A ticket comes in. The agent triages it.

Claude reads the ticket, sets severity and category, matches a runbook, and drafts the first reply. A dispatcher approves with one click. It never sends on its own.

inbound ticket

Crestview Dental · frontdesk · T-1002

Suspicious email from "Microsoft"

Got an email saying our mailbox is full and to click a link to keep receiving patient messages. Looks off. I did not click. Forwarding it here just in case.

↓

classification, by the agent

P2 security confidence 0.90 runbook: phishing report security floor held

↓

drafted reply · waiting for a dispatcher to approve

Thanks for flagging this and for not clicking, that was exactly the right move. Please don't click the link or enter any credentials, and leave your computer on as is.

We're pulling that message from all mailboxes now and checking sign-in activity over the last 24 hours to make sure nothing else needs attention. No action needed from you right now, we'll follow up once we've confirmed everything looks clean.

The Mindcore service desk

The severity floor is deterministic: anything security-related is forced to P2 or higher before the model runs, so a calm-sounding phishing report can never be filed as low priority. The reply is drafted, never sent, until a human approves. Every decision logs to a ledger with the model, the confidence, and an SLA clock.