# IT Helpdesk Resolution Agent

> An IT helpdesk agent that resolves common tickets from your runbooks, verifies identity for sensitive actions, and escalates security incidents and privileged access.

- **Category:** ITSM / Helpdesk
- **Difficulty:** Advanced
- **Setup time:** 45 min
- **Stacks:** Claude, LangGraph, OpenAI
- **Version:** 2.0.0 (updated 2026-06-21)
- **Source:** https://agent-kits.com/kit/it-helpdesk-resolver

## Overview

Resolves routine IT tickets by guiding users through documented runbook steps.

Verifies identity before any sensitive action like an account or password change.

Escalates security incidents, privileged-access requests, and anything without a runbook.

Defensive: never runs risky/destructive actions without approval and never invents a fix.

## When to use it

- You want L1 tickets (password, how-to, common errors) handled from runbooks.
- You have documented procedures the agent can follow safely.
- You want identity verified before sensitive actions and risky ones escalated.
- You want consistent, policy-bound support with security escalation built in.

## When not to use it

- You want it to perform privileged or destructive actions autonomously — it won't.
- You have no runbooks or knowledge base for it to follow.
- You can't provide escalation paths for security and complex issues.
- Your tickets are mostly novel incidents needing a human from the start.

## Architecture

- **Ticket intake** — Receives the ticket and identifies the issue type to route it correctly.
- **Runbook matcher** — Finds a documented, safe procedure for the issue, or determines there isn't one.
- **Identity verification** — Confirms the user's identity before any account, password, or access action.
- **Safety & privilege gate** — Blocks destructive actions and privileged-access grants, routing them to approval and change control.
- **Guided resolution** — Walks the user through the runbook steps or performs the safe, in-scope action.
- **Security escalation** — Detects security signals and escalates immediately, preserving information rather than improvising a fix.
- **Audit & handoff** — Logs actions and escalations and hands complex or undocumented tickets to a human with context.

## Files in this bundle

- `system-prompt.md` — the agent's system prompt
- `tools.json` — tool/function definitions the agent expects
- `workflow.md` — step-by-step run loop
- `.env.example` — environment variables to fill in
- `kit.json` — full structured metadata
- `starters/` — minimal starter snippets
- `LICENSE` — Apache-2.0 (code, configuration, and schema)
- `LICENSE-CONTENT` — CC BY 4.0 (specification text and documentation)
- `NOTICE` — attribution and trademark notice
- `run.py` — **runnable demo**: real agent loop with mock tools (`pip install anthropic`, set `ANTHROPIC_API_KEY`, `python run.py`)
- `agentaz.json` / `agentaz.schema.json` — AgentAz™ governance spec + schema

## Implementation notes

- Resolve only from documented runbooks and escalate the undocumented; an invented command or step can take down a system, so 'I don't have a procedure for that' must route to a human.
- Hard-block privileged-access grants and destructive/production actions behind approval and change control, even for verified users.
- Verify identity before any account, password, or access action; an unverified sensitive action is an account-takeover risk.
- Treat security signals (phishing, malware, compromise) as incidents to escalate immediately, preserving evidence rather than attempting a casual fix.
- Keep a full audit log of actions and escalations for accountability and compliance.
- Give clear interim guidance to users during escalations so they don't make a situation worse.
- The strong model earns its cost on ambiguous issues and security triage, while a cheaper model can handle clear runbook tickets.

## Variations

- **Basic — Runbook assistant:** Guides users through documented fixes for common tickets and escalates the rest. Read/guide only.
- **Advanced — Safe L1 resolver:** Adds identity verification, safe in-scope actions, privileged/destructive guards, security escalation, and audit logging.
- **Enterprise — Service-desk automation:** Adds ITSM integration, change-control workflows, approval routing, security incident handoff, and analytics across the ticket queue.

## FAQ

**Will it perform admin actions or delete things?**

No. It never grants privileged/admin access or runs destructive or production-changing actions on its own. Those are routed to approval and change control, even when the user is verified.

**How does it avoid breaking things?**

It only follows documented, safe runbook procedures. If there's no runbook or the situation is novel, it escalates to a human rather than inventing a command or step that could cause damage.

**Does it check who it's helping?**

Yes. For anything touching accounts, passwords, or access, it verifies the user's identity per your policy first. No verification means no sensitive action.

**What happens with a security issue?**

Signals like phishing, malware, or a suspected compromise are escalated to your security team immediately, with evidence preserved and safe interim guidance to the user — not handled as a routine fix.

**Is there an audit trail?**

Yes. It logs the actions it takes and every escalation, so support activity is traceable for accountability and compliance.

**What can it actually resolve on its own?**

Routine, documented L1 issues — password resets (after verification), common how-tos, known errors, and in-policy requests — while routing anything risky, privileged, or undocumented to the right human.


---

© 2026 AgentKits · www.agent-kits.com

**Open source.** Code, configuration, and the AgentAz™ schema are licensed under
**Apache-2.0**; specification text and documentation under **CC BY 4.0** (with
attribution to AgentKits, link to https://www.agent-kits.com). See LICENSE, LICENSE-CONTENT,
and NOTICE in this bundle. "AgentAz" and "AgentKits" are trademarks of AgentKits.

**Flagship reference blueprint.** View the source, AgentAz™ spec, and frozen v1.0 schema
in the public registry: https://github.com/agent-kits/agentaz
Original: https://agent-kits.com/kit/it-helpdesk-resolver
