The helpdesk queue is the same twenty questions on rotation. Password resets, VPN setup, which license to request, why the printer driver broke again. The answers exist — in a wiki nobody opens. Meanwhile the structural work slips: quarterly access reviews get compressed into the week before the audit, the SaaS inventory is whatever the card statement implies, and incident response depends on whoever remembers where the runbook lives. And the team’s automation scripts accumulate credentials — pasted into code, copied between repos, rotated never.
The wiki becomes retrievable. Markdown and text docs are chunked, embedded, and indexed in the platform’s own vector store; agents query them through a read-only search_kb tool that returns passages with source files and relevance scores. Scope is fixed server-side: an agent granted the IT knowledge base can search that base and nothing else, and it cannot widen its own reach — not even if the model asks.
Channel agents put those answers where employees already are. Each conversation carries a spend ceiling, and the tool surface on channels is restricted to tools explicitly marked channel-safe. A thread the agent cannot close moves to a human without losing its context.
Credentials follow one rule everywhere: agents receive short-lived, scoped references injected at call time, never raw secrets. An exfiltrated prompt has nothing to leak. Agent steps run in sandboxed containers behind egress allowlists, and the run page shows which domains a run actually reached — the security team verifies instead of trusting.
Recurring hygiene moves onto durable scheduled runs. A run parked on an approval waits days without burning compute; a run interrupted by a restart resumes where it stopped.
Every access decision — the agent assembles evidence, the system owner decides. Every remediation step that touches infrastructure — one approval gate per mutating stage. Every escalated conversation — an operator takes over, the agent steps back. The append-only audit log records the lot across auth, config, run, and approval events, so the trail exists whether or not anyone remembered to write it down.
Start with one workflow. The free tier is enough to run a real one — agents propose, your team decides.