Generate Resolution Notes That Feed the KB

Tier: Foundation · Workflow area: Ticket handling & triage · ~20 minutes

Resolution notes are the cheapest knowledge capture that exists, because the investigation already happened. AI removes the last excuse — the ten minutes of writing — by drafting KCS-shaped notes from the work log you already have. Your job shrinks to verifying the commands and stripping the personal data.

When to use

• Every resolved incident that took real diagnosisanything where you learned something. The one-click password reset does not need this; the weird Outlook/automapping fix absolutely does.
• Recurring symptomsthe third ticket this month with the same shape is a flashing sign that the resolution note will become a KB article (see pb-15).
• Before you forgetat close, same day. A resolution note written from memory a week later is fiction with a confident tone.

When NOT to use

• Trivial, fully-documented closesif an existing KB article was followed exactly, the resolution note is one line: "Resolved per KB0001234." Linking beats duplicating.
• Workarounds you are not sure aboutif you do not know why it worked, say exactly that in the note ("workaround, root cause unknown") rather than letting AI backfill a plausible-sounding cause. A wrong cause in the KB propagates forever.

The recipe

1. 1.

   Keep an honest work log while you work. The recipe starts before the fix: paste commands and results into work notes as you go (the same habit as pb-04). Ugly is fine. "Tried X, no change. Tried Y, error Z appeared. Y + reboot fixed it" is gold; a blank activity stream is unrecoverable.

2. 2.

   At close, draft the note in KCS shape. Knowledge-Centered Service structure — Issue / Environment / Cause / Resolution — is the shape your future KB wants, so generate it now:

   Copy

   Convert my work log into a resolution note using KCS structure.
   
   Format:
   ISSUE: the symptom in the user's vocabulary — what they saw, not what it was
   ENVIRONMENT: product, versions, platform, relevant config (only what's in the log)
   CAUSE: the actual root cause. If my log does not establish root cause, write
   "Not confirmed — resolved via workaround" and do NOT invent one.
   RESOLUTION: numbered steps that fixed it, exact commands in fenced blocks,
   in the order that worked. Omit dead ends here.
   DEAD ENDS (internal): what was tried that did NOT work, one line each — this
   saves the next engineer from repeating them.
   
   Rules:
   - Only facts from my log. Mark anything uncertain as uncertain.
   - Keep commands verbatim. Never "improve" a command that worked.
   - Replace the user's name and machine name with <user> and <hostname>.
   
   Work log:
   [paste work notes / terminal history]
   

3. 3.

   Verify the commands — this is the non-negotiable step. Read every command in RESOLUTION against your actual terminal history. Models "clean up" commands: a flag gets normalized, a path gets genericized into one that does not exist, a Get- becomes a Set-. One way to keep yourself honest:

   Copy

   # Pull your actual session history to diff against the draft
   Get-History | Select-Object -ExpandProperty CommandLine | Set-Clipboard
   

   Copy

   # bash/zsh equivalent
   fc -ln -30
   

   If a step in the draft never appears in your history, it is invented. Delete it.

4. 4.

   Check the good-output shape. A resolution note that will actually feed the KB looks like:

   Copy

   ISSUE: User cannot open a shared mailbox in Outlook desktop; error "Cannot
   expand the folder. The set of folders cannot be opened." OWA works normally.
   ENVIRONMENT: Outlook for Microsoft 365 build 16.0.17531, Windows 11 23H2,
   cached Exchange mode, shared mailbox with FullAccess granted 2026-07-28.
   CAUSE: FullAccess was granted with automapping disabled; profile still held
   a stale automapped entry from a previous grant.
   RESOLUTION:
   1. Remove and re-add FullAccess with automapping enabled:
      Remove-MailboxPermission -Identity "AP-Invoices" -User <user> -AccessRights FullAccess
      Add-MailboxPermission -Identity "AP-Invoices" -User <user> -AccessRights FullAccess -AutoMapping $true
   2. Restart Outlook; mailbox appears within ~15 min.
   DEAD ENDS: profile recreation (no change); OST delete (no change).
   

   Notice what makes it reusable: symptom in user words, versions pinned, cause separated from fix, dead ends preserved, identity masked.

5. 5.

   File it where it compounds. Paste into the resolution field (not a work note — reporting and triage models read the resolution field). If your tool has Now Assist resolution-note generation, use it as the first draft and still run steps 3–4; vendor generators inherit every error the work log contains and add paraphrase drift on top. Tag the ticket kb-candidate if the symptom has recurred — that tag is the intake queue for pb-15.

Make it yours

• Freshservice/JSM shopsno native resolution generator? A browser-side snippet of the prompt plus copy-paste is fine; the KCS shape and verification habit are tool-independent.
• MSP / multi-tenantadd a rule: "replace client name with <client>; note the client-specific config that made this fix apply." The same symptom often has different fixes per tenant, and unlabeled notes cause cross-client mistakes.
• Teams with a personal-corpus habitappend the finished note to your own searchable solved-problems corpus (pb-19) as well; the team KB and your personal RAG feed from the same close-time discipline.

Quality check

• Command fidelityevery command in the note ran on a real system and did what the note claims. This is the single check that protects the KB's credibility.
• Cause honesty"Not confirmed" must survive editing. A KB seeded with invented causes trains both engineers and future AI assistants to be confidently wrong.
• Identity hygieneno usernames, hostnames, emails, or ticket-requester details in the note body; placeholders only.
• Two-minute readability testa colleague who never saw the ticket should be able to say what broke and how to fix it. If they cannot, the ISSUE line is written in your vocabulary instead of the user's.