Resets and routine tickets go to an agent. The IT administrator's day shifts to approving the requests that grant or widen access, managing the connections and credentials agents themselves use, reviewing what agents did on their own, and handling changes that are hard to undo. Agents become a new kind of user to administer, with their own access to review.
What did the day look like before?
- Working the service desk queue: resets, account lockouts, software requests.
- Provisioning and removing accounts for joiners and leavers.
- Granting access to systems and shared folders.
- Applying patches and changes in maintenance windows.
- Investigating alerts and outages.
Routine tickets filled much of the day.
What does the agent take on?
| Task | Who | Depth |
|---|---|---|
| Password resets and lockouts through verified identity checks | Agent | 3 |
| Standard software installs from an approved list | Agent | 3 |
| Joiner accounts from confirmed HR records | Agent | 3 |
| Access requests to sensitive systems | Agent drafts; administrator approves | 2 |
| Privileged access, firewall and configuration changes | Administrator | stays with a person |
Changes that are hard to undo, such as deleting accounts, changing production configurations or rotating shared credentials, should be held for a person in almost every set-up.
What fills the administrator's day now?
Approving access. The agent drafts access requests with the requester, the system, the role and the manager's approval. The administrator checks that the access fits the job and that the approval came from the right person. A manager's approval in the HR or identity system is sealed or signed; an email from someone claiming to be the manager is external.
Administering agents. Each agent needs its own identity, its own credentials and connections scoped to what it needs. Role scope is one of the five bounds every action meets; the connections the administrator sets up are what make that scope real. An agent with broader access than its role is a risk even if its limits would refuse most actions.
Reviewing what agents did alone. Sampling resets, installs and joiner accounts the agent completed at depth 3. Was the identity check done? Was the software on the approved list?
Leavers. Removing access promptly, including any connections a departing person set up for agents.
Incidents. When an agent does something unexpected, the administrator reads the record and helps the process owner find which bound let it happen.
A day in practice
Take a mid-sized professional services firm. By 9am the agent has handled 60 overnight tickets, mostly resets for staff travelling across time zones. The administrator starts with 12 held items. Eight are access requests to the client document system; she checks each against the requester's team and the matter list, approves seven, and declines one where the requester has moved teams. Two are requests for administrator rights on laptops, which she declines with a standard reason and an alternative.
The last two concern agents. The finance team's new reconciliation agent needs read access to the bank feed; the request asks for read and write. She edits it to read only and records why. Then she reviews the quarterly list of agent credentials and finds a connection set up for a pilot agent that was retired a month ago, still active. She revokes it and adds agent retirements to the leavers checklist.
What does an IT administrator need to learn?
How agents act: the agent's certified depth and the depth each action needs, the minimum chain, and how role scope depends on the access the administrator grants. How provenance applies to requests. Which actions are hard to undo and should be held. How to read the record during an incident. And how to treat agent identities with the same discipline as people's.
Payroll administrators see a similar shift towards approving and checking; compare what changes in a payroll administrator's day. Job descriptions often lag behind; see your job descriptions are out of date the day an agent goes live. New administrators are covered in how to onboard a new IT administrator. For every role, see AI agent skills by role.
Questions people ask
Should agents share a service account?
No. Each agent should have its own identity and credentials, so its actions are attributable and its access can be scoped and revoked on its own.
Can the agent grant access to sensitive systems?
It can draft the request. Approval for sensitive systems and any privileged access stays with a named administrator.
Who reviews the administrator's own approvals?
A second administrator or the IT manager, on a sample, and always for privileged access.