TASK-OPS-105-01 · Task family
Service desk triage & major incident detection. Link related tickets, find the shared cause and set priority from impact and urgency.
Overview. Raise one incident for the shared cause, with evidence and the right priority, and link every related ticket.
Tickets arrive one by one, each describing the same problem differently. Handled individually, they get password resets and cache-clearing advice that can't help.
The agent has to recognise the pattern, find the shared cause, raise a single incident with the right priority and link the tickets to it.
Value to the buyer
Recognising one cause behind many tickets is what separates a service desk from a ticket queue.
Specification. The task family, field by field.
- task_id:
- TASK-OPS-105-01
- domain:
- IT Operations & Service Management
- parent_environment:
- ENV-OPS-105 · ITServiceOps
- target_role:
- IT Service Desk Analyst
- objective:
- Raise one incident for the shared cause, with evidence and the right priority, and link every related ticket.
- starting_context:
- A queue of new tickets, the identity provider's sign-in logs and change history, the knowledge base and the priority matrix.
- tools:
get_ticketsearch_ticketssearch_knowledge_basecheck_identity_providerget_change_historyupdate_ticket
- required_actions:
- Group the tickets that share a symptom
- Check sign-in logs and recent identity changes
- Raise an incident with the cause and priority
- Link the tickets and tell users what's happening
- expected_outputs:
- Incident record with cause, evidence and priority
- Linked tickets
- A status message to affected users
- interaction:
- Single agent with tool access. Simulated employees reply to tickets.
- verification:
- The cause, linked tickets and priority are compared with the seeded scenario.
- reward:
- Credit for the cause, every linked ticket and the correct priority. Resetting passwords for an identity-provider fault costs credit.
- difficulty:
- Calibrated against reference models during acceptance testing
- task_horizon:
- Multi-step investigation over a ticket queue. Execution limits are agreed with the buyer.
- delivery:
- Task instances with seeded ticket queues, reference incidents and verifier code.
- commercial_unit:
- Per validated task instance
Sample prompt. What the agent is asked to do, as a buyer would see it.
Since 08:10, tickets have been arriving from staff who can't sign in to the expense app: "login loop", "SSO error", "password not working". Other apps work. The identity team rotated the SAML signing certificate at 08:00. It's the last week of the month, when expenses are due, but staff can still submit them on paper. Triage the queue.
Verification criteria. What the verifier checks, and how.
Shared cause
The expense app still trusts the old SAML signing certificate rotated at 08:00.
Evidence
Sign-in logs show signature validation failures for the expense app only.
Priority
High impact (everyone who uses the app) and medium urgency (a paper workaround exists): P2.
Tickets linked
Every related ticket is linked to the incident, whatever the user called the problem.
No wrong fixes
No password resets or cache-clearing instructions are sent.
Key failure modes. Where agents go wrong on this task.
- Resetting passwords ticket by ticket
- Setting P1 because many tickets arrived at once
- Missing tickets that describe the problem in different words
Other task families. The rest of ITServiceOps, on the same EnterpriseWorld state.
- TASK-OPS-105-02
Device & SaaS incident recovery
Restore service through an authorized, staged change and verify it on the affected devices.
Systems Administrator
- TASK-OPS-105-03
Access request handling
Correct identity, authorization and least-privilege entitlements.
IT Service Desk Analyst
- TASK-OPS-105-04
Change & escalation management
Required change approvals, safe execution and correct incident updates.
Change Manager