How to build IT service desk fulfilment

What matters here

• Automate the top six request types properly, not everything partially. Volume concentrates far more than people expect.
• Only auto-fulfil what is safe, reversible and fully specified. Everything else routes to a person with the context attached.
• Check eligibility before granting. Entitlement by role beats an approval nobody can judge.
• Deflect before you fulfil. If the answer is written down, showing it costs less than doing the work.
• Measure the share fulfilled without a human, not tickets closed. That is the number that changes the queue.

Who this is for

You run IT operations or service management. The queue is full of password resets, access requests and software installs, each one handled manually by somebody who could be doing something harder.

How it works in practice

The path from somebody needing something to having it.

1. 1

   The request is raised from a catalogue

   Each item asking for exactly what fulfilment needs, so the first reply is never a question.

2. 2

   Deflection runs first

   If the answer exists in documentation, show it rather than paying somebody to paste the link.

3. 3

   Eligibility is checked against role and policy

   Entitled by role fulfils; not entitled routes for approval with the reason.

4. 4

   Safe requests fulfil end to end

   Group added, licence assigned, distribution list joined, with the change recorded.

5. 5

   Everything else routes with context attached

   Requester, role, manager, asset, history. Not a bare description.

6. 6

   The outcome is recorded against the catalogue item

   So the automation rate per item is visible and improvable.

Paste these into Claude Code or Codex with the Tray Headless plugin installed. Each stage runs on its own. The systems named in them are the worked example rather than a requirement, and every prompt says so.

Once per project, run /tray-workflows:set-workspace to pick the workspace these build in. Point it at a sandbox first.

1. 1

   Set up, then find where the volume actually is

   Volume concentrates far more than anybody expects.

   Headless skills build-workflow

   Copy

   Use build-workflow. The systems in play are Jira Service Management
   and Okta, or whatever we run in those seats.
   
   Before building anything, analyse the last six months of tickets and
   group them by what they were actually about, not by the category somebody
   selected.
   
   Show me the top twenty by volume, with median handling time and how often
   each was reassigned.
   
   Automating the top six properly beats automating twenty badly, and the
   list is almost always shorter and more boring than people expect.

   Sort by volume times handling time, not volume alone. A rare request that takes an hour can be worth more than a frequent one that takes two minutes.

2. 2

   Build a catalogue that asks for what fulfilment needs

   A free text box guarantees a round trip.

   Headless skills build-workflow

   Copy

   Use build-workflow. Build a catalogue item per request type in the top
   list, each asking for exactly what fulfilment requires:
   
     Access to a system: which system, which level, for how long, why
     Software install: which software, which machine, business justification
     if licensed
     Distribution list: which list, and whether they need to post or only
     receive
     New starter kit: start date, role, location, manager
   
   Pre-fill everything from the directory: requester, manager, team,
   location, device. Never ask for something the system already knows, and
   never present a field somebody has to guess at.
   
   Let me add catalogue items without a deployment. The list changes
   constantly and it is the part everybody else wants to change.

3. 3

   Deflect, then check eligibility

   If the answer is written down, showing it is cheaper than doing the work.

   Copy

   Before fulfilling anything, search the documentation and recently
   resolved requests and show the likely answer. Track how often that
   deflects, because that number decides whether the documentation is worth
   maintaining.
   
   Then check eligibility instead of asking for approval:
   
     Is this role entitled to this by policy
     Is a licence available, and what does it cost
     Does the request conflict with anything, such as segregation of duties
     Has this person had it before and had it revoked
   
   Entitled by role fulfils immediately. Not entitled routes to the system
   owner with the reason and the policy quoted, which is a far better
   conversation than a bare approval request.

4. 4

   Fulfil only what is safe to fulfil

   The boundary between automatic and routed is the whole design.

   Headless skills tray-gotchas

   Copy

   Use tray-gotchas, then auto-fulfil only where all of these hold:
   
     Reversible: the change can be undone in minutes
     Low blast radius: it affects one person, not a group or a system
     Fully specified: every field needed is present and valid
     Entitled: policy already permits it for this role
     Within limits: licence available, spend below a threshold
   
   Everything else routes. Do not stretch the boundary to raise the
   automation rate. An automatically granted permission somebody should not
   have costs far more than the ten minutes it saved.
   
   Record every automatic fulfilment as a change, with what was granted and
   under which entitlement, because these are still access changes and they
   appear in an access review.

5. 5

   Route the rest with the research already done

   Most handling time is looking things up, not fixing.

   Copy

   For anything that routes to a person, attach everything they would have
   looked up: requester, role, manager, location, their devices, their
   current access to the system in question, their last five requests, and
   whether anybody else asked for the same thing this week.
   
   Then report by catalogue item: volume, share fulfilled without a human,
   median time to fulfil, deflection rate, and reassignment count.
   
   Automation rate per item is the number that matters. Tickets closed rises
   with headcount and tells you nothing, and the item with high volume and
   low automation is always the next thing to build.

6. 6

   Validate, then hand the catalogue to IT

   Because the catalogue is never finished.

   Copy

   Run the per-step schema checks and the whole-workflow audit before this
   touches production.
   
   Then open the same workflow in Tray Build so IT operations can add
   catalogue items, change eligibility rules and move the auto-fulfil
   boundary in the visual canvas. New request types appear every month and
   none of them should need an engineer.

What it connects to

Requests arrive where people are and fulfilment happens where the access lives.

Named systems are the ones most teams run, not the only ones that work. Each is an authentication in your Tray workspace, referenced by name, so the workflow never holds a credential. Where we have a connector page, the name links to it.

Questions people ask

Further reading

Background on the same subject, for the case rather than the build.

• Why IT needs an AI-powered support agent (and how it works)

Related guides