The problem
One person handles IT for the firm, and the same questions reach them every week: VPN, passwords, a locked account, a new laptop, access to a shared folder. The answers are written down, but nobody can find them, so people ask that person instead.
What goes wrong
- The runbook is stale. The agent is exactly as right as the document it reads, so when the VPN changed in March and the doc did not, it walks people through the old client.
- The agent grants access. An agent with admin rights that resets passwords and adds people to groups on request has no approval step, and sooner or later someone talks it into adding them to the finance folder.
- It dead-ends. It says it does not know and stops there. Nobody else sees the question, and the person waits for an answer that is not coming.
The approach
- Load the agent with the runbooks and pinned notes you already have, in the Slack or Teams channel your team already uses for IT.
- Keep it read-only on systems. It answers and it drafts access requests; a named person approves and grants.
- Write the escalation rules with your IT lead: what counts as an incident, which severity it gets, who is on call, and how they are reached.
- Log every question it could not answer, and treat that list as the runbooks still to write.
When it works
When the firm has runbooks, or will write them, and one person who owns access and incidents. The agent takes the first question so that person can take the hard ones.
Why the helpdesk is the place to start
Every professional services firm has the same Monday. A partner cannot get into the VPN from a client site. A new associate's laptop needs the practice software. Someone replaced their phone the night before a filing and lost the authenticator app. These land on whoever handles IT, often one person, usually at the worst time, and most of them have been answered before.
The answers exist. They live in a runbook someone wrote two years ago, a pinned Slack message, a Google Doc called Onboarding Checklist v3. Nobody can find them at 7:40 on a Monday, so they ask the person, who answers the same questions all week and never gets to the work only they can do.
What the agent does
Answer from the runbook
"VPN says authentication failed." The agent finds the VPN runbook, gives the steps in order, and names the document and section so the person can check it. If the answer is not in any runbook, it says so and names who to ask.
Draft the request, not grant it
Access is the line it does not cross. When someone needs a shared mailbox, a folder, or a seat in a system, the agent collects who, which system, what for, and how long, and posts a ready-to-approve request to the person who owns access. That is an approval gate: the agent proposes, a named person decides.
Escalate with a severity
Some messages are not questions. "The document server is down for everyone" is an incident. The agent matches it to the incident rules your runbook defines, tags the severity, and mentions the person on call in the thread. It does not try to fix a server.
How we build it
First, we gather the runbooks you have in Drive, Docs, and pinned messages, and agree which folders the agent can read. It answers only from what your team shares with it. We write the escalation rules with your IT lead: what counts as an incident, who is on call, how they get reached.
Next, the runbooks go in. We test on real questions from the last month of your IT channel and fix every answer your IT lead would not have given. Then a few named people use it before it answers in the channel. After that every runbook has an owner, and we run it monthly: check the runbooks the agent cited most for stale steps, review answers people flagged as wrong, and send you the gap list.
When it does not work
It does not replace the person who handles IT. And it does not work if nobody writes the runbooks the gap list asks for. The agent gets better because someone fills the gaps.
Where to start
If Tier-1 IT is the first thing to fix, start with the Knowledge Agent. For an insurer, insurance covers submissions, claims intake and first notice of loss (FNOL). If you are not sure the helpdesk is the first thing, ask Roo, Webaroo's AI: Could an AI agent answer our IT questions from our runbooks?
Book 15 minutes with Connor