Teams · IT & security
Agent Serve agents gather access lists, triage alerts and answer service desk tickets. Every change to an account or a device waits for a person.
Agent Serve, the AI workspace where teams build, deploy, and manage AI agents, gives IT and security teams agents for access reviews, alert triage, onboarding and offboarding and service desk tickets, connected to Okta, Microsoft Entra ID, CrowdStrike, ServiceNow and PagerDuty, with approval before any change.
At a glance
The problem it removes
Quarterly access reviews mean exporting users from every system into spreadsheets. Alerts arrive faster than analysts can read them, and the same password and access tickets come in every day.
Agents to build
Each agent is built in Agent Serve and works through the identity, endpoint and ticketing tools the team already has.
An Agent Serve Relay lists users and group members from Okta, Microsoft Entra ID and AWS IAM into a table and asks each manager to confirm or remove access.
An Agent Serve workflow reads new CrowdStrike alerts, adds host and user context, and drafts a case note with a suggested severity.
When a ServiceNow incident is created, an Agent Serve agent finds the matching how-to in the knowledge base and drafts the reply.
An Agent Serve Relay prepares the offboarding steps for a leaver across Okta and Microsoft Entra ID, and runs each one after approval.
An Agent Serve agent lists Microsoft Intune devices that fail a compliance policy and asks an admin before any sync, lock or retire.
Examples show what teams can build in Agent Serve. They describe patterns, not named customer deployments.
How it runs
Agent Serve gathers the lists and chases the answers. Managers decide who keeps access.
The Relay reads users and group members from each identity system.
Accounts land in a table by manager, with last sign-in and groups.
Each manager confirms or removes access, and removals wait for approval before they run.
The final table and the decisions are saved to Files for the auditor.
Integrations
Agent Serve connects to identity providers, endpoint and cloud security, on-call and ticketing tools.
Browse integrationsIn each tool
Agent Serve lists and updates users and group members, and can suspend or deactivate an Okta account once a person approves.
Leaver → suspend · needs approval
Agent Serve queries alerts, hosts, indicators and vulnerabilities, and updates alerts as analysts decide.
New alert → context added
Agent Serve creates, updates and resolves incidents and change requests, starting when an incident is created.
Incident created → reply drafted
Agent Serve reads frameworks, controls and tests and uploads documents as evidence.
Access review → evidence uploaded
Agent Serve lists devices, apps and compliance policies, and can sync, lock or retire a device after approval.
Lost laptop → remote lock · needs approval
Agent Serve sends audit and run data to Microsoft Sentinel, so the security team sees agent activity beside everything else.
Audit events → Sentinel
In the workspace
A Relay gathers access lists and chases each manager for a decision.
Knowledge bases hold security policy and runbooks, kept in sync.
A monitor alerts the team when a metric crosses its line.
Logs keep a trace of every run for the auditor.
In depth
Agent Serve Chat answers security policy questions from the knowledge base and links the passage it used.
The Agent Serve Relay audit view lists what each Relay did, what it was refused, and the rule that blocked it.
An Agent Serve admin can pause all Relays in the organization, with a reason, and turn them back on when ready.
Before and after
| Work | Before | With Agent Serve |
|---|---|---|
| Access reviews | BeforeExports from each system, merged by hand. | With Agent ServeA table built by a Relay, with each decision recorded. |
| Alert triage | BeforeAnalysts gather context for every alert. | With Agent ServeContext and a draft note ready when the analyst opens it. |
| Repeat tickets | BeforeThe same how-to typed again. | With Agent ServeDrafted from the runbook, with the source linked. |
Governance
Agent Serve can cap how often a Relay routine runs and turn it off after repeated failures, with a notice to its owner.
Relays never send email or book meetings without an approval, under any autonomy setting. An approval covers the exact payload the reviewer saw and expires if nobody decides.
Proposals, approvals, declines and executed actions are written to the workspace audit log, which admins can export.
Sign in through your identity provider with SAML 2.0 or OIDC, and provision people with SCIM.
Admin, write and read roles per workspace, plus permission groups that limit which models, blocks and integrations a team can use.
Run Agent Serve in your own cloud or data centre, next to the systems it reads.
Questions
An Agent Serve Relay treats account changes as writes, which need approval unless you delegate them. Most IT teams keep a person on every change.
Yes. Agent Serve can be self-hosted, and it supports SAML and OIDC single sign-on and SCIM provisioning.
Agent Serve logs every run block by block, and the Relay audit view lists permitted, refused and failed actions with the rule behind each.
Last updated
Enterprise access
Agent Serve is available to teams by invitation. Tell us what you want to build and we will set up your workspace with you.