How to automate IT support tickets safely with AI

1. Pick the right tickets

Good candidates for automation share four traits:

• Frequent. The same problem keeps coming back across users and clients.
• Diagnosable from data. Device telemetry can confirm the cause, not just guess it.
• Low blast radius. If the fix runs when it wasn't needed, nothing bad happens.
• Verifiable. There is a clear check afterwards: the queue is empty, the service is running, the disk has space.

Export a few months of tickets and tag them. You will usually find a short list of repeat problems that accounts for a large share of the volume. Those are your first candidates.

2. Sort fixes into risk tiers

Not every fix deserves the same level of trust. A simple three-tier model works well:

Let each client decide whether the low tier runs automatically for them. Some will want it on from day one; others will want to watch it work for a while first.

3. Use a script library, not free-form code

Large language models are good at writing PowerShell, and they are also capable of writing confident, plausible code that is wrong. The safe pattern is:

• Keep a library of scripts written and tested by people, each with a risk tier and defined parameters.
• Sign or hash each script so it can't be altered after approval.
• Let the AI choose a library script and fill in parameters, which are validated before use (a service name must exist on the device, a printer must be on the approved list).
• Let the AI suggest new scripts too, but route those to a technician for review. Good ones can be tested and added to the library.

4. Limit what the AI sees

The AI needs enough to diagnose, and no more. Ticket text, service states, disk space, recent event log entries and queue status are usually enough for routine problems. File contents, emails and documents almost never are. Keeping the data narrow reduces privacy risk and makes POPIA conversations with clients much simpler.

5. Verify, record, hand back

Every automated run should end with a check that the problem is actually gone, and a record on the ticket that includes:

• what the AI saw and concluded, and how confident it was
• which script ran, with which parameters and its hash
• the output and result
• timestamps and who or what approved it

If the check fails, stop. Assign the ticket to a technician with the full history attached. Do not retry in a loop.

6. Start small

Run your first automations on non-production devices, then on one friendly client, then widen. Track how many tickets were closed automatically, how many were handed back, and whether any were reopened. Those three numbers tell you whether to expand the library or tighten it.

This is the model CitadelGate's planned AI ticket remediation follows.