A support AI without a governance matrix is an incident on a timer, and a deflection number without a strict definition is marketing. This module writes the signable auto-resolve policy, measures deflection the honest way, makes the bot DPDP-compliant, and turns vendor evaluation into a two-week scorecard instead of a leap of faith.
Daniel leads a 14-person service desk at the Indian arm of an EU-headquartered manufacturer. In January his CIO forwarded him a vendor deck with a highlighted line — "our AI agents deflect 65.7% of tickets" — and a one-line email: "Why aren't we at this number?" By March, Daniel had deployed the vendor's agent on a pilot. The vendor dashboard read 68%. The CIO was delighted. Daniel was suspicious, because the desk's phones had not gotten 68% quieter.
So he instrumented it himself, using the strict definition this module teaches: a contact counts as deflected only if it was fully resolved with no human involvement and no reopen within 72 hours. He pulled a month of conversation logs and ticket data and reconciled. The vendor's 68% counted every conversation that ended without an in-channel escalation — including users who abandoned mid-conversation and called the desk (34% of "deflections"), users the bot pointed to an article that did not fix the issue and who raised a ticket the next day, and duplicate conversations from the same user retrying. The strict number was 34%. Almost exactly half the dashboard.
Here is the part that made it a career moment instead of a disaster: Daniel wrote the reconciliation up in a one-page memo — both numbers, the definitions behind each, and what would genuinely move the strict number (three missing KB articles, one broken escalation flow, one intent worth adding) — and sent it to the CIO before anyone else could. The CIO's reply: "First AI number from anyone I actually believe." The desk kept the bot, fixed the three articles, and the strict number climbed to 41% by June — every point of it real. That memo is Lab 13's artifact, and this module is everything behind it.
Module 6 left you with a warning: build nothing action-enabled before the governance matrix exists. Here is the matrix. It is a short, signable document — ITIL v5's AI-governance guidance (February 2026, with a dedicated ITIL AI Governance publication) now gives it an industry-standard frame, but the practitioner version fits on one page and predates any framework: for every action class, a written decision on autonomy, with logging and rollback duties attached.
| Action class | Autonomy | Conditions | Rollback duty |
|---|---|---|---|
| KB answers, status lookups | Auto | Grounded + cited only; refuse below threshold | n/a |
| Password reset | Auto | Identity verification passed; rate-limited; logged | Session revoke + alert on anomaly pattern |
| Ticket creation & routing | Auto | Human-triaged sample audited daily (Module 1) | Reassignment |
| Software/license requests | Auto up to pre-approved list | Cost cap; manager visibility | License reclaim |
| Access grants | Approval-gated | Named human approves; entitlement summary shown (Module 5) | Documented revoke path, tested |
| Device remediation | Allowlisted actions only | Module 5's agentic-RMM scope; weekly action-log review | Per-remediation rollback script |
| Data deletion, retention changes | Never automated | Human-only, two-person for bulk | n/a — which is why it is never |
| Comms to all staff / external | Never automated | Human approves every send (Module 8) | Impossible — which is why it is never |
Three properties make a matrix real rather than decorative. It is signed — by the desk lead and whoever owns risk, so that when the bot resets the wrong password, the question "who decided bots may reset passwords?" has a documented answer. It is enforced in configuration — every "never" row maps to an absent permission in the agent platform, not to a hope; the matrix and the platform's permission config are reconciled quarterly. And it is versioned — autonomy expands only with evidence (clean logs, audited samples), and every expansion is a new signed version. Lab 14 stress-tests your matrix against five scenario challenges; the assessment does the same.
The matrix's "never" rows are its most valuable rows. Anyone can list what AI may do; the governance act is writing down what it may not — before the vendor's roadmap webinar suggests otherwise.
Deflection is the support-AI industry's headline metric and its most inflated one. The spread of published numbers tells the story on its own:
The strict definition, one more time, because everything in this module hangs on it: fully resolved, no human touch, no reopen within 72 hours. Alongside it, three companion metrics keep the picture honest: abandonment (conversations where the user gave up — Module 6's distinction, now instrumented), reopen rate on bot-resolved contacts, and BSAT — satisfaction with bot interactions specifically, not desk CSAT diluted across channels.
The weekly loop that keeps the numbers true is support-AI observability: log every conversation, sample-review a slice weekly (the same discipline as Module 1's triage audit, pointed at your own bot), maintain a wrong-answer taxonomy, and feed corrections back into the KB and intents. Vendor dashboards under-report failure modes structurally — not from malice, but because the dashboard measures what the platform can see, and abandonment-then-phone-call happens outside it. Your instrumentation sees the whole desk; theirs sees the bot.
Reconcile, don't replace. The move is never "the vendor number is a lie" — it is Daniel's memo: both numbers, both definitions, the bridge between them, and the fix list. The first stance starts a procurement war; the second makes you the most credible voice in the room.
India's DPDP Act and its Rules — enforcement ramping through 2026, penalties up to ₹250 crore — cover the support desk's AI stack explicitly: chatbots, support agents, vector stores and prompt logs are all processing surfaces for personal data, and a support desk holds employee personal data by definition. For an EU-headquartered employer like Daniel's, GDPR obligations stack on top. The compliance workload is concrete and buildable:
Compliance here is a career asset, not overhead. No global competitor curriculum teaches DPDP-compliant support AI, and every Indian deployment needs someone who can write the annex. Being the engineer who can is Position 2 with a moat.
Every desk faces the vendor decision, usually armed with nothing but demos and the marketing deck's deflection claim. The countermeasure is a structured proof-of-concept with your own instrumentation — two weeks, trial tenant, and a scorecard the vendor does not control:
Decision input, not decision: the numbers go to the same memo format as Lab 13.
Four scorecard lines, every time: strict deflection on real pilot traffic; wrong-answer rate on your golden set (Module 6's asset, now doing procurement duty); escalation quality tested by scripted frustrated-user runs; and cost per strict resolution against your human-handled baseline. Add one non-technical line: vendor viability. The category is consolidating under your feet — Moveworks acquired by ServiceNow (December 2025), Aisera by Automation Anywhere — and an acquired vendor's roadmap is a question mark you should price in. A two-week POC with this scorecard has killed more bad purchases than any procurement checklist, and — run honestly — it has also justified good ones with numbers the CFO can audit.
The final governance discipline is deciding what to deflect from evidence rather than enthusiasm. Bot-for-bot's-sake deployments automate whatever the platform demo automated; real deflection programs start from your own ticket data. The method: mine 6–12 months of tickets and rank contact types by frequency × resolvability — how often it occurs, times how mechanically it can be resolved without human judgment. Then, per contact type, choose the cheapest sufficient deflection path:
The top-10 list with chosen paths is Lab 13's companion artifact and, for a lead like Daniel, the difference between "we deployed AI" and "we removed 4,100 contacts a year and can show which ones."
Governance and measurement are the same skill wearing two documents: the signable matrix decides what the AI may do, and the strict-definition metrics decide what it actually did. The vendor's 68% and Daniel's 34% were both computable from the same logs — the desk that writes the definitions, signs the matrix, and sends the reconciliation memo first is the desk that keeps its AI, its budget and its credibility.