Information Systems & IT

ticket → triage record → resolution (or escalation) → knowledge base article → problem/trend report

• Automate
  Intake & self-service deflection — conversational agent resolves password resets, how-tos, and known issues directly against the KB and identity system · huge volume, low stakes, and success is verifiable — the user confirms it worked or the ticket reopens
• Automate
  Triage & routing — classify category, urgency, and assignment group from free-text tickets · repetitive and cheap to correct; a misroute costs minutes, not money
• Draft
  Diagnosis & resolution drafting — AI surfaces similar past tickets and drafts fix steps for the technician · context is rich in ticket history, but executing changes on someone's machine needs an accountable human
• Assist
  Identity-sensitive requests (credential resets on privileged accounts, MFA re-enrollment) — AI assembles verification context only; a human verifies the caller · helpdesk impersonation is now a top intrusion vector, and a fraudulent reset is close to irreversible
• Draft
  KB article generation — turn resolved tickets into draft articles automatically · verifiable by the resolving tech, and unpublished bad drafts cost nothing; unreviewed published ones poison future deflection
• Draft
  Problem management & trend reporting — cluster recurring tickets into problem candidates with evidence · pattern-finding at volume is AI's strength; deciding what's worth a root-cause project is a resourcing call

access request → risk/policy assessment → approval decision → provisioning change → certification record → audit evidence

• Draft
  Request interpretation & policy lookup — translate "I need what Maria has" into specific entitlements, check role fit and segregation-of-duties conflicts · rules-heavy and checkable against the role model, but the output shapes a consequential decision
• Automate
  Birthright & low-risk provisioning — auto-grant standard packages on HR joiner/mover events · pure rules, fully logged, and revocable in seconds
• Assist
  Privileged and sensitive grants — AI compiles a risk brief (who, what, precedent, SoD flags); a named human approves · high stakes plus regulatory exposure — SOX and auditors want a human name on the grant, and over-provisioning is how breaches escalate
• Draft
  Access certification campaigns — pre-flag dormant accounts, outlier entitlements, and peer-group anomalies so reviewers judge exceptions instead of rubber-stamping lists · turns an unverifiable checkbox ritual into reviewable claims; humans still sign the certification
• Automate
  Offboarding deprovisioning — trigger and verify revocation across all systems on termination · the risk runs the other way: the irreversible harm is the account you *don't* kill, and completeness is machine-checkable
• Assist
  Non-human identity governance — inventory service accounts, API keys, and AI-agent credentials; flag over-scoped or orphaned ones · the fastest-growing identity population is agents, context on "what does this agent actually need" is scattered, and revoking blind breaks production

alert → enriched investigation → incident record → containment action → post-incident report → detection rule update

• Automate
  Alert triage & enrichment — auto-correlate alerts, pull asset/user context, reputation lookups, and prior-incident history; close known benign patterns · thousands of alerts a day, enrichment is verifiable lookup work, and a wrong close is recoverable while the log trail exists
• Draft
  Investigation narrative — assemble a timeline across endpoint, identity, and network logs in plain English · AI reads logs faster than any analyst, but the narrative frames every downstream decision, so an analyst owns it
• Assist
  Containment execution (isolate host, disable account, block domain) — AI stages the action with blast-radius analysis; a human fires it · technically reversible but business-disruptive — isolating the wrong server or CEO's account mid-quarter is a stakes problem, not a capability problem
• Automate
  Phishing response — verdict reported emails, purge confirmed campaigns from all mailboxes, notify targets · high volume, narrow well-understood action, easily undone
• Draft
  Detection engineering — draft new detection rules (KQL/Sigma) from incident findings and threat intel · rules are testable against historical data before deploy, which makes the AI output cheap to verify
• Draft
  Post-incident reporting — generate the incident report and regulator/customer notification drafts from the case record · regulatory exposure means counsel and the CISO own the wording; AI just eliminates the blank page

usage & spend data → application inventory → rationalization recommendation → renewal brief → contract/DPA → sanctioned-tool policy

• Automate
  Shadow IT & shadow AI discovery — reconcile SSO logs, expense lines, and network telemetry into a live app inventory, flagging unsanctioned AI tools where employees may be pasting company data · pure cross-referencing at volume, and every finding is verifiable against source records
• Automate
  License utilization analysis — map paid seats to actual usage per app · mechanical, high-volume, and wrong answers surface immediately when checked
• Draft
  Rationalization recommendations — propose consolidations and cuts with overlap analysis and switching-cost estimates · the data work is AI-shaped, but usage counts miss load-bearing niche apps, so an owner validates before anything dies
• Draft
  Vendor security & AI-clause review — extract SOC 2 findings, data-processing terms, and model-training/data-retention clauses from vendor paperwork into a comparison grid · extraction is checkable against the document; judging acceptable risk is legal's and security's call
• Assist
  Renewal negotiation — AI builds the leverage brief (usage, benchmarks, alternatives, contract asymmetries); humans negotiate · negotiation is a relationship game with a counterparty, the classic rules-vs-relationships boundary
• Assist
  Sanctioning decisions & AI-use policy — decide what's approved, tolerated, or blocked, including which AI agents may touch which data · low volume, high organizational stakes, and it's a governance judgment the CIO must own

process map → integration spec (field mappings, triggers, exceptions) → workflow build → test evidence → production cutover → runbook

• Draft
  Process discovery & mapping — interview notes and screen recordings become a documented as-is flow with systems and handoffs · AI structures messy input fast, but only the process owner knows which undocumented exception is the real process
• Draft
  Field mapping & transformation spec — propose source-to-target mappings with sample-data validation · directly verifiable against real records, which makes AI's speed nearly free to check
• Draft
  Workflow build — generate the iPaaS recipe or automation from the spec in a sandbox · low-code platforms make the output inspectable and testable by a non-engineer before it touches anything real
• Automate
  Test-case generation & sandbox execution — enumerate edge cases (nulls, duplicates, malformed dates, retries) and run them against sample payloads · testing is the definition of verifiable work, and sandbox failures cost nothing
• Avoid
  Production cutover — enabling live writes to systems of record · bad writes to the ERP or CRM propagate downstream and are painful to unwind — a human flips the switch after reviewing test evidence, ideally with a human-approval step left inside the workflow
• Assist
  Exception handling & maintenance — AI drafts diagnosis when a workflow errors; a human applies the fix · each failure is novel and low-volume, and the fix is itself a production change

telemetry → correlated alert → incident channel & timeline → remediation change → status communications → postmortem

• Automate
  Anomaly detection & alert correlation — collapse alert storms into one probable incident with affected services · this is statistics over high-volume telemetry, and a bad correlation is instantly visible to responders
• Draft
  Incident summarization & comms — maintain a live timeline and draft status-page/stakeholder updates during the incident · AI keeps up with a fast channel better than any scribe, but a wrong public statement is a trust event, so a human posts
• Draft
  Root-cause hypothesis — correlate the incident with recent deploys, config changes, and dependency status to rank likely causes · genuinely strong AI territory because the change log is machine-readable, but hypotheses must be labeled as hypotheses
• Automate
  Runbook remediation — execute pre-approved actions: restart the service, roll back the flagged deploy, scale out · bounded, rehearsed, reversible actions with humans spot-checking — this is what runbooks were always for
• Avoid
  Novel production changes under pressure — untested fixes outside the runbook during an active incident · lowest-context, highest-stakes moment in all of IT; an AI-suggested "fix" applied at 2 a.m. is how outages become data-loss events
• Draft
  Postmortem authoring — assemble the blameless postmortem from the channel, timeline, and change records · the evidence-gathering is mechanical; the lessons and action items need the humans who were there