IT administrators new to a service desk where agents reset passwords and draft access grants should learn the access model before the tools. Week one covers role-to-group mappings, the agent's bounds and the privileged access it must refuse. Week two brings live access requests and joiner, mover and leaver changes, each checked by a senior administrator.
What does the service desk agent do?
In an IT team that runs agents, the agent typically resets passwords and releases locked accounts after identity checks (depth 3), drafts access grants from the role-to-group mapping for a person to approve (depth 2), prepares joiner, mover and leaver changes, and answers routine how-to questions. It must refuse privileged access requests, hand over anything outside its bounds, and hold resets where the identity check is weak.
The new administrator works the held items: access approvals, mover and leaver changes, exceptions, and the agent's refusals that someone disputes. How the day changes is set out in what changes in an IT administrator's day when AI agents arrive. The IT operations lead owns onboarding; a certified senior administrator coaches.
How are the two weeks laid out?
- Day 1. Person (IT operations lead): explains the access model: roles, groups, the mapping between them, and who owns the mapping in the identity system.
- Day 1 to 2. Person (new administrator): learns the agent's bounds: which resets it does alone, which identity checks it uses, which groups it may propose, which it must refuse.
- Day 2 to 3. Agent, depth 2: drafts access grants, which the coach approves or amends aloud while the new administrator follows.
- Day 4 to 5. Person (new administrator): practises in a sandbox workspace on past requests, including a mover who should lose old access and a request for a privileged group dressed up as routine.
- Week 2. Person (new administrator): approves live drafts, each checked by the coach before it takes effect.
- Week 2. Person (new administrator): records reasons on every amendment: wrong mapping, stale mapping, bound too wide, weak identity check, or one-off.
- End of week 2. Person (IT operations lead): signs off approval of standard access. Privileged access remains with named senior staff.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Password reset | Resets after identity checks | 3 | Weak checks, high-value accounts |
| Access grant | Drafts from mapping | 2 | Approval |
| Joiner, mover, leaver | Prepares changes | 2 | Approval, especially leavers |
| Privileged access | Refuses | none | Named senior staff |
| How-to questions | Answers routine ones | 3 | Anything unusual |
Which mistakes must a new administrator catch?
Movers keeping old access. The agent may treat a mover as a joiner and add new groups without removing old ones. Over time this gives people access they no longer need. The new administrator should check every mover change for removals.
Inherited project groups. Copying a predecessor's groups carries temporary project access to a new starter.
Leavers left active. A leaver change that is delayed leaves a live account. Leavers should be processed on time, every time.
Privileged requests in disguise. A request for "finance reporting access" may include a group with administration rights. The agent should refuse privileged groups; the administrator should know which groups those are.
Weak identity checks on resets. The agent resets passwords at depth 3 only after checks the business has set. If a caller passes on details anyone could find, such as a name and a manager's name, the reset should have been held. A new administrator who reviews held resets should know what a strong check looks like and should never complete a reset the agent held simply because the caller is in a hurry. Social engineering of service desks relies on exactly that pressure.
How do corrections reach the agent?
With reasons. Most IT corrections are mapping or bound problems: the mapping is out of date, or the bound allows a group it should not. A clear reason lets the agent owner fix the mapping source or tighten the bound, so every future request improves. Any change to the agent's brief or bounds should carry a change record, like any other identity configuration change.
Which controls and evidence should onboarding leave?
- Sandbox cases including privilege and movers. Evidence: results recorded.
- Checked approvals in week two. Evidence: both administrators named on each.
- Reasons on every amendment. Evidence: reason codes by person.
- Privileged access reserved. Evidence: the list of named approvers, excluding the new administrator.
What should the IT operations lead measure?
Mover changes approved with old access left in place, which should be none. Leaver changes processed late. Privileged requests the new administrator correctly escalated. Amendments by reason. After sign-off, a monthly sample of their approvals for the first quarter. In the first month, read the held resets the new administrator completed together each week, and discuss why each was held.
Where does it usually go wrong?
Approving the draft because it matches the mapping. If the mapping is wrong, matching it is wrong too. New administrators need to know the mapping can be stale.
Granting privileged rights early "for cover". It is common for a new person to be given admin rights so they can help in an outage. Use a separate break-glass process instead.
No link to payroll and HR. Joiner and leaver dates come from HR, and payroll systems are high-value access. The plan for a new payroll administrator and what changes in a payroll administrator's day show the other side. Support teams handle the customer-facing equivalent, as the plan for a new customer support agent shows. The wider approach is in training teams for AI agents.
Questions people ask
Can the agent grant access on its own?
For low-risk, well-mapped groups, a business may certify it to do so at depth 3. Privileged access should be refused by the agent at every depth through the business's own limits.
What if a manager insists on urgent access?
Follow the urgent access process, with approval recorded. Do not ask the agent to bypass its bounds.
Who owns the role-to-group mapping?
The identity or access management owner. The agent reads it; administrators report errors in it.