AI Service Desk: triage, SLA clock and breach alerts
A working prototype I built to show where AI helps a service desk and where it must not decide alone. It triages a request, sets the priority, starts the SLA clock, answers from a knowledge base and pages the Major Incident Manager on a P1. It runs entirely on my own laptop: no cloud service and no ticket data leaving the machine.
Watch one P1 run
A real run on the laptop, recorded without edits except one: the model’s 80-second wait plays 16 times faster. Press play to watch the triage, the knowledge-base answer and the P1 ticket card appear.
What happens to one message
Read the message
The user writes in plain language. Nothing to fill in, no category to pick.
Suggest impact and urgency
The language model proposes a category (incident, service request or question), an impact and an urgency. That is all it decides.
Apply the rules in code
Fixed code applies the priority matrix (P1 to P4), picks the assignment group and starts the SLA clock on business hours, or 24x7 for a P1.
Answer from the knowledge base
The reply is written from the service desk articles, with the sources cited, and a ticket card shows the first response and resolution due times.
Escalate a P1
A P1 is assigned to the Major Incident Manager on a 24x7 clock, and the major incident process is triggered straight away.
The design rule: AI suggests, rules decide
The model only ever proposes impact and urgency. The priority, the SLA targets and the due times come from deterministic code, so every number on the ticket can be checked and explained to an auditor or a customer. If the model gets it wrong, the analyst corrects one field and the clock recalculates.
The ticket card
Every reply ends with the ticket it logged: category, priority with the impact and urgency behind it, the assignment group and both SLA due times.
SLA Breach Checker
A second workflow takes a list of open tickets and a check time, and returns which are breached and which are at risk (75% of the resolution target used), then drafts the alert email to the Service Desk Manager with a next action for each. On the six sample tickets it finds two breached and two at risk.
How it is built
- Dify for the workflows and the knowledge base
- A small open model (Llama 3.2) running locally on Ollama
- The priority matrix and SLA clock written as plain Python, separate from the model
- Knowledge base: service desk how-to articles plus my own ITIL (Version 5) and major incident material
- Replies take one to two minutes on a laptop processor; a server would answer in seconds
This is a demonstration, not a hosted service. The sample organisation, tickets and articles are illustrative.
Want to see it live?
I run it on a call and walk through how the same pattern would fit your service desk, your categories and your SLAs.