Use case · IT and security operations
Agent Serve pulls accounts from your identity provider, flags what needs a decision, and drafts questionnaire answers from policy, with people deciding each step.
An IT and security operations use case for Agent Serve, the AI workspace where teams build, deploy, and manage AI agents: workflows pull accounts from Okta or Microsoft Entra ID for access reviews, answer security questionnaires from a policy knowledge base, and prepare change approvals from ServiceNow or Jira Service Management, with a person deciding at each step.
At a glance
The problem it removes
Every quarter someone exports accounts from the identity provider, splits a spreadsheet by manager and chases sign-offs for weeks. Security questionnaires with hundreds of questions land on the same few people, and change requests reach the approval board without the evidence attached.
Before and after
| Work | Before | With Agent Serve |
|---|---|---|
| Access reviews | BeforeA spreadsheet export split by manager and chased by email. | With Agent ServeAccounts pulled, flagged and grouped by manager in a table. |
| Questionnaires | BeforeOld answers searched by hand, questions emailed one at a time. | With Agent ServeAnswers drafted from current policy, each with its source. |
| Change approvals | BeforeRequests reach the board with evidence missing. | With Agent ServeEach request is checked for its evidence before approval. |
| Proving it happened | BeforeScreenshots and email threads gathered for the auditor. | With Agent ServeDecisions sit in a table, and every run keeps a trace. |
How it runs
Agent Serve gathers and flags the accounts. Each manager decides who keeps access.
A schedule starts the review on the first Monday of each quarter, and the Okta block lists users and their group memberships.
The accounts land in a reviews table, and rules flag leavers from the HR list, dormant accounts and privileged groups.
An agent groups the accounts by manager and writes a short note on why each flagged account needs a decision.
A Human step asks each manager to confirm or revoke, and the decisions are written back to the reviews table.
In depth
Agent Serve runs access reviews, questionnaires and change approvals from the same tables, policies and audit trail.
Agent Serve Chat answers a questionnaire question from the security policy knowledge base and links the passage it used, for a security lead to check.
A workflow column in an Agent Serve table runs on each account, adds the manager and the reason it was flagged, and leaves the decision column to people.
An Agent Serve workflow starts from a new change request in ServiceNow or Jira Service Management, checks the evidence is attached and waits for an approver.
The Agent Serve Activity audit lists workspace activity and exports as CSV, and log destinations can send audit logs to your own storage or monitoring tools.
What does the work
Okta, Microsoft Entra ID, SailPoint, ServiceNow and Jira Service Management blocks.
Scheduled and triggered workflows gather, flag and wait for decisions.
A reviews table holds every account, its flag and the manager’s decision.
Rules mark leavers, dormant accounts and privileged groups.
Security policies sit in a knowledge base for questionnaire answers.
Examples
Three recurring jobs IT and security teams run on Agent Serve, each with a person making the call.
An Agent Serve schedule lists accounts from Okta, flags leavers and privileged groups, and asks each manager to confirm or revoke.
An Agent Serve workflow drafts each answer from the policy knowledge base, checks it is supported, and a security lead approves the batch.
A new change request in ServiceNow starts an Agent Serve workflow that checks the evidence and pauses for the approver.
Examples show what teams can build in Agent Serve. They describe patterns, not named customer deployments.
Governance
Agent Serve keeps decisions with named people and leaves a record your auditors can follow.
Security and governanceAgent Serve access policies limit which blocks, models and integrations each permission group can use, on top of admin, write and read roles.
Agent Serve log destinations send workflow logs, audit logs and Chat history to Amazon S3, Azure Blob Storage, Datadog or an HTTPS webhook.
Sign in through your identity provider with SAML 2.0 or OIDC, and provision people with SCIM.
Admin, write and read roles per workspace, plus permission groups that limit which models, blocks and integrations a team can use.
Proposals, approvals, declines and executed actions are written to the workspace audit log, which admins can export.
Every workflow run records each block’s inputs, outputs and errors, so a reviewer can trace how a result was reached.
Run Agent Serve in your own cloud or data centre, next to the systems it reads.
Zero data retention with supported model providers, backed by your own provider keys and agreements or self-hosted models. Some provider features keep data by design, such as Gemini Deep Research, so they are outside zero data retention.
Use your organisation’s own model provider keys at organisation or workspace level.
Workflows run from a deployed version, so a change is reviewed before it reaches production runs.
Further reading
The deep dive models the time a security questionnaire takes and what changes, with every figure labelled.
Read the blogMost security questionnaires ask the same two hundred questions in a different order. Here is a workflow that drafts each answer from your own policies and past approved answers, and sends anything uncertain to the right expert.
Sales and security · 13 min readAccess reviews fail in the same way everywhere: managers approve long lists they cannot judge. This guide compares three ways to run them and when each one fits.
IT and security · 5 min readMost change approvals stall on missing rollback plans and test evidence, not on risk. These field notes answer the questions teams ask when they put an agent in front of the change advisory board.
IT and engineering · 6 min readQuestions
Not in this process. Agent Serve flags accounts and asks each manager to decide. A workflow only changes an account after a person approves, if you build that step.
Agent Serve has blocks for Okta, Microsoft Entra ID, SailPoint and AWS IAM Identity Center, and triggers for ServiceNow and Jira Service Management, among its integrations.
From your own policies in an Agent Serve knowledge base. Each answer links to the passage it used, and a security lead approves the batch.
Agent Serve supports SAML and OIDC single sign-on with SCIM provisioning, roles and permission groups, and an Activity audit that exports as CSV.
A team can start with the Agent Serve access review workflow and a reviews table, then add questionnaire drafting and change approvals.
Last updated
Enterprise access
Agent Serve is available to teams by invitation. Tell us what you want to build and we will set up your workspace with you.