Grant sending per type of request, not for the whole helpdesk. The agent drafts replies on every ticket at depth 2, and sends at depth 3 only for request types where Attest has certified it on your own past tickets. It may not add recipients, change the requester, merge tickets or mark a complaint solved. Every reply is filed.
What does replying involve, and who owns it?
Replying to a ticket is three actions, not one: writing the answer, sending it to the right person, and changing the ticket's state. Each can go wrong in a different way. A wrong answer misleads one customer. A reply sent to the wrong address discloses one customer's data to another. A ticket marked solved too early hides an unresolved problem from your reporting.
The support operations lead owns the helpdesk configuration. Team leaders own the queues and the request types. Name the owner of each request type before you grant anything, because sending rights are granted per type. The broader position on what support agents should and should not do is in the AI support agent that knows when to say no.
Which helpdesk actions should you grant, and at what depth?
| Helpdesk action | Depth | Stays with a person |
|---|---|---|
| Read the ticket, customer and ticket history | 1 | Nothing |
| Add an internal note | 3 | Nothing |
| Save a draft public reply | 2 | Sending it |
| Send a public reply on a certified request type | 3 | Other request types |
| Attach files from an approved library | 3 | Any other attachment |
| Set status to "awaiting customer" | 3 | Nothing |
| Set status to "solved" | 3, certified types only | Complaints; any disputed ticket |
| Add CC recipients or change the requester | None | Staff, after checks |
| Merge or split tickets | None | Staff |
| Edit customer profile fields | None | Handled by a separate grant |
Request types are where the depth lives. "Where is my order?" might be certified at depth 3 because the answer comes from a sealed source, the order system. "Why was I charged twice?" might stay at depth 2 because the answer depends on judgement. The same agent sends one and drafts the other, in the same queue, on the same afternoon.
Recipients are the quiet risk. A ticket from a new email address asking about an existing account is a classic takeover attempt. The agent replies only to the requester the helpdesk already holds, and never adds anyone.
How do you set it up, step by step?
- Person, team leaders: list the request types and owners. For each one, write what a correct reply contains and which sources it may draw on.
- Agent, depth 1: classifies incoming tickets by type. Classification and routing are covered in whether an AI agent can tag and route incoming tickets.
- Certification: past tickets of each type are replayed. The agent's drafts are scored against the floor on grounding, refusal, scope and escalation. Types that clear become eligible for depth 3; the rest stay at drafting.
- Agent, depth 2: drafts on every ticket. With the sources for each claim and a note on anything it could not answer.
- Platform: checks each send against the minimum chain. Role scope, the certificate for that request type, the sources, your own limits, and platform guardrails. The lowest wins.
- Agent, depth 3: sends allowed replies and sets the status.
- Person: reviews held drafts in the helpdesk view, edits if needed, and sends.
Which replies are held, even on certified types?
Some content triggers a hold whatever the request type:
- a promise of money, such as a refund, credit or compensation;
- a reply on a ticket flagged urgent or at risk, which belongs with the team described in detecting urgent tickets in a busy queue;
- any ticket the customer has called a complaint;
- signs of distress, vulnerability or a legal threat;
- a third reply on the same ticket, which suggests the first two did not work.
The hold is written as a platform check on the draft and the ticket, not as an instruction to the agent. The agent cannot talk itself past it.
How do you revoke the access?
Revoke at the level of the problem. If replies on one request type start to slip, withdraw sending for that type and the agent drafts them again; the other types continue. If the certificate lapses after 90 days without renewal, sending stops for every type it covered. A certification run that clears no depth drops the agent to depth 1 the same day. Disabling the agent's helpdesk account stops everything at once. Test each level before go-live.
What does the audit trail record?
Every send, hold and refusal is filed in an append-only record: the ticket, the request type, the draft as sent, the sources and their provenance class, the bounds checked and the one that decided, and the person who released any held draft. Edits made by staff before sending are kept too. The difference between what the agent drafted and what a person sent is the most useful evidence you have when recertifying.
What should you measure?
- Reopen rate on tickets the agent sent and solved, compared with staff.
- Edit distance on held drafts: how much staff change before sending, by request type.
- Holds by trigger. If almost every draft on a type is held, the type is defined too broadly.
- Replies sent to a requester different from the original. Should be zero.
- Time to first reply on certified types.
Where does it usually go wrong?
Macros carry old promises. The agent applies a saved reply that mentions a delivery time or policy that has since changed. Treat macros as sources with an owner and a review date.
Solved means silent. The agent marks tickets solved after one reply, and the customer's follow-up opens a new ticket that looks like fresh demand. Solve only when the customer confirms, or after the waiting period your team leaders set.
The same agent replies in public. Helpdesk replies are private; social replies are not. Grant them separately, as described in replying to customers on social media.
Questions people ask
Should customers be told the reply came from an AI agent?
Yes. Say it in the reply and say how to reach a person. Under the EU AI Act people must be told when they interact with an AI system, and the practice builds trust elsewhere too.
Can staff override a hold and let the agent send?
A person sends the held draft themselves. They do not lift the hold for the agent, because then the decision and the record would point at the wrong actor.
How many request types should start at depth 3?
Few. Start with types answered from a single sealed source, such as order status, and add more as certification evidence builds on your own tickets.