> ## Documentation Index
> Fetch the complete documentation index at: https://docs.labelbox.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Run an IT help desk agent in Slack

> Run an agent that answers IT questions with sourced steps, collects access requests and their approvals, tracks onboarding and offboarding checklists to done, and posts a weekly IT digest. It needs only Slack.

The **IT help desk** template is an agent for a company's internal IT, whether IT is one person or a service desk with a ticket queue. People mention it in Slack when they need help, and it runs on a weekly schedule for IT. It handles four jobs, each with its own skill:

| Skill | What it does | When it runs |
| - | - | - |
| `help-desk` | Triages a question or problem, answers from your knowledge base with linked steps, troubleshoots one step at a time, and hands off to IT with everything tried. Treats phishing, a lost device, or a compromised account as urgent, and checks vendor status pages for outages. | When someone asks for help |
| `access-requests` | Collects who needs what access, at what level, why, and until when. Checks current access when an identity provider is connected, gathers the approvals your policy requires in the thread, and writes the exact change for IT. | When someone asks for access, or to remove it |
| `people-changes` | Builds an onboarding, role-change, or offboarding checklist of accounts, access, devices, and licenses, and tracks each item to done with evidence before its deadline. Offboarding stays in private channels. | When someone joins, changes role, or leaves |
| `it-digest` | Posts a short digest for IT: urgent and stalled requests, approvals waiting, people changes due soon, recurring issues worth a knowledge base article, and the week's volume by category. | On the schedule, or when you ask |

A fifth skill, `slack-replies`, shapes every post: replies use Slack's layout blocks with the next step first, and a request that takes several steps shows a progress checklist in the thread.

The agent needs only Slack. Connect a help desk, an identity provider, a knowledge base, or an HR system, and it reads them too. In this tutorial, you set the agent up for a growing company, answer a problem, route an access request, track an onboarding, and set up a weekly digest. Setup takes about 15 minutes.

> [!NOTE]
>
> You need the Developer or Admin role in the organization; see [Organizations and roles](https://docs.labelbox.com/recursion/organizations-and-roles.md). You also need permission to install a Slack app in your workspace, or an existing Slack connection in Recursion.

## How it works

* **One session per request.** An automation starts a session when someone mentions the agent in a thread, and every later mention in that thread wakes the same session. While a request is open, the agent sleeps between checks and its own timer wakes it to follow up.
* **It reads everywhere, and acts only in Slack.** The agent never grants access, resets a password or MFA factor, unlocks an account, or locks or wipes a device. It writes the exact change in the thread for someone in IT to make. The only exception is a tool your organization added that asks an approver before it runs (see [Require approval before a tool runs](https://docs.labelbox.com/recursion/mcp-servers.md#require-approval-before-a-tool-runs)).
* **Security first.** It never asks for or repeats a password, a one-time code, or a key, and tells anyone who posts one to delete it and change it. Only the person who asks, by Slack user, can request access; a request for someone else needs that person, or an allowed approver, to confirm in the thread. Bots and members of another organization in a shared channel can ask for help but can't request or approve access. Slack doesn't tell the agent whether a member is a guest, so your **Approvals** setting is what keeps a guest from getting access.
* **Approvals in the thread.** An approval counts only as a reply in the thread from someone your policy allows, who is neither the requester nor the person getting access. Reactions don't count. The agent records how it knows each approver's role, from an HR system, an identity provider, your settings, or only the requester's word, and tells IT which approvals rest on the requester's word.
* **Departures and role changes are verified.** Nothing that disables or removes access for someone leaving or changing role goes to IT until an HR system record shows it, or someone your **Approvals** setting allows confirms it in the thread and an HR system, an identity provider, or your settings show that person's role.
* **Every fact has a source.** Steps link the knowledge base article they come from. A fix from general knowledge is labeled as general, not your company's procedure.
* **Graded against a rubric.** The agent's rubric checks sourcing, that it never handled a secret, that it only read outside Slack, and the rules of the skill the turn used. See [Outcomes](https://docs.labelbox.com/recursion/outcomes.md).

## Step 1: Connect Slack

> [tab] Console
>
> 1. In the sidebar, click **Integrations**, then click **Add integration**.
> 2. Choose **Slack**, and choose the workspace.
> 3. In Slack, invite the Recursion app to your IT help channel, such as `#it-help`, and to the private channel IT works in.

> [tab] cURL
>
> Connect in the console first, then list connections to get the ids you'll use later.
>
> ```bash theme={"theme":"css-variables"}
> curl 'https://api.recursion.labelbox.com/managed-agents/v1/integrations/connections' \
>   -H "Authorization: Bearer $RECURSION_API_KEY"
> ```

## Step 2: Create the agent from the template

1. On **Home**, under **Start from a template**, click **IT help desk**. The assistant asks four setup questions: who IT looks after, which jobs the agent takes on first, which IT systems you use, and where a request goes when it needs a person from IT. It rewrites the agent's settings from your answers and suggests the apps to connect. To skip the questions, click **Use defaults** under the template instead.
2. When asked, choose the Slack connection. The template grants it with `workspace_tools` access, which checklists and digests need.
3. Review the plan and approve it.

The agent's settings are the last lines of its system prompt: **You support**, **Focus**, **Work hours**, **Escalation**, **Approvals**, **Standard apps**, and **Apps**. Edit them on the agent's **Configuration** tab at any time. Set **Escalation** to the Slack user group or channel IT watches, **Approvals** to your access policy, and **Standard apps** to the apps and groups every new hire gets, then click **Save new version**.

The template's agent searches the web, which it uses for vendor documentation and status pages, and keeps a history of the records it saves.

## Step 3: Give it more to read (optional)

With Slack alone, the agent answers from vendor documentation, collects access requests and approvals, and tracks checklists whose evidence is posted in the thread. Each app you add gives it another source:

| Add | The agent reads |
| - | - |
| A help desk, such as Jira Service Management, Freshservice, ServiceNow, or Zendesk | Knowledge base articles for answers, existing tickets to link instead of duplicating, and ticket status for follow-ups and the digest |
| A knowledge base, such as Confluence, Notion, or SharePoint | Your own how-to articles and onboarding checklists |
| An identity provider, such as Okta | Whether someone already has an app or group, and whether a checklist's account item is done |
| An HR system, such as Workday, BambooHR, or HiBob | Start and end dates, titles, teams, and managers for people changes |

1. Connect the app under **Integrations** and allow only its read tools. See [Choose which tools agents may use](https://docs.labelbox.com/recursion/integrations.md#choose-which-tools-agents-may-use).
2. On the agent's **Configuration** tab, under **Integrations**, add the app, then click **Save new version**. See [Grant apps to an agent](https://docs.labelbox.com/recursion/integrations.md#grant-apps-to-an-agent).

Device management (such as Jamf, Kandji, or Intune) and identity providers other than Okta aren't built-in integrations. To let the agent read them, add your own MCP server for them with read-only tools; see [MCP servers](https://docs.labelbox.com/recursion/mcp-servers.md).

> [!WARNING]
>
> Grant only read tools. Built-in integration tools that change data don't ask an approver before they run, and the agent's instructions, not the platform, keep it read-only outside Slack.

## Step 4: Create the automation

The automation has two triggers. A mention starts a session for its thread, and later mentions continue it. A weekday schedule starts the run that posts each digest due that day; a digest set up for a day the schedule doesn't run never posts. Only mentions in the channels listed in `routing.channelIds` start a session, so list every channel where people ask IT for help, and the channel the digest posts in.

```bash theme={"theme":"css-variables"}
curl -X POST 'https://api.recursion.labelbox.com/managed-agents/v1/automations' \
  -H "Authorization: Bearer $RECURSION_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "displayName": "IT help desk",
    "agentId": "5f0c2a1e-8b7d-4c3a-9e21-6d4f0b9a7c55",
    "agentVersionId": "d8f25b1c-6e4a-4a93-b7c0-3f1e9d5a2c68",
    "environmentId": "9d3e7b52-1a4c-4f80-b6e9-2c8a5d0f7e13",
    "initialPrompt": {
      "type": "literal",
      "text": "You were started by a Slack mention or by a schedule. When a person mentioned you, read the thread, work out what they asked, and activate the matching skill: help-desk, access-requests, people-changes, or it-digest. When this is a scheduled run, activate it-digest and follow its scheduled-run procedure."
    },
    "triggers": [
      {
        "type": "slack",
        "triggerId": "3dc23fbf-b976-475e-abdf-ba0f280f6bb8",
        "enabled": true,
        "eventSourceId": "d2b8f6a4-3e17-4c95-a0d6-8b1e5f9c2a73",
        "events": ["app_mention"],
        "routing": { "workspaceIds": [], "channelIds": ["C0APQ7Z1K2M", "C0BQR8A2L3N"] },
        "botEvents": { "mode": "ignore" },
        "continuation": "resume_thread",
        "firstResponse": "platform"
      },
      {
        "type": "schedule",
        "triggerId": "6ca65f3d-49b8-4f41-a6be-86e9cf19167e",
        "enabled": true,
        "schedule": { "cron": "0 9 * * 1-5", "timezone": "America/New_York" }
      }
    ]
  }'
```

The automation starts paused. Resume it to let mentions and the schedule start runs. See [Run, pause, and resume](https://docs.labelbox.com/recursion/automations.md#run-pause-and-resume) and [Continue a Slack thread](https://docs.labelbox.com/recursion/automations.md#continue-a-slack-thread).

## Step 5: Ask for help

1. In `#it-help`, post: `@IT help desk my laptop can't connect to the VPN since this morning's update. It says "authentication failed".`
2. The agent replies with the next step first, linked to the knowledge base article it came from, and asks what happened.
3. When two rounds of troubleshooting don't fix it, or the fix needs admin access, it hands off following your **Escalation** setting, with what was tried and the exact error, so IT doesn't ask again.

When several people report the same problem, the agent checks the vendor's status page, posts one status in the thread, and updates the same message hourly until it's resolved. It repeats or links other reports only from public channels that aren't shared with another organization, and only into a thread that isn't shared either. Each request is saved as `requests/<thread>.json`.

## Step 6: Route an access request

1. Post: `@IT help desk I need edit access to the Finance shared drive for the Q4 close, until 31 December.`
2. The agent asks for anything missing, checks current access when an identity provider is connected, and mentions the approvers your **Approvals** setting requires.
3. When each approver says yes in the thread, it writes the exact change for IT, with links to the approvals and how each approver's role was established. On the end date, it reminds IT in the thread to remove the access. In a channel shared with another organization, it doesn't say what access someone other than the requester already has.

## Step 7: Track an onboarding

1. In IT's private channel, post: `@IT help desk Priya Shah joins sales on Monday as an account executive reporting to Sam. Set up her onboarding.`
2. The agent builds a checklist from your **Standard apps** setting or your onboarding article, posts it in the thread, and asks for any owner it can't resolve.
3. It tracks each item to done with evidence, such as the identity provider showing the account active, and mentions an item's owner when it stalls before the start date. An item outside your **Standard apps** setting that grants an admin role, production systems, or customer or financial data waits for the same approvals as an access request.

Offboarding works the same way, with the last day as the deadline for disabling sign-in. The agent handles a departure only in a private channel that isn't shared with another organization. Slack tells the agent a thread's channel only by id, and it confirms a channel's privacy by looking up its name, so when the thread never names the channel, it asks once what the channel is called, without naming anyone. Mention the agent in your answer so it wakes. In a public or shared channel, or when it still can't confirm the channel, it asks to move the request and says nothing else. Until an HR system shows a departure or role change, or someone whose HR or IT role an HR system, identity provider, or your settings show confirms it in the thread, the checklist is marked unverified and no removal goes to IT. Each checklist is saved as `people/<thread>.json`.

## Step 8: Set up a weekly digest

1. In IT's private channel, post: `@IT help desk set up a Monday digest here.`
2. The agent confirms the digest's scope, saves it, and posts this week's. Only someone the **Escalation** setting names can set up a digest, or someone else once a person it names confirms in the thread. When the setting names nobody, a digest can post only to a private channel. A digest never posts in a channel shared with another organization.

The digest has at most 15 items, under **Urgent**, **Waiting on IT**, **Waiting on approvals**, **Recurring issues**, and **Volume**. A digest reads a private channel's requests only when it posts to that channel, and shows offboardings only as a count. The agent finds a channel's privacy by its name, so a request whose channel it never confirmed counts only toward **Volume** in digests posted elsewhere. Post the digest in your help channel to list those requests. Each digest is saved as `digests/<profile>/<date>.json`.

## What can go wrong

| Symptom | Cause | Fix |
| - | - | - |
| A mention starts nothing | The automation is paused, the Recursion app isn't in the channel, or the channel isn't in the trigger's channels. | Resume the automation, invite the app to the channel, and add the channel to the trigger's `routing.channelIds`. |
| No checklist or digest appears, and the agent says it can't post blocks | The Slack grant has `trigger_thread` access. | Grant the Slack connection with `workspace_tools` access and save a new version. |
| Answers are labeled as general suggestions | No knowledge base is granted, or it has no article for the problem. | Grant your help desk or wiki with its read tools (step 3), or write the article; the digest lists recurring issues that need one. |
| The agent says it can't check current access | No identity provider is granted. | Grant Okta with its read tools, or add an MCP server for your identity provider (step 3). |
| A handoff mentions nobody | The **Escalation** setting names no IT contact. | Name IT's Slack user group or channel in the setting and save a new version. |