An AI IT helpdesk should answer fast and grant slowly

Microsoft’s security team published guidance in July on least privilege for AI agents: give each agent its own identity, build roles around discrete units of work, and expose only an approved list of tools. It is the right list. It is also written for organizations that have someone whose job is to read it.

The place this gets real for everyone else is the internal IT queue. Vendors in this space advertise deflecting 80 percent or more of access tickets, and the volume claim is believable, because the IT queue really is dominated by the same handful of requests. VPN setup. License questions. Software access. The password reset that never stops coming.

But that queue is hiding two different kinds of work under one intake form, and an AI helpdesk should treat them as differently as a bank treats the lobby and the vault.

Questions and changes are not the same ticket

“How do I set up the VPN on a personal laptop” is a question. The answer lives in a document, the same answer every time, and nothing changes when it is given. If the agent has your setup guides ingested, this should flow at any hour without a human touching it. “Do I have a Figma license” is also safe ground: a read-only lookup, scoped to the person asking about their own account.

“Give me access to the finance share” looks like the next ticket in the same queue. It is not. An access grant is a change to the security perimeter, requested in natural language, by someone whose enthusiasm for their own request is not evidence of anything. Automating the answer to a question saves minutes. Automating a grant transfers authority. Those deserve different machinery, not the same autopilot with a higher confidence threshold.

How Celeste splits them

In our design, the split is not a prompt instruction. It is enforced by ordinary code that runs after the AI, on every connected tool.

Every tool the agent can reach gets classified by the operator: read-only, low-risk write, or high-risk write. Until someone classifies a write tool, the agent cannot execute it at all. It can prepare the action. What comes out is a reply queued for review with the proposed change attached: the tool, the arguments, the wording to the employee, all pre-drafted. A tech reads it, and approving takes one click. The judgment stays with a person; the typing does not.

The classification is also pinned to the tool’s actual definition. Connected tools drift. A vendor updates its API, a new parameter appears, and yesterday’s “this tool can only create a ticket” is no longer a fact. When the live tool no longer matches the definition that was classified, the classification stops counting and the tool is held again until someone re-confirms it. Nobody discovers a surprise capability in production.

And one rule has no override: a tool that writes can never be classified as read-only. The agent can suggest classification defaults, but the floor is enforced on the server, not in the prompt.

Autonomy arrives one topic at a time

None of this requires trusting the agent everywhere at once. VPN how-tos can go live in week one, after the agent has practiced silently on your real incoming questions and you have read what it would have said. Access requests can stay in held-draft mode for a month, or forever. Each topic has its own dial, and turning one up is a small, reversible decision about a bounded thing.

That is the shape we would want even if we were the buyer, and it is how Celeste works on every channel: the agent proposes, hard-coded policy decides what executes and what waits for a person. We wrote recently about what happens when teams skip this and hand the agent a human’s login. The short version is that a human’s permissions were safe because of limits nobody wrote down, and software inherits none of them.

An IT queue run this way gets the outcome the deflection vendors promise, minus the part where the perimeter moved without anyone deciding it should. The how-to gets answered at 9pm from your own docs. The grant waits, drafted and ready, for the one person who should still be saying yes. See what that looks like in the product.