--- title: How we built an AI IT assistant for an enterprise... description: Redpanda built an AI IT assistant that handles enterprise service desk requests inside Microsoft Teams. In its first week, it answered 36% of employee requests... canonical: https://daily.dev/posts/how-we-built-an-ai-it-assistant-for-an-enterprise-service-desk-0xvxadgkm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How we built an AI IT assistant for an enterprise service desk | daily.dev og:description: Redpanda built an AI IT assistant that handles enterprise service desk requests inside Microsoft Teams. In its first week, it answered 36% of employee requests... og:url: https://daily.dev/posts/how-we-built-an-ai-it-assistant-for-an-enterprise-service-desk-0xvxadgkm og:image: https://api.daily.dev/og/posts/0xvXADgkM.png og:image:alt: How we built an AI IT assistant for an enterprise service desk og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How we built an AI IT assistant for an enterprise service desk **[Redpanda](https://daily.dev/sources/redpanda)** · 10 min read · 0 upvotes · 0 comments ## Summary Redpanda built an AI IT assistant that handles enterprise service desk requests inside Microsoft Teams. In its first week, it answered 36% of employee requests on its own using existing knowledge base articles, without creating tickets or involving analysts. The assistant runs on the Redpanda Agentic Data Plane, which routes every model and tool call through an AI Gateway and a custom MCP server exposing only specific IT tasks. Writes use the employee's own account identity, Cedar policies restrict which tools each person can call, and Amazon Bedrock Guardrails scan prompts and responses. With audit recording enabled, security events follow the OCSF schema and publish to Redpanda topics. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I restrict what an AI agent's MCP server is allowed to do in an enterprise system? Build a custom MCP server that exposes only specific, narrowly scoped tasks, such as finding an article, reading a form, or creating an incident, rather than a general query tool over platform tables. Combine this with gateway-level authorization using Cedar policies that check caller, action, and resource before a tool call runs, so a forbid or unevaluated rule denies the request by default. _Teams scoping agent permissions for internal tools can track patterns like this on daily.dev._ ### How do you keep an AI agent from acting with more privilege than the employee who asked it? Have the agent use the employee's own authenticated account for every write, picked from an OAuth token vault isolated by tenant and user, so the agent can only do what that employee could already do themselves. A separate read-only service account handles verification lookups, and approvals required by the existing workflow, like manager sign-off, still apply regardless of chat confirmation. _Engineers designing identity-preserving agent integrations can follow this approach on daily.dev._ ### Which LLM guardrail backend does the Redpanda Agentic Data Plane use to scan prompts and responses? Amazon Bedrock Guardrails is the documented backend, used even when a different provider hosts the model itself. In that setup, the gateway sends conversation text to Bedrock for evaluation to detect or block disallowed topics, sensitive information, and prompt attacks, or redact sensitive output, so Bedrock's destination and region need to be included in any data handling review. _Developers evaluating guardrail options for agent platforms can compare approaches via daily.dev._ ## Similar posts on daily.dev - [Build an AI agent once and reuse it across teams](https://daily.dev/posts/build-an-ai-agent-once-and-reuse-it-across-teams-ouyvwviwr) · Redpanda · 1 upvotes · 0 comments - [Governing AI agents in production: Redpanda Agentic Data Plane](https://daily.dev/posts/governing-ai-agents-in-production-redpanda-agentic-data-plane-riajexr7p) · Redpanda · 0 upvotes · 0 comments - [How to prepare your company for the era of agentic ITops](https://daily.dev/posts/how-to-prepare-your-company-for-the-era-of-agentic-itops-d2ryn2vtu) · The New Stack · 0 upvotes · 0 comments - [Diving into the AI iceberg: What lies beneath your AI agents](https://daily.dev/posts/diving-into-the-ai-iceberg-what-lies-beneath-your-ai-agents-otguapsub) · Temporal · 0 upvotes · 0 comments - [Transforming work at Cisco with our internal AI assistant, purpose-built with security](https://daily.dev/posts/transforming-work-at-cisco-with-our-internal-ai-assistant-purpose-built-with-security-pe0luomvt) · Cisco · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#redpanda](https://daily.dev/tags/redpanda) [View this post on daily.dev](https://daily.dev/posts/how-we-built-an-ai-it-assistant-for-an-enterprise-service-desk-0xvxadgkm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How we built an AI IT assistant for an enterprise service desk","url":"https://daily.dev/posts/how-we-built-an-ai-it-assistant-for-an-enterprise-service-desk-0xvxadgkm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-we-built-an-ai-it-assistant-for-an-enterprise-service-desk-0xvxadgkm"},"datePublished":"2026-10-27T16:48:28.679Z","dateModified":"2026-10-27T16:52:35.955Z","description":"Redpanda built an AI IT assistant that handles enterprise service desk requests inside Microsoft Teams. In its first week, it answered 36% of employee requests...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2317a28a3791073c0ac2185f4f550df0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2317a28a3791073c0ac2185f4f550df0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Redpanda","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Redpanda","logo":"https://media.daily.dev/image/upload/s--1R2EIDcb--/f_auto,q_auto/v1769934743/logos/redpanda","url":"https://daily.dev/sources/redpanda"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-we-built-an-ai-it-assistant-for-an-enterprise-service-desk-0xvxadgkm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,mcp,redpanda","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Redpanda","item":"https://daily.dev/sources/redpanda"},{"@type":"ListItem","position":3,"name":"How we built an AI IT assistant for an enterprise service desk"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-we-built-an-ai-it-assistant-for-an-enterprise-service-desk-0xvxadgkm#faq","mainEntity":[{"@type":"Question","name":"How can I restrict what an AI agent's MCP server is allowed to do in an enterprise system?","acceptedAnswer":{"@type":"Answer","text":"Build a custom MCP server that exposes only specific, narrowly scoped tasks, such as finding an article, reading a form, or creating an incident, rather than a general query tool over platform tables. Combine this with gateway-level authorization using Cedar policies that check caller, action, and resource before a tool call runs, so a forbid or unevaluated rule denies the request by default. Teams scoping agent permissions for internal tools can track patterns like this on daily.dev."}},{"@type":"Question","name":"How do you keep an AI agent from acting with more privilege than the employee who asked it?","acceptedAnswer":{"@type":"Answer","text":"Have the agent use the employee's own authenticated account for every write, picked from an OAuth token vault isolated by tenant and user, so the agent can only do what that employee could already do themselves. A separate read-only service account handles verification lookups, and approvals required by the existing workflow, like manager sign-off, still apply regardless of chat confirmation. Engineers designing identity-preserving agent integrations can follow this approach on daily.dev."}},{"@type":"Question","name":"Which LLM guardrail backend does the Redpanda Agentic Data Plane use to scan prompts and responses?","acceptedAnswer":{"@type":"Answer","text":"Amazon Bedrock Guardrails is the documented backend, used even when a different provider hosts the model itself. In that setup, the gateway sends conversation text to Bedrock for evaluation to detect or block disallowed topics, sensitive information, and prompt attacks, or redact sensitive output, so Bedrock's destination and region need to be included in any data handling review. Developers evaluating guardrail options for agent platforms can compare approaches via daily.dev."}}]} ```