IT service desk agent

• Staff get answers to how-to questions in the portal or in chat, drawn from your approved knowledge articles, with a link to the source and an easy route to a person.
• Every ticket is categorised, prioritised and routed on arrival, with the user's device and account status already attached: compliance state, pending updates, lock-out status, recent sign-in failures.
• Access requests are matched to your service catalogue and prepared for the approvals your process already needs: the line manager and the system owner. A separate workflow carries out the change only once they've approved.
• Password and MFA resets go down a verified path. The agent explains the self-service route, or hands the person to a trained analyst who checks identity using methods your security team has set. The agent never decides who someone is, and never triggers a reset.
• Analysts get a drafted summary and suggested fix for each ticket they pick up, and the agent spots gaps in the knowledge base from what people ask.
• Ticket text is treated as untrusted. A ticket that tries to instruct the agent can't make it do anything its tools don't allow, because the limits are set by the platform, not the prompt.

• NCSC / IASMECyber Essentials: Requirements for IT Infrastructure v3.3 (Danzell question set, since 27 April 2026)
  →

  MFA must be switched on for every cloud service that offers it, or the assessment fails automatically, and high-risk and critical updates must be installed within 14 days. User accounts must be approved before they're created, admin accounts kept separate, and accounts removed when no longer needed. The agent can tell people their device is overdue an update and route leavers' accounts for removal, but it can't switch off MFA, add an MFA method or create an account. Its own service account is in scope like any other: no admin rights, and MFA or workload identity where the platform supports it.

• NCSCAdvice after the 2025 attacks on UK organisations: review help desk password reset processes
  →

  The NCSC asked organisations to review how the help desk authenticates staff before resetting passwords and MFA, particularly for privileged accounts, to deploy MFA comprehensively and to watch for unusual logins. In this design, identity is checked by a trained person using methods security has chosen, stronger for privileged and senior accounts, never by the agent. The agent never tells a caller anything that would help them pass a check, such as the last digits of a registered phone number.

• NCSCManaging the cyber risk of agentic AI (interim advice, 20 August 2026) and 'Prompt injection is not SQL injection' (8 December 2025)
  →

  The NCSC says prompt injection may never be fully fixed, so design to limit the damage. Give each agent its own identity with only the permissions its task needs, log and monitor what it does, keep a way to stop it at once, and don't rely on the prompt for safety. Here the agent has read-only access to identity and devices, and the only system it writes to is the ITSM tool.

• Government / ETSIAI Cyber Security Code of Practice (DSIT, January 2025) and ETSI EN 304 223 (January 2026)
  →

  A voluntary baseline of 13 principles across secure design, development, deployment, maintenance and end of life, including human oversight, asset tracking and monitoring. Use it as the checklist for the agent itself: threat model, named owner, logged changes to prompts and tools, and a plan for switching it off.

• ICOUK GDPR and the Data Protection Act 2018
  →

  Tickets carry staff personal data and sometimes more: sickness, reasonable adjustments, a home address for a laptop delivery. Do a DPIA before the pilot, keep ticket data in UK regions, set a retention period, make sure no provider trains on it, and keep sensitive categories out of the knowledge index. Decisions about a person's access stay with their manager and the system owner.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• Security owns the identity check: which methods, for which account types, and what's recorded. Analysts are trained on it before go-live, including how attackers use urgency and seniority.
• A named owner for the knowledge base, with review dates on every article. Articles the agent cites most are reviewed first.
• A named owner for the agent's prompts, tools and catalogue mapping, with change control like any other system. Adding a tool needs a security review.
• A weekly sample of agent answers and routing decisions, and of resets, checked against the verification record.
• Prompt injection tests in the regression suite: tickets that try to make the agent grant access, reveal data or close security tickets.
• Phone stays staffed. People who can't or won't use chat get the same service from a person.

1. 2–3 weeks

   Discovery

   Measure today's ticket mix, reassignment rate and time to access. Review the reset and verification process with security. Check knowledge article quality and the ITSM tool's APIs.

2. Gate · must be true to passBaseline agreed, verification process signed off by security, tool list and boundaries approved, DPIA started.

3. 6–8 weeks

   Pilot

   Routing and drafted summaries in shadow mode for all tickets, and self-service answers for one group of staff, such as one site or one directorate.

4. Gate · must be true to passRouting accuracy and answer quality within agreed limits, all prompt injection tests refused by the platform, and the service desk manager signs off.

5. 4–6 weeks

   Production

   Self-service and routing live for everyone, access request preparation for the first catalogue items, with monitoring, support and a rollback plan.

6. Gate · must be true to passSupport model in place, analysts trained, logs feeding security monitoring, and the switch-off tested.

7. Ongoing

   Scale

   More catalogue items, joiners and leavers linked to HR events, and the same pattern for HR and facilities requests.

8. Gate · must be true to passEach new tool or catalogue item passes its own security review and a short shadow period.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The agent is given a help desk admin role 'to keep the pilot simple', and a ticket talks it into a reset.

   How the design avoids it

   Read-only tools for the agent, a separate fulfilment workflow that checks approvals, and a test suite of hostile tickets run before go-live.

2. 2

   Goes wrong

   The agent helpfully tells a caller which phone number is registered, and the attacker uses it.

   How the design avoids it

   Lookups return only what the agent needs to route. It never reads account details back to the requester.

3. 3

   Goes wrong

   Out-of-date knowledge articles give confident wrong answers.

   How the design avoids it

   Review dates on every article, the most-cited reviewed first, and answers that always link the source.

4. 4

   Goes wrong

   Self-service saves time for analysts, but people who phone get a worse service.

   How the design avoids it

   Phone stays staffed, and satisfaction is reported by channel.

5. 5

   Goes wrong

   Access requests flow faster, so access piles up and nobody removes it.

   How the design avoids it

   Leavers and movers linked to HR events, and a regular access review by system owners.

1. Formal guidance expected
   The NCSC says its interim advice on managing the cyber risk of agentic AI (August 2026) will be replaced by formal guidance.

   Build to the interim advice now: the agent's own identity, least privilege, logging and a tested way to stop it. These are unlikely to change.

2. 2026–2027
   The ICO's code of practice on AI and automated decision-making, required by regulations in force since May 2026.

   Keep the record of who approved each access change, and why, so it's clear a person made the decision.

3. Late 2026–2028
   The Cyber Security and Resilience Bill is going through Parliament. It brings medium and large managed service providers into regulation, with duties set by secondary legislation by about 2028.

   If any part of your service desk or end-user support is outsourced, check how the provider's new duties will apply, and align its incident reporting and verification process with yours.

4. 2028
   The NCSC's post-quantum cryptography milestone: a full migration plan by 2028.

   Record the cryptography used by the identity provider, the fulfilment worker and the private links, and keep it easy to change.