n8n workflow · 13 nodes · Claude classifier + drafter

MSP Ticket Triage

Reading, triage, and first drafts handled. The dispatcher keeps every final call.

status running · private n8nrole designed + built end to end
view code ↗
MSP Ticket Triage: The workflow running on n8n. The security floor and the confidence check live in
The workflow running on n8n. The security floor and the confidence check live in parse and guard; human gate routes anything the model is unsure about to a person instead of a reply.
MSP Ticket Triage: Real executions from the 16-ticket production run, unedited. The green rows succ
Real executions from the 16-ticket production run, unedited. The green rows succeeded, one is parked Waiting on a dispatcher, and the red ones are the two failures that run surfaced: a transient API error and a parser bug. Both were diagnosed and fixed, and the retry and guard that came out of it are in the workflow above.
interactive · click and scroll itlive
One real run: phishing report in, P2 classification and a drafted reply out, security floor held.
What it solves

Triage eats 15 to 25 percent of a service desk's day, and the dangerous case is a calm-sounding security incident filed as routine. A 16-ticket production run through this workflow surfaced two real bugs: Sonnet sometimes prepends a thinking block, which broke a naive content[0].text parse, and burst traffic hit transient API 5xxs. The fixes now in the workflow: a text-block-only parser and retry at 3 attempts with 2-second backoff.

Who it serves

MSP or in-house service desks fielding mixed-severity ticket streams.

Who it is for

Dispatchers and Tier-1 techs who want the reading done but not the deciding.

How it works
  1. Ticket arrivesA webhook catches the inbound ticket and normalizes it into a clean shape.
  2. Severity floor, in codeAnything security-related is forced to P2 or higher before the model runs. A calm phishing report can never be filed low.
  3. Claude classifiesSeverity, category, confidence, and the matching runbook, with the reasoning attached.
  4. Claude drafts the replyA first response in the service-desk voice, specific to the ticket. Drafted, never sent.
  5. Dispatcher approvesOne signed link approves the send. Low-confidence tickets self-queue for a human instead.
  6. Everything logsModel, confidence, severity, and an SLA clock land in a ledger for every decision.
Built with
n8n Claude (Sonnet) webhook data-table ledger deterministic gate