By Sagar Shankaran, Founder of CallSphere
Build IT helpdesk AI agents with multi-agent architecture for triage, device, network, and security issues. RAG-powered knowledge base, automated ticket creation, routing, and escalation.
Key takeaways
IT helpdesks face a persistent challenge: 60-70% of all tickets are Level 1 issues — password resets, VPN configuration, printer setup, software installation requests, and basic troubleshooting steps that follow documented procedures. Each L1 ticket costs $15-25 to resolve and takes an average of 8 minutes of analyst time. Meanwhile, complex L2/L3 issues queue behind the flood of routine requests.
AI agents can resolve the majority of L1 tickets autonomously by combining conversational AI with retrieval-augmented generation (RAG) over the organization's knowledge base, plus integration with IT service management (ITSM) platforms for ticket creation and execution of automated remediation.
An effective IT helpdesk AI system uses specialized agents for different problem domains, coordinated by a triage agent that routes the user's request to the right specialist.
flowchart LR
Q(["User query"])
EMB["Embed query<br/>text-embedding-3"]
VEC[("Vector DB<br/>pgvector or Pinecone")]
RET["Top-k retrieval<br/>k = 8"]
PROMPT["Augmented prompt<br/>system plus context"]
LLM["LLM generation<br/>Claude or GPT"]
CITE["Inline citations<br/>and page anchors"]
OUT(["Grounded answer"])
Q --> EMB --> VEC --> RET --> PROMPT --> LLM --> CITE --> OUT
style EMB fill:#ede9fe,stroke:#7c3aed,color:#1e1b4b
style VEC fill:#ede9fe,stroke:#7c3aed,color:#1e1b4b
style LLM fill:#4f46e5,stroke:#4338ca,color:#fff
style OUT fill:#059669,stroke:#047857,color:#fff
from dataclasses import dataclass, field
from enum import Enum
from typing import Optional
import asyncio
class TicketPriority(Enum):
CRITICAL = 1 # System down, affecting multiple users
HIGH = 2 # Single user blocked, no workaround
MEDIUM = 3 # Issue with workaround available
LOW = 4 # Enhancement request or minor issue
class TicketCategory(Enum):
ACCOUNT_ACCESS = "account_access"
DEVICE = "device"
NETWORK = "network"
SOFTWARE = "software"
SECURITY = "security"
HARDWARE = "hardware"
OTHER = "other"
@dataclass
class ITTicket:
id: str
user_id: str
user_email: str
category: TicketCategory
priority: TicketPriority
subject: str
description: str
assigned_agent: str # "ai_triage", "ai_device", "human_l2", etc.
status: str = "open"
resolution: Optional[str] = None
conversation_log: list[dict] = field(default_factory=list)
ai_actions_taken: list[str] = field(default_factory=list)
escalated: bool = False
class TriageAgent:
"""Routes IT issues to the appropriate specialist agent."""
CATEGORY_DESCRIPTIONS = {
TicketCategory.ACCOUNT_ACCESS: (
"Password resets, MFA issues, locked accounts, "
"permission requests, SSO problems"
),
TicketCategory.DEVICE: (
"Laptop/desktop issues, monitor setup, docking station, "
"peripheral problems, device provisioning"
),
TicketCategory.NETWORK: (
"WiFi connectivity, VPN configuration, internet speed, "
"DNS resolution, proxy settings"
),
TicketCategory.SOFTWARE: (
"Application installation, license requests, "
"software updates, compatibility issues, crashes"
),
TicketCategory.SECURITY: (
"Phishing reports, suspicious emails, malware concerns, "
"data breach reporting, security policy questions"
),
}
def __init__(self, llm_client, specialist_agents: dict):
self.llm = llm_client
self.specialists = specialist_agents
async def classify_and_route(
self, user_message: str, user_context: dict
) -> dict:
# Step 1: Classify the issue
categories_desc = "\n".join(
f"- {cat.value}: {desc}"
for cat, desc in self.CATEGORY_DESCRIPTIONS.items()
)
classification = await self.llm.chat(messages=[{
"role": "user",
"content": (
f"Classify this IT support request into one of "
f"these categories and assess priority.\n\n"
f"Categories:\n{categories_desc}\n\n"
f"Request: {user_message}\n"
f"User: {user_context.get('name')}, "
f"{user_context.get('department')}\n\n"
f"Return JSON: "
f'{{"category": "...", "priority": 1-4, '
f'"reasoning": "..."}}'
),
}])
import json
result = json.loads(classification.content)
category = TicketCategory(result["category"])
priority = TicketPriority(result["priority"])
# Step 2: Route to specialist
specialist = self.specialists.get(category)
if specialist:
return {
"category": category,
"priority": priority,
"agent": specialist,
"reasoning": result["reasoning"],
}
# Fallback: create ticket for human
return {
"category": category,
"priority": priority,
"agent": None,
"reasoning": "No specialist available, routing to human L2",
}
The backbone of an IT helpdesk AI agent is its knowledge base. RAG (Retrieval Augmented Generation) lets the agent search through thousands of internal documentation pages, runbooks, and past tickets to find the most relevant solution.
Hear it before you finish reading
Talk to a live CallSphere AI voice agent for IT support in your browser — 60 seconds, no signup.
from dataclasses import dataclass
@dataclass
class KBArticle:
id: str
title: str
content: str
category: str
last_updated: str
resolution_steps: list[str]
tags: list[str]
success_rate: float # historical resolution rate
class KnowledgeBaseRAG:
"""RAG system for IT knowledge base retrieval."""
def __init__(self, vector_store, embeddings_client, llm_client):
self.vectors = vector_store
self.embeddings = embeddings_client
self.llm = llm_client
async def index_article(self, article: KBArticle):
# Chunk the article for better retrieval
chunks = self._chunk_article(article)
for i, chunk in enumerate(chunks):
embedding = await self.embeddings.embed(chunk["text"])
await self.vectors.upsert({
"id": f"{article.id}_chunk_{i}",
"embedding": embedding,
"metadata": {
"article_id": article.id,
"title": article.title,
"category": article.category,
"chunk_index": i,
"success_rate": article.success_rate,
"tags": article.tags,
},
"text": chunk["text"],
})
async def search(
self,
query: str,
category: str = None,
top_k: int = 5,
) -> list[dict]:
query_embedding = await self.embeddings.embed(query)
filters = {}
if category:
filters["category"] = category
results = await self.vectors.query(
embedding=query_embedding,
top_k=top_k * 2, # over-fetch for reranking
filters=filters,
)
# Rerank using LLM for relevance
reranked = await self._rerank(query, results)
return reranked[:top_k]
async def _rerank(
self, query: str, candidates: list[dict]
) -> list[dict]:
candidate_texts = "\n".join(
f"[{i}] {c['metadata']['title']}: "
f"{c['text'][:200]}"
for i, c in enumerate(candidates)
)
response = await self.llm.chat(messages=[{
"role": "user",
"content": (
f"Rank these knowledge base results by relevance "
f"to the query. Return a JSON array of indices "
f"in order of relevance.\n\n"
f"Query: {query}\n\n"
f"Candidates:\n{candidate_texts}"
),
}])
import json
order = json.loads(response.content)
return [candidates[i] for i in order if i < len(candidates)]
def _chunk_article(
self, article: KBArticle, chunk_size: int = 500
) -> list[dict]:
words = article.content.split()
chunks = []
for i in range(0, len(words), chunk_size):
chunk_text = " ".join(words[i : i + chunk_size])
chunks.append({
"text": (
f"Title: {article.title}\n"
f"Content: {chunk_text}"
),
"start": i,
"end": min(i + chunk_size, len(words)),
})
return chunks
Each specialist agent follows the same pattern: retrieve relevant KB articles, walk the user through troubleshooting steps, attempt automated remediation if possible, and create a ticket for human follow-up if the issue is not resolved.
class DeviceTroubleshootingAgent:
"""Handles laptop, desktop, peripheral, and docking station issues."""
def __init__(
self,
llm_client,
kb: KnowledgeBaseRAG,
itsm_client,
mdm_client,
):
self.llm = llm_client
self.kb = kb
self.itsm = itsm_client
self.mdm = mdm_client # Mobile Device Management
async def troubleshoot(
self, ticket: ITTicket, user_message: str
) -> dict:
# Step 1: Get device info from MDM
device_info = await self.mdm.get_device(
user_email=ticket.user_email
)
# Step 2: Search knowledge base
kb_results = await self.kb.search(
query=user_message,
category="device",
top_k=3,
)
# Step 3: Generate troubleshooting response
context = self._build_context(device_info, kb_results)
response = await self.llm.chat(
messages=[
{
"role": "system",
"content": (
"You are an IT helpdesk specialist for device "
"issues. Use the knowledge base articles and "
"device information provided to troubleshoot.\n"
"Always provide step-by-step instructions.\n"
"If the issue requires physical intervention, "
"create a ticket.\n\n"
f"{context}"
),
},
*ticket.conversation_log,
{"role": "user", "content": user_message},
],
tools=[
self._restart_device_tool(),
self._push_config_tool(),
self._create_ticket_tool(),
self._escalate_tool(),
],
)
# Handle tool calls
actions = []
if response.tool_calls:
for tc in response.tool_calls:
result = await self._execute_action(tc, ticket)
actions.append({
"action": tc.function.name,
"result": result,
})
return {
"response": response.content,
"actions": actions,
"kb_articles_used": [
r["metadata"]["article_id"] for r in kb_results
],
}
async def _execute_action(self, tool_call, ticket: ITTicket):
name = tool_call.function.name
args = tool_call.function.arguments
if name == "restart_device":
result = await self.mdm.send_command(
device_id=args["device_id"],
command="restart",
)
ticket.ai_actions_taken.append(
f"Initiated remote restart: {result}"
)
return result
elif name == "push_config":
result = await self.mdm.push_profile(
device_id=args["device_id"],
profile_name=args["profile"],
)
ticket.ai_actions_taken.append(
f"Pushed config profile {args['profile']}: {result}"
)
return result
elif name == "create_ticket":
ticket_id = await self.itsm.create_ticket(
subject=args["subject"],
description=args["description"],
priority=ticket.priority.value,
category=ticket.category.value,
assigned_group=args.get("assigned_group", "desktop_support"),
)
ticket.ai_actions_taken.append(
f"Created ITSM ticket: {ticket_id}"
)
return {"ticket_id": ticket_id}
elif name == "escalate":
ticket.escalated = True
return await self.itsm.escalate_ticket(
ticket_id=ticket.id,
to_group=args["escalation_group"],
reason=args["reason"],
)
def _build_context(
self, device_info: dict, kb_results: list
) -> str:
lines = ["## Device Information"]
if device_info:
lines.append(f"- Model: {device_info.get('model', 'Unknown')}")
lines.append(f"- OS: {device_info.get('os_version', 'Unknown')}")
lines.append(
f"- Last seen: {device_info.get('last_checkin', 'Unknown')}"
)
lines.append(
f"- Compliance: {device_info.get('compliance_status', 'Unknown')}"
)
lines.append("\n## Relevant Knowledge Base Articles")
for r in kb_results:
lines.append(
f"### {r['metadata']['title']}\n{r['text']}"
)
return "\n".join(lines)
def _restart_device_tool(self) -> dict:
return {
"type": "function",
"function": {
"name": "restart_device",
"description": (
"Remotely restart the user's device via MDM"
),
"parameters": {
"type": "object",
"properties": {
"device_id": {"type": "string"},
"reason": {"type": "string"},
},
"required": ["device_id"],
},
},
}
def _push_config_tool(self) -> dict:
return {
"type": "function",
"function": {
"name": "push_config",
"description": "Push a configuration profile to the device",
"parameters": {
"type": "object",
"properties": {
"device_id": {"type": "string"},
"profile": {"type": "string"},
},
"required": ["device_id", "profile"],
},
},
}
def _create_ticket_tool(self) -> dict:
return {
"type": "function",
"function": {
"name": "create_ticket",
"description": (
"Create an ITSM ticket for human follow-up"
),
"parameters": {
"type": "object",
"properties": {
"subject": {"type": "string"},
"description": {"type": "string"},
"assigned_group": {"type": "string"},
},
"required": ["subject", "description"],
},
},
}
def _escalate_tool(self) -> dict:
return {
"type": "function",
"function": {
"name": "escalate",
"description": "Escalate ticket to L2/L3 support team",
"parameters": {
"type": "object",
"properties": {
"escalation_group": {"type": "string"},
"reason": {"type": "string"},
},
"required": ["escalation_group", "reason"],
},
},
}
When the AI agent cannot resolve an issue, it creates a detailed ticket that gives the human analyst a head start instead of making them start from scratch.
class TicketCreationEngine:
"""Creates well-structured tickets from AI conversations."""
def __init__(self, llm_client, itsm_client):
self.llm = llm_client
self.itsm = itsm_client
async def create_from_conversation(
self, ticket: ITTicket
) -> str:
# Generate a structured summary
summary = await self.llm.chat(messages=[{
"role": "user",
"content": (
f"Summarize this IT support conversation into a "
f"structured ticket. Include:\n"
f"1. Issue summary (1-2 sentences)\n"
f"2. Steps already attempted by AI agent\n"
f"3. Current state of the issue\n"
f"4. Recommended next steps for L2 analyst\n"
f"5. Relevant system/device info\n\n"
f"Conversation:\n"
+ "\n".join(
f"{t['role']}: {t['content']}"
for t in ticket.conversation_log
)
+ f"\n\nAI actions taken: "
+ ", ".join(ticket.ai_actions_taken)
),
}])
# Determine routing
routing = await self._determine_routing(ticket)
ticket_id = await self.itsm.create_ticket(
subject=ticket.subject,
description=summary.content,
priority=ticket.priority.value,
category=ticket.category.value,
assigned_group=routing["group"],
assigned_to=routing.get("individual"),
tags=routing.get("tags", []),
custom_fields={
"ai_resolved": False,
"ai_attempts": len(ticket.ai_actions_taken),
"ai_conversation_id": ticket.id,
},
)
return ticket_id
async def _determine_routing(self, ticket: ITTicket) -> dict:
routing_rules = {
TicketCategory.ACCOUNT_ACCESS: {
TicketPriority.CRITICAL: "identity_team",
TicketPriority.HIGH: "identity_team",
"default": "helpdesk_l2",
},
TicketCategory.NETWORK: {
TicketPriority.CRITICAL: "network_ops",
"default": "network_support",
},
TicketCategory.SECURITY: {
"default": "security_ops",
},
TicketCategory.DEVICE: {
"default": "desktop_support",
},
}
category_rules = routing_rules.get(
ticket.category, {"default": "helpdesk_l2"}
)
group = category_rules.get(
ticket.priority,
category_rules.get("default", "helpdesk_l2"),
)
return {"group": group, "tags": [ticket.category.value]}
The key metrics for IT helpdesk AI agents:
The knowledge base should be treated as a living system. Set up automated pipelines that re-index KB articles when they are updated in your documentation platform (Confluence, SharePoint, Notion). Track which KB articles are cited in successful resolutions vs escalations — articles with low success rates need review. Some teams use a feedback loop where human analysts can flag AI responses as incorrect, which triggers a KB review workflow.
Still reading? Stop comparing — try CallSphere live.
See the IT support AI agent handle a real call — complete, industry-specific, and live in your browser. No signup.
Yes, but with strict identity verification. The AI agent should verify the user's identity through multi-factor authentication before performing any account operations. Password resets can be executed through the same API that the self-service portal uses — the AI agent is just providing a conversational interface to the same secure backend. Never allow the AI agent to bypass security controls that human analysts must follow.
The AI triage agent classifies priority independently of the user's stated urgency. It uses objective criteria: number of affected users, availability of workarounds, business impact, and time sensitivity. If the user insists on higher priority, the agent can acknowledge their urgency while maintaining the assessed priority, and offer to escalate for priority review. This is actually easier for AI than for human analysts, who face social pressure to accommodate urgency claims.
Yes, through a continuous improvement loop. When a human analyst resolves an escalated ticket, the resolution steps can be indexed into the knowledge base for future RAG retrieval. Some organizations use fine-tuning on their historical ticket resolution data to improve the AI agent's troubleshooting accuracy. The key is maintaining a feedback loop: AI attempts resolution, escalates when it fails, humans resolve, and the resolution feeds back into the AI's knowledge base.
#ITHelpdesk #AIAgents #TicketRouting #RAG #Automation #ServiceDesk #ITSM
Written by
Sagar Shankaran· Founder, CallSphere
LinkedInSagar Shankaran is the founder of CallSphere, where he builds production AI voice and chat agents deployed across healthcare, hospitality, real estate, and home services. He writes about agentic AI, LLM engineering, and shipping voice agents that handle real calls in production.
See how AI voice agents work for your industry. Live demo available -- no signup required.
A founder's guide to the personal AI assistant market: best AI assistant apps, business-grade options, and how CallSphere's voice agent fits in.
A founder's guide to free AI agents, low-code AI agent builders, and how to know when you should pay for a real platform like CallSphere.
A founder's guide to building a chatbot for answering questions on your website: RAG, voice, and how CallSphere ships one in 3-5 days.
Graphiti is the open-source temporal knowledge graph for AI agents in 2026. Learn how bi-temporal memory beats vector RAG for voice agents and long-running LLMs.
Chatbot app vs ChatGPT in 2026: a founder's clear take on the difference, when to use which, and how a real AI chatbot app development works.
A founder's guide on how to create a chatbot in 2026. Build options, AI stack, integration patterns, and when buying a managed agent wins over building.
© 2026 CallSphere Inc. All rights reserved.
Made within San Francisco
Watch how CallSphere handles real customer calls, schedules appointments, and processes payments — live.
Try Live DemoBook a DemoCalculate Your ROI