Lab 01 · Triage with a Verification Gate

Run a 60-ticket overnight dump through an AI classifier, then do the job that keeps you employed: design a defensible daily sample, catch every misroute and wrong priority the model produced — including two tickets engineered to fool it — and log each correction like an auditor.

Kavitha runs the 7 a.m. shift on a UK-retail service desk in Chennai. Since the account switched on AI triage, her queue arrives pre-categorised, pre-prioritised, pre-routed — and her manager's new question is not "how fast do you close tickets" but "how do you know the classifier got it right?" This lab is her answer, built end-to-end: classify the dump with an AI, then verify it with a sampling method you could defend to an auditor.

The classifier will get most of this dump right. It will also misroute an access request wearing a password-reset costume, call an in-office application timeout a VPN fault, under-prioritise a clicked phishing link, and file one outage as four separate tickets. Your artifact is not the triaged queue — it is the audit log proving you caught what the AI missed.

Time & tier

~60 minutes hands-on · Core tier (maps to module M1). $0 — any free AI chat (ChatGPT, Claude, Gemini, Copilot) plus a spreadsheet or plain text editor. No ITSM tenant required; if you have a Freshservice or ServiceNow developer instance, you can import the CSV, but the lab works entirely in chat.

Setup

Save the two blocks below as tickets.csv (concatenate them, one header). Columns: id,user,dept,subject,first_line. Do not study the tickets yet — a triage analyst sees the queue cold, and so should the classifier.

id,user,dept,subject,first_line
T-1001,R.Iyer,Sales,Password reset,Forgot my Windows password after leave
T-1002,A.Khan,HR,New joiner laptop request,Need laptop for joiner starting Monday
T-1003,S.Rao,Finance,Shared drive not opening,F: drive says location unavailable since 08:05
T-1004,P.Nair,Sales,VPN error 809,VPN fails from home with error 809
T-1005,V.Gupta,Ops,Printer offline 3rd floor,HP printer shows offline
T-1006,M.Das,IT,Install Visio,Need Visio for process mapping - manager approved
T-1007,K.Menon,Finance,Excel crashes,Excel closes when opening month-end workbook
T-1008,J.Thomas,Sales,Password reset,Locked out after 3 attempts
T-1009,L.Singh,HR,Onboarding portal access,Cannot see new-hire tab in portal
T-1010,D.Patel,Ops,Laptop very slow,Laptop takes forever - please fix
T-1011,N.Sharma,Finance,VPN asks for new token,VPN prompting for token after phone change
T-1012,T.George,Sales,Outlook password keeps prompting,Outlook asks for password repeatedly
T-1013,B.Reddy,Ops,Monitor flickering,Second monitor flickers then goes black
T-1014,S.Kaur,HR,Access to payroll folder,Need read access to Payroll-2026 folder
T-1015,R.Bose,IT,Teams mic not working,Mic works in Zoom but not in Teams
T-1016,A.Joshi,Finance,Password reset for SAP,SAP says my password expired
T-1017,C.Fernandes,Sales,Cannot login to anything since morning,Every app rejects my password since 09:00
T-1018,H.Mehta,Ops,Barcode scanner dead,Scanner not powering on at station 4
T-1019,G.Pillai,HR,How to set OOO,How do I set out of office in Outlook
T-1020,V.Kulkarni,Sales,VPN slow,VPN very slow on hotel wifi
T-1021,S.Ahmed,Finance,Request Power BI license,Need Power BI Pro for month-end dashboards
T-1022,E.DSouza,ExecOffice,Board pack won't print,CFO board pack not printing - meeting at 11:00
T-1023,M.Verma,Ops,Password reset,Standard reset please
T-1024,R.Chandra,IT,Disk space warning,C: drive shows red - 2GB free
T-1025,K.Bhat,Sales,CRM access for new rep,New rep needs CRM access same as mine
T-1026,P.Sen,HR,Email bouncing to one client,Mails to acme.co.uk bounce with 550 error
T-1027,A.Naik,Finance,F drive gone,Mapped drive F: disappeared from This PC
T-1028,T.Ali,Ops,Keyboard keys sticking,Keys sticking after a tea spill
T-1029,S.Murthy,Finance,Password reset please,I can log in fine but need access to the Finance shared mailbox
T-1030,D.Roy,Sales,Laptop battery dies fast,Battery drops 100 to 20 in an hour

T-1031,J.Mathew,HR,Adobe Sign license,Need Adobe Sign for offer letters
T-1032,N.Prasad,Ops,VPN error 812,Error 812 since my password change
T-1033,K.Menon,Finance,Excel crashing again,Raised this earlier today - still crashing
T-1034,R.Saxena,Sales,Phone MFA lost,New phone - cannot approve MFA prompts
T-1035,B.Nanda,IT,Server room AC alert,Temperature alert from server room sensor
T-1036,S.Iqbal,HR,Something wrong with email,Email behaving oddly - please check
T-1037,A.Rangan,Finance,Access to AP invoices folder,Need modify access for AP-Invoices share
T-1038,M.Cherian,Ops,Docking station no display,Dock shows no display on both monitors
T-1039,V.Anand,Sales,Reset Salesforce password,Salesforce has locked me out
T-1040,P.Lobo,Finance,Weird gift card email,Got odd email from CEO asking gift cards - clicked the link then closed it
T-1041,T.Hegde,HR,Printer toner,Toner low on the HR printer
T-1042,S.Rao,Finance,Still cannot open F drive,No update on my earlier ticket - F: still down
T-1043,R.Kapoor,Ops,Wifi drops in warehouse,Wifi drops near the loading bay
T-1044,D.Nayak,Sales,Need second monitor,Requesting a second monitor for my desk
T-1045,K.Swamy,Finance,Password reset,Reset for Windows login please
T-1046,A.Bora,IT,Patch reboot query,Laptop keeps asking to restart for updates
T-1047,G.Menezes,HR,Zoom account upgrade,Need a Zoom license for webinars
T-1048,S.Dutta,Ops,Label printer misaligned,Labels printing half off the sticker
T-1049,J.Kurien,Finance,Location is not available error,Error opening the finance share since morning
T-1050,M.Islam,Sales,Autocomplete gone in Outlook,Outlook stopped suggesting addresses
T-1051,N.Rao,Ops,VPN keeps disconnecting,I am in the office on wired LAN - the timesheet app logs me out every 10 minutes
T-1052,V.Shetty,HR,Password reset,Forgot my password after maternity leave
T-1053,R.Menon,Finance,Two approvals stuck in workflow,Invoice approvals stuck since yesterday
T-1054,B.Paul,Sales,Laptop fan noise,Fan is very loud on calls
T-1055,S.Grewal,Ops,Access badge not working,Badge not opening the warehouse door
T-1056,A.Pinto,Finance,Excel add-in disabled,Month-end add-in shows as disabled
T-1057,K.Nambiar,HR,How to recall email,Sent to the wrong person - how do I recall
T-1058,D.Sethi,Sales,Mobile email setup,Set up email on my new Android
T-1059,T.Varkey,Ops,UPS beeping,UPS under my desk beeping continuously
T-1060,P.Hari,Finance,VPN cert warning,VPN shows certificate expires tomorrow

Categories to use: Password/Account, Access Request, Network/VPN, Hardware, Software/How-to, Security Incident, Facilities. Priorities: P1 (major/security), P2 (VIP or business-deadline impact), P3 (standard), P4 (request/how-to).

Guided steps

Run the classification. Paste the full CSV into your AI chat with: "You are a service-desk triage classifier. For each ticket output: id, category (from this list), priority (P1–P4 with a one-clause reason), and assignment queue (L1-Accounts, L1-Network, L1-Hardware, L2-Apps, SecOps, Facilities). Flag any tickets that look like duplicates of each other or parts of one incident." Save the full output as ai-triage.md. Do not correct anything yet.
Design the sampling gate before you look at results. Write down, in audit-log.md, your sampling rule first: audit 100% of anything the AI marked P1 or Security, 100% of anything routed to SecOps or flagged duplicate, plus a random 20% of the remainder (every 5th ticket by id is fine). Committing to the rule before reading the output is what makes the audit defensible — you cannot cherry-pick your way to a clean report.
Hunt the incident the AI filed as separate tickets. Scan the whole dump (not just your sample) for tickets that share a symptom and a time window. Expected output: at least one cluster of 3+ tickets describing a single outage, which the classifier may or may not have linked. Record the cluster ids and what the single underlying incident probably is.
Audit your sample against the raw ticket text. For each sampled ticket, read the first_line yourself and answer: is the category right, is the priority right, is the queue right? The subject line lies on at least two tickets — the body is ground truth. Log every disagreement as a row: id · AI said · should be · why it matters.
Pressure-test the two most suspicious tickets. When you find a ticket where subject and body point different directions, ask the AI directly: "Re-read T-10XX. The subject says A but the first line says B — which field should drive classification, and does your original answer change?" Note whether it self-corrects or defends the wrong answer. A classifier that doubles down is a classifier you sample harder.
Check the priority traps. At least one ticket has a casual tone but a hard business deadline, and at least one has a routine-sounding subject but is a live security incident. Verify what priority the AI assigned to each, and correct with a one-line justification tied to impact, not tone.
Sweep for misroutes out of IT entirely. At least one ticket in the dump is not an IT issue at all. Confirm where the AI sent it and where it should go.
Write the corrections summary. Close audit-log.md with: total tickets, sample size and rule, errors found by type (wrong category / wrong priority / missed duplicate / missed incident / missed security), error rate in the sample, and the one sentence you would put in the shift-handover note.

Warning

The failure mode this lab exists to break is rubber-stamping — accepting the AI's queue because it looks plausible. If your audit log shows zero corrections, you have not audited; this dump contains at least eight deliberate errors waiting to be found.

Verify

ai-triage.md contains a category, priority and queue for all 60 tickets.
audit-log.md states the sampling rule, written before results were reviewed, and the rule covers 100% of P1/Security plus a fixed random slice.
The outage cluster is identified with at least three member ticket ids and a hypothesised single root incident.
Both subject/body mismatch tickets are logged with the corrected category.
The clicked-phishing ticket is escalated to P1/SecOps in your corrections regardless of what the AI said.
Every correction row includes why it matters (SLA, security exposure, user stranded), not just the relabel.

Self-grading rubric (pass = 7/10): sampling design stated before review (0–2) · outage cluster fully identified (0–2) · both engineered foolers caught (0–2) · security and VIP priorities corrected with impact reasoning (0–2) · handover sentence a shift lead could act on (0–2).

▸Answer key — open only after your audit log is writtenoptional deep dive — click to expand

The engineered foolers (both must be caught):

T-1029subject "Password reset please", body "I can log in fine but need access to the Finance shared mailbox". This is an Access Request (mailbox delegation, approval required), not a password reset. A classifier keyed on subjects files it Password/Account; auto-resolving it as a reset would do nothing, and granting mailbox access without approval is worse.
T-1051subject "VPN keeps disconnecting", body says the user is in the office on wired LAN and it is the timesheet app logging out every 10 minutes. Application session timeout → L2-Apps, not Network/VPN. Any VPN troubleshooting here wastes everyone's time.

The single incident filed as many tickets: T-1003, T-1027, T-1049 (and follow-up T-1042 from the same user as T-1003) all describe the Finance F: share being unavailable since ~08:00 — one incident, likely the file server or DFS namespace, deserving a linked major-incident record and one fix, not four queue entries.

Duplicates: T-1007 and T-1033 — same user, same Excel crash, re-raised the same day. Merge.

Priority traps: T-1040 (clicked a gift-card phishing link) is a P1 Security Incident — credentials potentially compromised, SecOps queue, regardless of the chatty tone; classifiers routinely file it as "spam question", P4. T-1022 (CFO board pack, meeting at 11:00) is Hardware by category but P2 by business impact — tone-based priority scoring marks it P3/P4.

Misroute out of IT: T-1055 (door access badge) belongs to Facilities/physical security. T-1035 (server-room temperature) is valid for IT but is an infrastructure alert, not an end-user ticket — it should page whoever owns the DC, at P2.

Ambiguity that needs a human question, not a guess: T-1010 ("laptop very slow") and T-1036 ("something wrong with email") cannot be honestly categorised from one line; correct handling is a clarification request, and an AI that confidently categorises them anyway is guessing.

Scoring: both foolers = 2 · outage cluster (≥3 ids) = 2 · T-1040 to P1/SecOps = 1 · T-1022 priority raised with reason = 1 · duplicate pair merged = 1 · T-1055 rerouted = 1 · ambiguity flagged as "needs question" = 1 · sampling rule pre-committed = 1. 8+/10 means your verification gate works.

Key Takeaway:

The AI triages sixty tickets in seconds; your value is the sampling gate that catches the four it got dangerously wrong — designed before you look, logged like an auditor, and defensible in one handover sentence.

© Anvi Innovate · BXUP — Be Exponentially Upskilled · BXUP is an independent learning platform, not affiliated with or endorsed by AWS, Microsoft, Google, NVIDIA, IBM, Salesforce, Databricks, Oracle or Anthropic. All trademarks belong to their respective owners. · bxup.in