Every service desk has the same quiet problem. Closure is a human act performed under time pressure, measured by volume, and reviewed by sampling — a few tickets a week, chosen more or less at random, long after the engineer has moved on. Everybody knows some closures are wrong. Nobody knows which ones, or how many, until the caller comes back.
This is the use case we usually show first on a service estate, because it needs nothing new from the client: no migration, no new channel, no change to how engineers work. It reads what the desk has already produced.
The morning check
Ten tickets sit in this week's resolved queue. The agent takes each one and checks the condition the ticket describes against the systems that would know: monitoring for the asset, logs for the service, the configuration record for what should be running where. Not the ticket's own claim that it was fixed — the state of the world the ticket was about.
Seven come back verified. The service is up, the error has stopped, the asset agrees. Those are safe to close, and the record says why.
The three that were not
Two of the remaining three are still live. The symptom the caller reported is still visible in the logs, just quieter. Left alone, these become reopens — and reopens are the most expensive tickets a desk handles, because they arrive angry and have to be diagnosed from scratch.
The third is the interesting one. The fix was real, but it was applied to the wrong asset — a sibling server with a nearly identical name. The ticket is closed, the caller's problem persists, and the configuration record is now wrong as well, because it claims the fix landed where it did not. One closure, two future incidents.
Each of the three goes to an engineer with the evidence attached: what was checked, what was found, and where. Nobody hunts through logs to reconstruct the reasoning, because the reasoning is in the ticket.
Why this one first
Three reasons. It is measurable on figures the desk already reports — reopen rate, repeat-caller rate, closure accuracy — so the before and after are not an argument. It touches no customer-facing channel, so the risk committee has little to object to. And it is honest about what the agent is: not a worker replacing the desk, but a checker standing behind it, catching the closures that sampling would never have found.
The desk keeps its people. The engineers keep the judgment calls. What changes is that "closed" starts to mean something.