AI-Powered IT Operations

A public portfolio proof of concept showing how AI can reduce friction across end-user support, deskside and EUC engineering, and IT operations management. The design remains constrained by approved knowledge, permissions and human decision points.

Guardrail-first100% synthetic dataPublic portfolio v1.3

Portfolio demonstration
This site is a deterministic simulation of AI-enabled workflows. It is not connected to a live LLM, ServiceNow, Jira, Intune, a former employer or any production environment. All users, incidents, devices and metrics are synthetic.

The aim is to remove operational friction without adding another tool to the workflow.

The project is built around practical outcomes. These include fewer avoidable tickets, faster engineer preparation, better handovers, earlier problem detection, proactive endpoint review and less administrative work during major incidents.

Approved data→Guardrails and permissions→Recommendation / self-service→Human escalation when required

Illustrative self-service deflection

36.6%

183 of 500 synthetic sessions

Illustrative engineer prep target

~5 min

Demo assumption, not benchmarked

Recurring issue signal

+71%

Synthetic VPN incidents vs prior month

Endpoint review candidates

12

Human review only, no automatic refresh

Suggested 5-minute tour

About this project

Why it exists

To demonstrate practical AI use in IT Operations and EUC. The aim is to reduce repetitive work, improve preparation and surface useful operational signals rather than add a generic chatbot.

What production would add

Live platform integrations, identity and RBAC enforcement, audited tool permissions, approved enterprise knowledge, telemetry connectors, human approval workflows and production security controls.

End-User AI Self-Service

Approved KB troubleshooting for actions a standard user can perform. Privileged, ambiguous, unsupported or security-sensitive requests are escalated rather than improvised. In production this would normally sit inside the organisation's existing self-service portal.

No admin stepsKB grounded

AI Support Assistant Simulated AI

Safe demo scenarios

Normal self-service never asks for admin credentials, registry changes, elevated PowerShell, security-policy changes or recovery keys.

Knowledge grounding

Approved KB matches appear here once the user describes an issue.

Deskside / EUC Engineer Copilot

Combines the current ticket, synthetic endpoint telemetry, recent support history and approved knowledge into a concise diagnostic brief. The engineer remains accountable for technical decisions. In production the capability should appear inside the existing ServiceNow or Jira ticket view.

Read + recommendNo autonomous changes

Engineer queue Context ready

Ticket	User / Site	Issue	SLA	Status

Engineer Diagnostic Brief

Select a ticket to prepare the engineer brief.

Deskside Visit Preparation

Transforms the ticket and endpoint context into a pre-visit checklist so an engineer can arrive with likely spares, relevant history and approved first checks.

Engineer decidesSynthetic case

Selected field-support case

IncidentINC0012854

LocationSingapore · Level 18

IssueDocking station intermittently disconnects both external monitors.

DeviceDell Latitude 7450

DockDell WD22TB4

Related tickets2 in previous 60 days

Endpoint stateCompliant No active alerts

Visit Brief

Generate the brief before leaving the support area.

Operations Handover Assistant

Summarises open incidents, SLA risk, vendor dependencies, planned changes and watch items into a structured handover. Designed to reduce manual shift-report preparation.

SummariseNo ticket ownership changes

Open tickets

43

Across APAC synthetic queue

SLA risks

7

2 require attention < 60 min

Vendor dependencies

4

Awaiting external action

Changes tonight

2

One M365, one network

Operational input snapshot

Type	Reference	Current state
P1	INC004391	Intermittent iManage access affecting Hong Kong users. The application team is investigating.
SLA	INC004377	Executive laptop issue. 42 minutes remaining.
Vendor	INC004355	Printer fault. MPS vendor due tomorrow at 09.00.
Change	CHG001281	Microsoft 365 client update from 22.00 to 23.30 SGT.
Change	CHG001287	Tokyo switch firmware from 23.00 to 00.30 JST.
Trend	VPN	Ticket volume 42% above 30-day baseline.

Handover Draft

Generate a concise shift handover from the operational snapshot.

Ticket Trend & Problem Detection

Uses synthetic incident volumes and resolution outcomes to surface recurring issues, probable knowledge gaps and candidates for human-led problem management.

Detect patternsDraft only

Tickets analysed

650

Synthetic 30-day dataset

Recurring clusters

5

2 above watch threshold

Knowledge gaps

3

Suggested for KB owner review

Improvement opportunities

48

Synthetic model flags for review

Pattern Findings

VPN / Remote Access incidents increased 71%

84 tickets this month vs 49 prior month. 67% of the affected synthetic endpoints share the same recent Windows update window. This is correlation and not proof of root cause.

84 ticketsCorrelation detected

Teams microphone KB may be incomplete

31 incidents reference “microphone not detected.” Of 18 interactions using KB002, 6 still escalated. A repeated successful analyst step is to confirm the Windows default input device after docking or undocking. This step is not explicit in the current article.

KB reviewPattern from resolutions

Printer tickets concentrated at one floor

22 printer incidents came from Singapore Level 18, compared with 4 to 7 on comparable floors. Recommend checking shared-device health and vendor maintenance history.

Site concentration

Human Review Workspace

Select “Draft Problem Record” to prepare a human-reviewable draft.

EUC Device Health & Refresh Advisor

Prioritises endpoint review by combining age, warranty, support demand and health indicators. It does not automatically replace, retire or remediate devices.

600 synthetic endpointsRecommend only

Healthy

481

No immediate review

Watch

76

Monitor trend

Attention

31

Engineer review

Refresh candidates

12

Manager review

Priority device review list

Device	Site	Age	Tickets / 90d	Battery	Risk

Device Assessment

Select a device to see the evidence supporting the recommendation.

Major Incident Assistant

Maintains a clean incident timeline and drafts stakeholder communications from approved operational updates. Technical decisions and external communications remain human-controlled.

Summarise + draftHuman approval required

P1 Timeline, Synthetic Example

14.02

Monitoring alert triggered for application latency.

14.04

Service Desk receives first Hong Kong user report.

14.07

Incident declared P1. Incident bridge opened.

14.11

Application and infrastructure teams engaged.

14.18

Database latency identified as common technical symptom.

14.27

Application vendor engaged.

14.36

Workaround implemented and validation starts.

14.42

Service restored. Monitoring continues.

Communication Workspace

Generate an update or PIR structure from the approved incident timeline.

How This Fits Into Existing ITSM

The public site demonstrates the operating model. It is not intended to become another production page for engineers to check. A real implementation should place each capability inside the tools people already use.

Reduce context switchingEmbedded workflow

Production design principle
The AI service can run behind the scenes. End users, engineers and managers should normally interact with it through their existing ServiceNow, Jira or workplace experience.

👤

End User

Use the organisation's existing self-service portal. Approved knowledge, guided troubleshooting and escalation appear in the same channel employees already know.

Production placement
ServiceNow employee or virtual agent experience, or the Jira Service Management portal and virtual service agent.

🛠

Deskside and EUC Engineer

Show the diagnostic brief in the current incident or request. The engineer should not copy the ticket number into a second website or switch between separate tools.

Production placement
ServiceNow workspace component or Jira Forge issue panel using current ticket context.

📊

IT Operations Manager

Surface handover, trend and device insights in the operational workspace or dashboard. Links should open the relevant records in the source system.

Production placement
Existing ITSM workspace, dashboard or reporting experience with approved integrations.

Production interaction model

Existing ServiceNow or Jira interface→Permission controlled integration→Approved knowledge and permitted operational data→AI service→Recommendation, draft or approved action

POC compared with production

Capability	Portfolio POC	Production implementation
End user support	Standalone simulation	Embedded in the existing employee support portal
Engineer copilot	Standalone simulation	Panel or component inside the current incident view
Ticket context	Synthetic incidents	Current ITSM record retrieved within the user's permissions
Endpoint context	Synthetic device data	Approved Intune, CMDB or endpoint data exposed through controlled integration
Knowledge	Synthetic KB articles	Approved enterprise knowledge available to that role
Write back	Simulated only	Explicit permitted actions such as adding a draft summary or work note after human review
Authentication	None because all data is synthetic	Enterprise SSO, RBAC and platform permissions

ServiceNow example

Use UI Builder or workspace components to present assistance in the agent experience.
Read only the incident and related data permitted for the user or service identity.
Use approved APIs and ACL controls for permitted record access and write back.
Keep final ownership, privileged actions and sensitive decisions with authorised staff.

Jira Service Management example

Use a Forge issue context for a compact collapsible brief or an issue panel when richer content is needed.
Use Jira APIs only for the issue data and actions allowed by the configured scopes and user permissions.
Offer controlled actions such as opening approved knowledge or adding a reviewed summary.
Keep high impact decisions and privileged actions with authorised staff.

Enterprise AI Control Model

The same control approach applies across every module. The assistant gets only the access needed for the task and cannot expand its own scope or make high-impact changes.

Least privilegeHuman escalation

Permitted assistance

✓ Retrieve approved KB	Only content authorised for the current role.
✓ Summarise permitted data	Tickets, endpoint signals, alerts, changes and approved notes.
✓ Guide safe self-service	Standard-user actions that require no elevation.
✓ Classify and enrich	Categories, summaries, attempted steps and suggested routing.
✓ Draft operational output	Handover, problem draft, refresh recommendation, MI update.
✓ Escalate uncertainty	Low-confidence or sensitive cases go to people.

Not permitted

✕ Expand its own permissions	Prompt text cannot override RBAC or policy.
✕ Retrieve secrets	No passwords, recovery keys, tokens or admin credentials.
✕ Browse unrelated records	Role, user and case boundaries remain enforced.
✕ Execute privileged change	No access, policy, endpoint, firewall or backend changes.
✕ Invent unsupported fixes	No KB match or an ambiguous match leads to human hand-off.
✕ Make final high-impact decisions	Problem creation, device refresh, major incident comms and remediation require approval.

Decision boundary examples

Scenario	Assistant action	Human boundary
End user has Teams microphone issue	✓ Guide approved KB steps	Escalate if unresolved.
User asks for BitLocker recovery key	→ Create controlled hand-off	Authorised support performs identity verification and recovery process.
Recurring VPN incidents detected	→ Draft problem candidate	Problem Manager validates evidence and decides whether to open problem record.
Device scores as refresh candidate	→ Recommend review	EUC/asset owner approves refresh based on policy, budget and business need.
Major incident update ready	→ Draft stakeholder message	Incident Manager validates and sends.

How This Maps to Enterprise Platforms

The prototype is intentionally vendor-neutral. In production these patterns would use capabilities already available across ITSM, endpoint management, monitoring and collaboration platforms.

Conceptual mapping

Platform capability mapping

Prototype capability	Typical ServiceNow mapping	Typical Jira / Atlassian mapping	Typical Microsoft / EUC mapping
Engineer in-ticket assistance	Workspace or UI Builder component	Forge issue context or issue panel	Endpoint context supplied through approved integrations
End-user conversational self-service	Virtual Agent / Now Assist	Virtual Service Agent / Rovo	Copilot / Teams front-end as applicable
Approved knowledge grounding	Knowledge Management	JSM + Confluence knowledge base	SharePoint / approved enterprise knowledge
Ticket enrichment and routing	ITSM incident workflows / AI features	JSM request/issue workflows + Rovo	Graph / Power Platform integration where appropriate
Endpoint context	CMDB / Discovery / integrations	Assets / integrations	Intune / Defender / endpoint analytics
Operations handover / incident drafting	ITSM + Major Incident Management	JSM incident management	Teams / Copilot / monitoring integrations
Role and data boundaries	ACLs, roles, AI governance controls	Permissions, app/agent configuration	Entra ID, RBAC, Intune scope controls

What this prototype proves

Understanding of AI-enabled ITSM and EUC workflow design, including where assistance should sit inside existing tools.
Ability to define useful data inputs and operational outputs.
Awareness of access controls, auditability and human decision boundaries.
Focus on measurable service outcomes rather than chatbot novelty.

What it does not claim

It is not an official ServiceNow, Jira or Microsoft product.
It is not connected to a production environment.
It contains no real employer or customer data.
The current version does not call a live LLM. Responses and outputs are deterministic simulations of the intended operating model.