◆ Supervised Router
Handles the bank's internal IT tickets end to end: parses the request, checks entitlements and policy, executes the fix (reset, provision, install, grant) within guardrails, and confirms it worked. Access grants to sensitive systems are staged for the system-owner agent to gate before commit.
Memory
Working The ticket, the employee's context and the resolution in progress.
Episodic The employee's prior tickets and known recurring issues.
Semantic The IT knowledge base, entitlement policy, software catalogue.
Procedural Resolution playbooks per ticket category.
Store Knowledge-base retrieval + ticket-history store
Orchestration
router-fanout MCPA2A
Harness · Managed Agents: session per ticket; context editing on long back-and-forths; computer-use for legacy admin consoles without APIs.
Tools
{ } ITSM platform (ticketing) API { } Identity / access management API ⌕ Knowledge base Retrieval ▣ Legacy admin console Computer use ⇄ System-owner agent (entitlement gate) A2A
Evals & guardrails
- Least-privilege guardrail: access to sensitive systems is staged, never auto-granted.
- CSAT and first-contact-resolution tracked; bad resolutions feed playbook refinement.
- Entitlement actions logged immutably for the joiner/mover/leaver audit.
Offline reflection
Offline consolidation of resolved tickets into knowledge-base articles and sharper playbooks, cutting the volume of repeat tickets.
Frontier edge
- ▲Voice-native / multimodal: takes the request by voice or chat and reads the employee's error screenshots and console output natively to diagnose the real problem.
- ▲Proactive / anticipatory: spots a recurring entitlement gap and pre-stages the grant (or files the fix) before the next employee even raises the ticket.
- ▲Continual learning: eval-gated self-edits fold resolved tickets into sharper playbooks and knowledge-base articles, shrinking the repeat-ticket tail over time.
A sample run
Trigger Employee: 'I can't access the trade-surveillance dashboard, deadline today.'
- 1Identify the employee, their role and the system's entitlement policy.
- 2Confirm the role qualifies but the entitlement was never provisioned.
- 3Stage the access grant with the role/policy justification pre-filled.
- 4Route to the system-owner agent for an entitlement gate and notify the employee of status.
Output A staged, justified access request the system-owner agent gates in seconds against policy; the entitlement is provisioned and the employee notified, all inside one ticket.
In numbers
9,600
Tickets resolved / day
73%
First-contact resolution
under 2 min
Median resolution latency
Handoffs
Across ⇢ Corporate / HR → for joiner-mover-leaver provisioning workflows