How do I safely connect an AI assistant to our help desk tickets?

11 November 2026 · 4 min read

Treat ticket text as untrusted, start read only, keep a named owner and a human approval for anything hard to undo, and log every action.

In brief

Connecting an AI assistant such as Claude, ChatGPT or Copilot to a help desk can be useful, but every ticket is written by whoever raised it, so the assistant must treat ticket text as untrusted input. Anyone who can log a ticket can try to slip instructions to the assistant, which is known as prompt injection. OWASP lists it as the top risk for large language model applications, and the UK National Cyber Security Centre has argued it may never be fully mitigated, so the safest approach is to limit what a misled assistant could do. Esm recommends deciding the outcome first, starting with read only access to an export or reporting dataset, removing passwords and personal data before anything reaches an external model, and giving the assistant its own limited account if it later creates tickets. Anything hard to undo, such as closing tickets, replying to users or changing priorities, should need a person's approval, every action should be logged against the ticket, and users should be told when an assistant has drafted a reply. A worked example shows a service desk proving value on read only triage suggestions before allowing approved draft replies. Common mistakes include connecting first and deciding the purpose later, automating a messy process, using an administrator account and leaving ownership vague. The article draws on John Sansbury's The Journey to Service Excellence and Ian Hughes's What Stays the Same.

Yes, you can connect an AI assistant to your help desk, but treat every ticket it reads as untrusted input and start with read only access. Give the assistant the smallest set of permissions that does a useful job, put a named person in charge of it, and only let it change tickets once you have seen it behave well on real data.

The question usually arrives in a simple form: is there a plugin, connector or MCP server that lets Claude, ChatGPT or Copilot work with our help desk? Sometimes the answer is that the platform has no public API yet, so there is nothing for a connector to sit on. When there is a route, the harder question is not whether it can be connected but what the assistant should be allowed to do once it is.

Why ticket data needs special care

A ticket is written by whoever raised it. If an assistant reads tickets and can then act, anyone who can log a ticket can try to give it instructions. This is prompt injection, and OWASP lists it as the first risk in its Top 10 for large language model applications. The UK National Cyber Security Centre has argued that because a model does not separate data from instructions, prompt injection may never be fully mitigated in the way SQL injection can. So the design aim is to limit what a fooled assistant could do, not to hope it will never be fooled.

OWASP calls the related problem excessive agency: an assistant with more functions, permissions or autonomy than its task needs. For a service desk that means an assistant that can close, reassign or reply to tickets, or email people, when all you wanted was a summary.

Practical steps

Decide the outcome first. Faster triage, better first time fixes, trend spotting for problem management or drafting knowledge articles each need very different access. Write the outcome down before choosing a tool.

Start read only. Let the assistant analyse an export or a reporting dataset rather than the live system. Most of the early value, such as finding repeat incidents or gaps in the knowledge base, needs no write access at all.

Strip what the model does not need. Remove passwords, personal data and anything confidential from what you send to an external service, and check what your licence says about how prompts and data are stored and used.

Use a separate, limited account. If the assistant later creates tickets, give it its own service account that can only create, through a dedicated mailbox or API scope, so its actions are distinguishable from people's.

Keep a human yes for anything you cannot easily undo. Closing tickets, replying to users, changing priorities and touching accounts should wait for a person to approve.

Log everything. Record each action with the ticket reference and what changed. If you cannot trace an action back to what prompted it, the assistant should not be allowed to take it.

Be open with users. If an assistant drafts replies, say so. John Sansbury makes the same point about chatbots in The Journey to Service Excellence: "Good practice is to advise the user that they are dealing with a chatbot rather than try to disguise the fact".

A short worked example

Imagine a service desk of eight analysts that wants help with triage. In month one, a nightly export goes to the assistant, which suggests a category and priority for each new ticket and flags likely duplicates. Analysts compare its suggestions with their own. In month two, with agreement rates tracked, the assistant drafts a first reply that an analyst must approve before it is sent. The service desk manager is named as the owner, the assistant cannot close anything, and any ticket text that looks like an instruction to the assistant is flagged for review. That is a hypothetical design, not a case study, but it shows the pattern: prove value on read only data, then widen access one step at a time.

Common mistakes

Connecting first and deciding the purpose later. John's warning applies directly: "A sub-optimal process that is automated may simply fail quicker or in unexpected ways." If your categories and routing rules are a mess, an assistant will reproduce the mess at speed. Tidy the process, then automate it.

Giving the assistant an administrator's account because it was quicker to set up.

Treating the vendor's safety claims as your controls. Vendor documentation, such as the Model Context Protocol security best practices, is useful vendor material, but the permissions and approvals are yours to set.

Leaving ownership vague. As Ian Hughes puts it in What Stays the Same, "You can delegate the task. You can never delegate the accountability." His advice is to "Name the owner before you switch the agent on."

Next step

For more on leading AI in service teams, browse the AI enablement articles on ESM's Exchange.

If this helped, John Sansbury's The Journey to Service Excellence covers support centre management, automation and the guiding principles in depth, and is available to Exchange members. Ian Hughes's What Stays the Same explores accountability when AI can act.

Tags: esm-questions, ai, service-desk, prompt-injection, automation