Conversational ITSM Intelligence Agent
A multi-agent conversational platform that answers operational questions in plain English and automates root-cause analysis across incidents, changes, and problems.
The Problem
Engineering and support teams needed natural-language access to incident, change, and problem data scattered across a live ITSM system and its historical data warehouse, plus manual, time-consuming root-cause analysis linking failed changes to the incidents they caused.
Why Traditional Systems Failed
Generic chatbots lack ITSM domain context and the guardrails an enterprise support org needs. Naive LLM-to-SQL tools are unreliable for production data because they let the model both query and interpret data in one uncontrolled step, risking hallucinated numbers in executive-facing reports.
Multi-Agent Architecture
Built a multi-agent pipeline on Google's Agent Development Kit: a Router agent classifies intent, a deterministic Prompt Expander normalizes the request, an Understanding agent extracts structured parameters, a Generation agent drafts SQL or live API calls, a Review agent validates them, and only then does a pure-Python Execution stage run the query — with zero LLM involvement in that step, so data never round-trips through the model. A separate Reasoning agent turns validated results into narrative summaries, tables, and charts. Dedicated two-agent pipelines handle live incident and change-request lookups against the source ITSM system, with a self-correcting retry loop (up to three attempts) if generated SQL fails.
Interactive Architecture
Hover a node for detail · click to isolate its connections
Access & Security
Agent Pipeline
Data & Knowledge
Ingestion & Sync
LLMs handle understanding and narration only. SQL execution and RCA logic run in deterministic Python. BigQuery remains the system of record.
Key Capabilities
Secure Natural Language Querying
Lets users ask operational questions in plain English across incidents, changes, and problems.
Multi-Agent Reasoning Pipeline
Router, Understanding, Generation, and Review agents collaborate before any query touches production data.
Deterministic Data Execution
SQL and live API calls run in pure Python — the LLM never sees or touches raw data, only validated results.
Automated Root-Cause Analysis
5 Whys synthesis and change-caused-incident (CCI) detection automatically link failed changes to the incidents they caused.
Scheduled Enterprise Sync
Incident, change, and problem data syncs from the source ITSM system on a fixed schedule to keep the warehouse current.
What This Enables
- Faster incident context retrieval during outages
- Automated root-cause narratives instead of manual ticket archaeology
- Self-service operational insight for non-SQL stakeholders
- Executive-ready summaries generated directly from validated data
- Safer LLM adoption pattern: reasoning and narration only, never raw data handling
What This Is Not
- Not a generic AI chatbot
- Not an autonomous remediation system
- Not a replacement for the core ITSM system of record
- Not a system where the LLM ever executes queries against production data directly
Business Value
Democratized access to ITSM data for non-SQL users, automated root-cause synthesis that used to require manually cross-referencing incidents against recent changes, and gave leadership executive-ready narrative summaries instead of raw ticket exports.
Key Learnings
- Separating deterministic code from probabilistic LLM steps is the key reliability lever: schema injection, date parsing, and data execution stay in plain Python so numbers in reports are never model-generated.
- A self-correction loop on generated SQL (validate, retry, cap at a few attempts) meaningfully improves first-try accuracy without needing a human in the loop.
- Root-cause analysis features (5 Whys, causal linking between changes and incidents) deliver more perceived value than the query interface itself — teams cared more about "why did this happen" than "show me the data."