01 the business
Law firm
110 staff, one in-house IT person
Locked accounts and access requests land on the firm's one IT person, or on a partner who knows the systems. People wait hours for simple fixes. Access is granted by whoever answers first, with no record of who approved it.
02 before
The problem
Locked accounts and "can I get access to the shared drive?" messages land on whoever knows IT best, often a manager doing it on the side. People wait for hours on simple fixes. Access gets granted by whoever answers first, with no record of who said yes.
- Simple fixes take hours.
- Access approvals are informal and unrecorded.
- The IT person is interrupted all day.
03 the build
What the AI does
- Step 1: Answers staff in Slack, Microsoft Teams or a phone line and works out whether they need a reset, a lockout cleared or new access.
- Step 2: Checks who the person is with a push prompt in Okta or Microsoft Entra ID before it touches any account.
- Step 3: Resets the password or clears the lockout directly and confirms the fix with the person in the same thread.
- Step 4: Turns access requests into a ticket in Jira Service Management or Freshservice and sends it to the app owner or line manager to approve.
- Step 5: Grants the access once approved and logs who asked, who approved and when.
paused: waiting for a person to approve
How it was put together
- Answered staff in Teams and worked out what they needed.
- Verified identity with a push prompt in the identity provider before touching any account.
- Reset passwords and cleared lockouts directly, confirming the fix in the same thread.
- Sent access requests to the app owner or manager for approval, then granted and logged them.
04 human in the loop
Where a person stays in charge
Any new access to an app, shared drive or admin role waits for the named app owner or the requester's manager to approve in Slack or Teams. Resets for admin accounts always go to a person on the IT side.
- No account is touched before identity is verified.
- New access always waits for the named owner's approval.
- Admin account resets always go to a person.
05 rollout
From kickoff to live in 4 weeks
- Week 1Map apps, owners and approval rules; connect the identity provider.
- Week 2Pilot resets and lockouts with one team.
- Weeks 3–4Add access requests and roll out firm-wide.
06 after
What changes
Staff get routine fixes in the chat tool they already use, at any hour. Your IT person stops being interrupted for resets, and every access decision now has a clear owner and a trail you can show an auditor.
Assume 110 staff raising 60 resets and lockouts a month at 10 minutes each, plus 40 access requests at 15 minutes each.
60 × 10 + 40 × 15 = 1,200 minutes, or 20 hours a month of IT time, plus the waiting time of everyone locked out.
What to measure
- Time to resolve resets and lockouts.
- Access requests with a recorded approval.
- IT interruptions per day.
- Requests escalated to a person.
07 evidence
What the research says
Third-party involvement in breaches doubled to 30%.
Verizon, 2025 Data Breach Investigations Report (opens in a new tab) · 2025
The global average cost of a data breach reached $4.99 million, a record high.
IBM, Cost of a Data Breach Report (opens in a new tab) · 2026
08 lessons
Mistakes to avoid
- Resetting without verification. Social engineering targets help desks.
- No named app owners. Approvals need someone accountable.
- Automating admin accounts. Keep those with people.
09 questions
Common questions
- Which identity providers does it work with?
- Okta, Microsoft Entra ID and Google Workspace.
- Can attackers trick it?
- It never acts on a claim of identity alone. It needs a push approval on the person's registered device.