AI at the IT Help Desk: Who Approves the Changes?
The OpenAI–ServiceNow expansion makes conversational IT workflows more tangible. A practical operating model for UK service teams starts with evidence, bounded actions and change ownership.
IT directors and service owners
5 min read
30 October 2026
2 sources
Retrieve
Scoped incident history
→Compare
Evidence + uncertainty
→Draft
Proposed update
→Approve
Service owner
→Record
Audit + recovery
Reading, recommending and changing a system require different permissions.
An agent that can update a record is useful only when the record remains a reliable account of who decided what.
- 01Start with incident investigation and proposed updates.
- 02Separate permission to read from permission to change a system.
- 03Measure resolution quality and reopened tickets alongside speed.
What changed this week
On 28 October, OpenAI and ServiceNow announced an expanded partnership, including an integration intended to let people investigate incidents, assess changes and update ServiceNow records from ChatGPT. The announcement describes intended capabilities; teams should check their own entitlement, rollout and configuration.
For a UK managed service provider, the opportunity is not just a faster answer. It is a single incident record that connects a customer report, similar historical incidents and a proposed next action without losing the service owner's judgement.
Make an incident record the boundary
Begin with read-only retrieval from an explicitly scoped queue. The assistant can produce a draft summary with links to the original incident, timestamps, affected service and uncertainty. A named operator checks the summary before it becomes part of the record.
Next allow low-risk record updates with a clear actor, before-and-after values and an undo path. Changes to production systems, privileged access or customer communications should follow the organisation's existing approval process. An integration is not a substitute for that process.
Design for the unhelpful answer
Historical tickets can contain outdated fixes, personal data and malicious or misleading text. Filter access by the requesting user's rights, treat retrieved content as untrusted, and test whether the agent distinguishes a suggestion from an approved change. Record source links and the model and tool version used for each proposed action.
Run a pilot against a representative set of resolved and difficult incidents. Compare time to first useful diagnosis, reopened tickets, incorrect suggestions, escalations and operator review time with the current process. A shorter response that creates more rework is a loss.
Use this before approving the work.
- 01Choose one queue and an accountable service owner.
- 02Define allowed reads, writes, approval points and rollback.
- 03Test conflicting, stale and adversarial ticket content.
- 04Review reopens and correction time before expanding access.
Research and references supporting this article. Interpretation and recommendations are Thalenor’s.
The managed-service-provider scenario and implementation recommendations are illustrative; the announcements do not establish independent performance results.
Published and reviewed on 30 October 2026. This article provides general technology and operational information, not legal, tax, medical or regulatory advice.