Status: AI remediation is built and deployed on our platform, and is now being tested. No client devices are connected yet: pilot partners will test it on non-production devices before any client rollout.
Five steps, every one recorded
Read
The AI reads the ticket text and the approved telemetry from the affected device. It is told which client and device it is working on, and every lookup is checked against that client.
Explain
It writes a plain-language diagnosis on the ticket: what it found, how confident it is, and what it would check next.
Propose
It proposes a fix with its target device, expected effect, risk level and rollback, chosen from the signed script library wherever one fits.
Decide
A low-risk library fix runs on its own when the client's policy allows it. Anything else, including any PowerShell the AI wrote itself, waits for technician approval.
Verify
After the run, the problem is checked again. Success updates the ticket. Failure hands the ticket to a technician with the full history.
What can run on its own, and what can't
Low-risk library fixes
- Restart a stopped Windows service
- Clear a stuck print queue and restart the spooler
- Reinstall an approved printer driver, keeping the old one for rollback
- Flush the DNS cache and renew the IP lease
- Clear temporary files when disk space is low
Examples from the planned library. Each one must be tested, signed and labelled low risk, and switched on by the client.
Everything else
- Any PowerShell the AI wrote itself
- Installing or removing software
- Changes to users, groups or permissions
- Registry, firewall or security-setting changes
- Anything run on more than one device at once
The AI still does the legwork: diagnosis, proposed script and rollback, ready for a technician to approve with one click.
Safety is designed in, not bolted on
An RMM that runs PowerShell is a powerful tool, and attackers target RMM tools for the same reason. These rules hold for every automated run.
Full security model- Signed and unchanged. A script is integrity-checked and can't be edited once it is queued.
- Bound to one client and target. The ticket, device and script must all belong to the same client.
- Time-limited and cancellable. Every job has an expiry and can be stopped.
- One device at a time. Automatic fixes target the device on the ticket only, never a whole fleet.
- Fully audited. Ticket, AI reasoning, script hash, parameters, output, result and timestamps are kept.
- Maintenance windows. Disruptive fixes can be held until a time the client chooses.