Run an IT help desk agent in Slack

The IT help desk template is an agent for a company’s internal IT, whether IT is one person or a service desk with a ticket queue. People mention it in Slack when they need help, and it runs on a weekly schedule for IT. It handles four jobs, each with its own skill:

Skill	What it does	When it runs
`help-desk`	Triages a question or problem, answers from your knowledge base with linked steps, troubleshoots one step at a time, and hands off to IT with everything tried. Treats phishing, a lost device, or a compromised account as urgent, and checks vendor status pages for outages.	When someone asks for help
`access-requests`	Collects who needs what access, at what level, why, and until when. Checks current access when an identity provider is connected, gathers the approvals your policy requires in the thread, and writes the exact change for IT.	When someone asks for access, or to remove it
`people-changes`	Builds an onboarding, role-change, or offboarding checklist of accounts, access, devices, and licenses, and tracks each item to done with evidence before its deadline. Offboarding stays in private channels.	When someone joins, changes role, or leaves
`it-digest`	Posts a short digest for IT: urgent and stalled requests, approvals waiting, people changes due soon, recurring issues worth a knowledge base article, and the week’s volume by category.	On the schedule, or when you ask

A fifth skill, slack-replies, shapes every post: replies use Slack’s layout blocks with the next step first, and a request that takes several steps shows a progress checklist in the thread. The agent needs only Slack. Connect a help desk, an identity provider, a knowledge base, or an HR system, and it reads them too. In this tutorial, you set the agent up for a growing company, answer a problem, route an access request, track an onboarding, and set up a weekly digest. Setup takes about 15 minutes.

You need the Developer or Admin role in the organization; see Organizations and roles. You also need permission to install a Slack app in your workspace, or an existing Slack connection in Recursion.

How it works

One session per request. An automation starts a session when someone mentions the agent in a thread, and every later mention in that thread wakes the same session. While a request is open, the agent sleeps between checks and its own timer wakes it to follow up.
It reads everywhere, and acts only in Slack. The agent never grants access, resets a password or MFA factor, unlocks an account, or locks or wipes a device. It writes the exact change in the thread for someone in IT to make. The only exception is a tool your organization added that asks an approver before it runs (see Require approval before a tool runs).
Security first. It never asks for or repeats a password, a one-time code, or a key, and tells anyone who posts one to delete it and change it. Only the person who asks, by Slack user, can request access; a request for someone else needs that person, or an allowed approver, to confirm in the thread. Bots and members of another organization in a shared channel can ask for help but can’t request or approve access. Slack doesn’t tell the agent whether a member is a guest, so your Approvals setting is what keeps a guest from getting access.
Approvals in the thread. An approval counts only as a reply in the thread from someone your policy allows, who is neither the requester nor the person getting access. Reactions don’t count. The agent records how it knows each approver’s role, from an HR system, an identity provider, your settings, or only the requester’s word, and tells IT which approvals rest on the requester’s word.
Departures and role changes are verified. Nothing that disables or removes access for someone leaving or changing role goes to IT until an HR system record shows it, or someone your Approvals setting allows confirms it in the thread and an HR system, an identity provider, or your settings show that person’s role.
Every fact has a source. Steps link the knowledge base article they come from. A fix from general knowledge is labeled as general, not your company’s procedure.
Graded against a rubric. The agent’s rubric checks sourcing, that it never handled a secret, that it only read outside Slack, and the rules of the skill the turn used. See Outcomes.

Step 1: Connect Slack

Console
cURL

In the sidebar, click Integrations, then click Add integration.
Choose Slack, and choose the workspace.
In Slack, invite the Recursion app to your IT help channel, such as #it-help, and to the private channel IT works in.

Connect in the console first, then list connections to get the ids you’ll use later.

curl 'https://api.recursion.labelbox.com/managed-agents/v1/integrations/connections' \
  -H "Authorization: Bearer $RECURSION_API_KEY"

Step 2: Create the agent from the template

On Home, under Start from a template, click IT help desk. The assistant asks four setup questions: who IT looks after, which jobs the agent takes on first, which IT systems you use, and where a request goes when it needs a person from IT. It rewrites the agent’s settings from your answers and suggests the apps to connect. To skip the questions, click Use defaults under the template instead.
When asked, choose the Slack connection. The template grants it with workspace_tools access, which checklists and digests need.
Review the plan and approve it.

The agent’s settings are the last lines of its system prompt: You support, Focus, Work hours, Escalation, Approvals, Standard apps, and Apps. Edit them on the agent’s Configuration tab at any time. Set Escalation to the Slack user group or channel IT watches, Approvals to your access policy, and Standard apps to the apps and groups every new hire gets, then click Save new version. The template’s agent searches the web, which it uses for vendor documentation and status pages, and keeps a history of the records it saves.

Step 3: Give it more to read (optional)

With Slack alone, the agent answers from vendor documentation, collects access requests and approvals, and tracks checklists whose evidence is posted in the thread. Each app you add gives it another source:

Add	The agent reads
A help desk, such as Jira Service Management, Freshservice, ServiceNow, or Zendesk	Knowledge base articles for answers, existing tickets to link instead of duplicating, and ticket status for follow-ups and the digest
A knowledge base, such as Confluence, Notion, or SharePoint	Your own how-to articles and onboarding checklists
An identity provider, such as Okta	Whether someone already has an app or group, and whether a checklist’s account item is done
An HR system, such as Workday, BambooHR, or HiBob	Start and end dates, titles, teams, and managers for people changes

Connect the app under Integrations and allow only its read tools. See Choose which tools agents may use.
On the agent’s Configuration tab, under Integrations, add the app, then click Save new version. See Grant apps to an agent.

Device management (such as Jamf, Kandji, or Intune) and identity providers other than Okta aren’t built-in integrations. To let the agent read them, add your own MCP server for them with read-only tools; see MCP servers.

Grant only read tools. Built-in integration tools that change data don’t ask an approver before they run, and the agent’s instructions, not the platform, keep it read-only outside Slack.

Step 4: Create the automation

The automation has two triggers. A mention starts a session for its thread, and later mentions continue it. A weekday schedule starts the run that posts each digest due that day; a digest set up for a day the schedule doesn’t run never posts. Only mentions in the channels listed in routing.channelIds start a session, so list every channel where people ask IT for help, and the channel the digest posts in.

curl -X POST 'https://api.recursion.labelbox.com/managed-agents/v1/automations' \
  -H "Authorization: Bearer $RECURSION_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "displayName": "IT help desk",
    "agentId": "5f0c2a1e-8b7d-4c3a-9e21-6d4f0b9a7c55",
    "agentVersionId": "d8f25b1c-6e4a-4a93-b7c0-3f1e9d5a2c68",
    "environmentId": "9d3e7b52-1a4c-4f80-b6e9-2c8a5d0f7e13",
    "initialPrompt": {
      "type": "literal",
      "text": "You were started by a Slack mention or by a schedule. When a person mentioned you, read the thread, work out what they asked, and activate the matching skill: help-desk, access-requests, people-changes, or it-digest. When this is a scheduled run, activate it-digest and follow its scheduled-run procedure."
    },
    "triggers": [
      {
        "type": "slack",
        "triggerId": "3dc23fbf-b976-475e-abdf-ba0f280f6bb8",
        "enabled": true,
        "eventSourceId": "d2b8f6a4-3e17-4c95-a0d6-8b1e5f9c2a73",
        "events": ["app_mention"],
        "routing": { "workspaceIds": [], "channelIds": ["C0APQ7Z1K2M", "C0BQR8A2L3N"] },
        "botEvents": { "mode": "ignore" },
        "continuation": "resume_thread",
        "firstResponse": "platform"
      },
      {
        "type": "schedule",
        "triggerId": "6ca65f3d-49b8-4f41-a6be-86e9cf19167e",
        "enabled": true,
        "schedule": { "cron": "0 9 * * 1-5", "timezone": "America/New_York" }
      }
    ]
  }'

The automation starts paused. Resume it to let mentions and the schedule start runs. See Run, pause, and resume and Continue a Slack thread.

Step 5: Ask for help

In #it-help, post: @IT help desk my laptop can't connect to the VPN since this morning's update. It says "authentication failed".
The agent replies with the next step first, linked to the knowledge base article it came from, and asks what happened.
When two rounds of troubleshooting don’t fix it, or the fix needs admin access, it hands off following your Escalation setting, with what was tried and the exact error, so IT doesn’t ask again.

When several people report the same problem, the agent checks the vendor’s status page, posts one status in the thread, and updates the same message hourly until it’s resolved. It repeats or links other reports only from public channels that aren’t shared with another organization, and only into a thread that isn’t shared either. Each request is saved as requests/<thread>.json.

Step 6: Route an access request

Post: @IT help desk I need edit access to the Finance shared drive for the Q4 close, until 31 December.
The agent asks for anything missing, checks current access when an identity provider is connected, and mentions the approvers your Approvals setting requires.
When each approver says yes in the thread, it writes the exact change for IT, with links to the approvals and how each approver’s role was established. On the end date, it reminds IT in the thread to remove the access. In a channel shared with another organization, it doesn’t say what access someone other than the requester already has.

Step 7: Track an onboarding

In IT’s private channel, post: @IT help desk Priya Shah joins sales on Monday as an account executive reporting to Sam. Set up her onboarding.
The agent builds a checklist from your Standard apps setting or your onboarding article, posts it in the thread, and asks for any owner it can’t resolve.
It tracks each item to done with evidence, such as the identity provider showing the account active, and mentions an item’s owner when it stalls before the start date. An item outside your Standard apps setting that grants an admin role, production systems, or customer or financial data waits for the same approvals as an access request.

Offboarding works the same way, with the last day as the deadline for disabling sign-in. The agent handles a departure only in a private channel that isn’t shared with another organization. Slack tells the agent a thread’s channel only by id, and it confirms a channel’s privacy by looking up its name, so when the thread never names the channel, it asks once what the channel is called, without naming anyone. Mention the agent in your answer so it wakes. In a public or shared channel, or when it still can’t confirm the channel, it asks to move the request and says nothing else. Until an HR system shows a departure or role change, or someone whose HR or IT role an HR system, identity provider, or your settings show confirms it in the thread, the checklist is marked unverified and no removal goes to IT. Each checklist is saved as people/<thread>.json.

Step 8: Set up a weekly digest

In IT’s private channel, post: @IT help desk set up a Monday digest here.
The agent confirms the digest’s scope, saves it, and posts this week’s. Only someone the Escalation setting names can set up a digest, or someone else once a person it names confirms in the thread. When the setting names nobody, a digest can post only to a private channel. A digest never posts in a channel shared with another organization.

The digest has at most 15 items, under Urgent, Waiting on IT, Waiting on approvals, Recurring issues, and Volume. A digest reads a private channel’s requests only when it posts to that channel, and shows offboardings only as a count. The agent finds a channel’s privacy by its name, so a request whose channel it never confirmed counts only toward Volume in digests posted elsewhere. Post the digest in your help channel to list those requests. Each digest is saved as digests/<profile>/<date>.json.

What can go wrong

Symptom	Cause	Fix
A mention starts nothing	The automation is paused, the Recursion app isn’t in the channel, or the channel isn’t in the trigger’s channels.	Resume the automation, invite the app to the channel, and add the channel to the trigger’s `routing.channelIds`.
No checklist or digest appears, and the agent says it can’t post blocks	The Slack grant has `trigger_thread` access.	Grant the Slack connection with `workspace_tools` access and save a new version.
Answers are labeled as general suggestions	No knowledge base is granted, or it has no article for the problem.	Grant your help desk or wiki with its read tools (step 3), or write the article; the digest lists recurring issues that need one.
The agent says it can’t check current access	No identity provider is granted.	Grant Okta with its read tools, or add an MCP server for your identity provider (step 3).
A handoff mentions nobody	The Escalation setting names no IT contact.	Name IT’s Slack user group or channel in the setting and save a new version.

Get started

Account and access

Build agents

Coordinate multiple agents

Configure environments

Run and observe sessions

Manage agent context

Automate

Tutorials

Run an IT help desk agent in Slack

How it works

Step 1: Connect Slack

Step 2: Create the agent from the template

Step 3: Give it more to read (optional)

Step 4: Create the automation

Step 5: Ask for help

Step 6: Route an access request

Step 7: Track an onboarding

Step 8: Set up a weekly digest

What can go wrong

​How it works

​Step 1: Connect Slack

​Step 2: Create the agent from the template

​Step 3: Give it more to read (optional)

​Step 4: Create the automation

​Step 5: Ask for help

​Step 6: Route an access request

​Step 7: Track an onboarding

​Step 8: Set up a weekly digest

​What can go wrong

How it works

Step 1: Connect Slack

Step 2: Create the agent from the template

Step 3: Give it more to read (optional)

Step 4: Create the automation

Step 5: Ask for help

Step 6: Route an access request

Step 7: Track an onboarding

Step 8: Set up a weekly digest

What can go wrong