Build the Deflection Portfolio from Your Own Ticket Data

Tier: Advanced · Workflow area: Assistants & RAG · ~45 minutes

This playbook turns a raw ticket export and an LLM into a ranked deflection portfolio — the build order for everything your virtual agent does next. It is the difference between a bot with forty intents nobody triggers and a bot with ten intents that eat a third of your queue, which is exactly the discipline UC-47 describes.

When to use

• Before building or expanding any botevery intent you build should trace to a ranked row in this portfolio. No row, no build.
• You have 6–12 months of ticket historyenough volume that frequency rankings are stable and seasonal patterns (joiner waves, appraisal-season password chaos) are visible.
• Deflection has plateauedthe bot handles what it handles and the number stopped moving. The portfolio tells you whether the next win is a new intent, a KB gap, or a remediation script.

When NOT to use

• On someone else's dataindustry top-10 lists are marketing. Your mix of apps, users and seasons is the only dataset that predicts your deflection.
• When the export is garbageif 60% of tickets are categorized "Other" with one-line descriptions, run a month of triage discipline (pb-01) first; mining noise ranks noise.
• To justify deflecting the undeflectableoutages, security reports and grief-adjacent HR contacts appear frequent in exports; they are escalation material, and no resolvability score makes them bot food.

The recipe

1. 1.

   Pull the export with the fields that matter. Twelve months if you have them: number, opened date, short description, category, resolution code, resolution notes, reassignment count, resolve time. From ServiceNow:

   Copy

   curl -s -u "$SN_USER:$SN_PASS" \
     "https://yourinstance.service-now.com/api/now/table/incident?sysparm_query=opened_atRELATIVEGT%40month%40ago%4012&sysparm_fields=number,opened_at,short_description,category,close_code,close_notes,reassignment_count,calendar_stc&sysparm_limit=10000" \
     | jq -r '.result[] | [.number,.short_description,.category,.close_code] | @tsv' \
     > tickets.tsv
   

   Strip user names and any pasted secrets before the next step — the mining works on symptoms, not identities.

2. 2.

   Cluster contact types with the LLM, in batches. Categories lie; descriptions tell the truth. Batch 200 rows at a time:

   Copy

   You are analyzing IT support tickets to find repeating CONTACT TYPES —
   what the user actually wanted, not the category field.
   
   For the tickets below, assign each a contact-type label of at most
   6 words (e.g. "password reset after lockout", "VPN fails on home wifi",
   "request new starter laptop"). Reuse labels across tickets aggressively;
   invent a new label only when nothing fits.
   
   Output: ticket_number <TAB> contact_type. No commentary.
   
   Tickets: [paste batch]
   

   Then merge label variants in a second pass ("consolidate these labels; output a mapping table"). Expect 30–60 contact types from a year of tickets.

3. 3.

   Score resolvability per contact type, 0–3. Frequency alone builds the wrong bot. For each of the top ~25 types by count, read five sample resolution notes and score: 3 — resolved by a fixed procedure every time (self-service candidate); 2 — resolved by procedure with one branch point; 1 — needs human judgment or environment access; 0 — inherently human (approvals, outages, exceptions). Let the LLM propose scores from the resolution notes, but you confirm each one — this is the step where domain knowledge earns its keep.

4. 4.

   Rank by frequency × resolvability and cut at ten. A spreadsheet with four columns: contact type, 12-month count, resolvability, product. Sort descending. The top ten is your portfolio; print it. A typical desk finds password/MFA resets, VPN client issues, distribution-list membership, software installs from the approved catalog, and shared-mailbox access in the top ranks — but your list will surprise you at least twice, and the surprises are the point.

5. 5.

   Assign each row its deflection path. Three paths, chosen by resolvability and risk:

   • •
     KB article — resolvability 2–3, user can safely self-serve (client-side steps, settings, how-tos). Cheapest to ship; write it with pb-47's how-to recipe.
   • •
     Bot intent — resolvability 2–3 but users won't find or follow an article; the bot walks the dialog, gathers the variables, links or executes.
   • •
     Automated remediation — resolvability 3 and the fix is an action (unlock account, re-add to group, license assign). This path lands in pb-41's risk table and pb-43's matrix before anything executes.

   One row can take two paths — an article and an intent that delivers it — but every row gets an explicit decision, including "do not deflect."

6. 6.

   Estimate the ceiling honestly. Sum the 12-month counts of the ten rows, multiply by a sober per-path deflection guess (articles 20–30%, intents 40–60%, remediation 70–85% of that contact type), and you have the maximum tickets this portfolio can remove per year. That number — not the vendor's "up to 80%" — goes in front of management, and pb-44 measures against it.

7. 7.

   Ship in portfolio order and re-mine quarterly. Build row 1 end-to-end before touching row 2. Re-run the mining each quarter: contact types shift with every app rollout, and last year's number three may be gone.

Make it yours

• ServiceNow shopcross-check your LLM clustering against Predictive Intelligence similarity groups if licensed; build intents as Virtual Agent topics in portfolio order, and wire remediation rows to existing flows rather than new scripts where possible.
• Freshservice shopmine from the analytics export; ship article rows into the KB with Freddy article suggestions enabled, and build intent rows in the bot builder with the portfolio spreadsheet as the backlog.
• No-platform shopthe portfolio still pays without a bot: rows become KB articles, a self-service page ordered by your real top ten, and scripted remediations the desk runs in one click. Deflection is a coverage strategy, not a product SKU.

Quality check

• Every score has evidence. Each resolvability score cites at least five read tickets. A portfolio built from label guesses is intuition with a spreadsheet costume.
• The cut line is defended. Rows 11+ are explicitly parked, not quietly built. Scope creep in intents is how forty-intent ghost bots happen.
• Remediation rows route through governance. Any row assigned the remediation path appears in the pb-43 matrix before a single action ships.
• The ceiling estimate is written down. When pb-44's measurement disagrees with it later, you want the original arithmetic, not a memory.