Desk · readiness 84/100 · Standardize first

Reads each new ServiceNow ticket in the unassigned queue and proposes a category, priority and assignment group using the team's rules. An analyst approves the proposal in one step before the agent writes it to the ticket. P1, security and VIP tickets are flagged for the analyst.

**Trigger:** A new ticket appears in the ServiceNow unassigned queue, from email or the portal.

**Inputs:** Ticket short description and full description; Requester details (name, department, location, VIP status once defined); Impact and urgency values, if present on the ticket; Category-to-group mapping: Access to Service Desk, Software to App Support, Hardware to Desktop Support, Network to Netw; Impact/urgency priority matrix (thresholds still to be supplied); List of VIP requesters and the senior desk group (still to be supplied); Security-incident indicators (still to be supplied)

**Done when:** Category, priority and assignment group are all set and the ticket has left the unassigned queue.

## Steps

1. Detect new ticket in the unassigned queue (ServiceNow, api): Poll or use a business-rule trigger on new incidents with no assignment group.
2. Read description, requester details and any existing impact/urgency (ServiceNow, api)
3. Propose category from the requester's description (ServiceNow, ai): Choose among Access, Software, Hardware and Network. Give a confidence score and flag multi-issue or unclear tickets.
4. Propose priority from impact, urgency and whether it is an outage (ServiceNow, ai): Apply the impact/urgency matrix. Outages are P1.
5. Flag security incident and VIP requester (ServiceNow, ai): Security goes to the security team and VIP to the senior desk, overriding the category mapping. Detection rules are still open.
6. Derive assignment group from category, then apply security and VIP overrides (ServiceNow, ai): Fixed mapping, not model judgment, except for the override flags.
7. If information is missing, draft a request-for-information email (Outlook, ai): Only for tickets the agent cannot classify confidently.
8. Approve the drafted email before it is sent (Outlook, person): Policy: no unattended messages to people.
9. Send the approved email to the requester (Outlook, connector)
10. Review the proposed category, priority and group; approve, edit or reject (ServiceNow, person): One-step approval. The analyst sees the reasoning and any P1, security or VIP flag.
11. Write approved category, priority and assignment group to the ticket (ServiceNow, api): Runs only after approval. The ticket leaves the unassigned queue.
12. Phone the on-call engineer for P1 tickets (ServiceNow, person): Assigning is not enough for P1. The agent cannot phone, so the analyst does.

## Approvals

- Analyst approves the proposed category, priority and assignment group before anything is written to ServiceNow.
- Analyst approves any email to a requester before it is sent.
- Analyst personally handles the P1 phone call to the on-call engineer.

## Prerequisites

- ServiceNow service account with API rights to read incidents and update category, priority and assignment group
- Copilot Studio and Power Automate licenses, with the ServiceNow API and Outlook connector available
- Written routing guide covering the priority matrix, VIP list, security criteria and Software/Network cues (readiness verdict is 'standardize')
- Sample of historical tickets with final category, priority and group, to test accuracy
- Shared mailbox or sender identity for requester emails
- Defined on-call contact process for P1

## Risks

- Misclassification sends tickets to the wrong group. The approval step and confidence thresholds reduce this, but analysts may approve without reading.
- Priority thresholds are undefined, so priority proposals may be inconsistent until the matrix is written down.
- The VIP and security rules are unclear, and these tickets carry the highest cost if misrouted.
- The required approval step limits time saved (estimated 35–55%).
- The cause of the 7% pauses and the rework is not understood. The agent may not remove them if they come from outside the ticket data.

## Measure after launch

- Median handling time per ticket (baseline 3.1 min; 318 cases and 19.9 team hours per week)
- Share of tickets with a re-edited field, mainly assignment group (baseline 10.7%)
- Share of cases that pause or redo steps (baseline 6.9% waiting, median 1.1 h; 6.6% redone after a pause)
- Share of proposals approved unchanged by the analyst (new; no baseline)

## Decisions

| Decide | Rule | Source |
| --- | --- | --- |
| Category | Choose from what the requester describes: login problems are Access, laptop problems are Hardware. Software and Network follow the same description-based approach, but the team gave no examples for them. | team |
| Priority | Use the impact and urgency matrix; outages are P1 (Critical). In practice about 60% of tickets are Moderate, about 29% Low and about 10% High. Thresholds for each level are not known yet: ask the team. | team |
| Assignment group | Follow the category: Access to Service Desk, Software to App Support, Hardware to Desktop Support, Network to Network Ops. Observed data agrees at 89–98% per category. | team + data |
| VIP override | VIP tickets go to the senior desk. The team does not apply this consistently in its answers, and how a VIP is identified is not known yet: ask the team. | team |
| Security incident | Skip the unassigned queue and go straight to the security team. How to recognize one is not known yet: ask the team. | team |
| P1 escalation | In addition to assignment, phone the on-call engineer. | team |
| When to ask the requester for more information | Not known yet: ask the team. Everyone says 'missing information' without saying which information. | unknown |

## Still to answer before building

- What specific information is missing from tickets, and how is it requested from the requester today?
- What approval is being waited on after assignment, and who gives it?
- How is a VIP identified (list, title, ServiceNow field), and what exactly is the senior desk?
- What impact and urgency thresholds define each priority level, other than outages being P1?
- How are Software and Network tickets recognized from the description?
- Which tickets that don't match the category-to-group mapping (about 6–11%) are explained by VIP or security handling, and which by other causes?
- How is a security incident recognized, and who owns the security queue?
- Can ServiceNow notify the on-call engineer automatically, or must a person always phone?

## Exceptions

- When Security incident (rare: about half of respondents say almost never): Flag it for the analyst with a proposal to send it straight to the security team. Apply only after approval.
- When VIP requester (frequency not stated): Propose the senior desk instead of the category group. Apply only after approval.
- When P1 priority (High is about 10% of tickets; P1 share not stated): Flag as P1 and remind the analyst to phone the on-call engineer after the assignment is applied.
- When Missing information in the ticket, which the team blames for rework (about 11% re-edit fields, about 7% redo steps after a pause): Draft a request-for-information email and hold the ticket for analyst approval. If confidence is low, put it in the analyst queue with what was found.
- When Ticket pauses after assignment or after a Quick Assist session (about 7% of cases, median 1.1 h; cause unclear): Do nothing automatically. Show the ticket in a 'paused' view for the analyst and log whether the group was changed afterwards.
- When Ambiguous or multi-issue ticket, or low model confidence: Do not propose a group. Route to the analyst queue with the candidate categories and the reasons.

## Build with

- Copilot Studio: Classification and priority proposal, confidence score, drafting the request-for-information email
- Power Automate: Queue trigger, routing rules and overrides, approval flow, ServiceNow updates, Outlook send
- ServiceNow: Source of tickets, home of the approval task, and target of the field updates
- Outlook: Emails to requesters after approval

## Effort and return

- Size M, about 3-5 weeks (Copilot Studio, Power Automate, ServiceNow API and business rules, Prompt design and testing against historical tickets)
- Team time on this task now: 20 h/week; expected back: 3-9 h/week

## Evidence

- too many different paths for an agent to follow reliably; the training guide comes first
- 87% of cases follow the same steps
- 20 team hours a week
- 17% of cases redo steps