> ## Documentation Index > Fetch the complete documentation index at: https://docs.getthread.com/llms.txt > Use this file to discover all available pages before exploring further. # Agents > The named agents you can build in Thread — what makes a job an agent, and every Magic Library entry a Flow can run unattended. An **agent** is a named job with a defined scope: a prompt that does one thing, the tools it's allowed to use, and a trigger that starts it without you. The entries here can all be started by a Thread Flow, which is what turns a skill into an agent. **The Flow action that runs these unattended is in beta.** **New Super Magic Agent** — the Flow action behind every entry tagged AgentBeta or Agent + SkillBeta — is enabled per workspace. If it doesn't appear in your Flow Builder, ask your Customer Success contact. This applies to the Flow trigger only. Running the same job by hand in Super Magic is generally available, and **Triage Agent**, **Reminder Agent**, **Intents** and **Voice AI** below are separate, generally-available products — not Super Magic Agents. **Looking for something specific?** Press `⌘K` (or `Ctrl K`) and search by the problem — "printer", "backup", "offboarding". To browse instead, use **By Category**, **By Connector**, **By Role** or **By Outcome** in the sidebar. ## What makes it an agent A **skill** is the work — a prompt that does one job well. An **agent** is that same skill with two things added: 1. **A trigger.** A [Flow](/inbox/flows) fires on a ticket event that matches your conditions, and runs the job with nobody watching. Flows are *event*-triggered — there's no schedule or timer — so an agent runs when something happens to a ticket, not at 9am. 2. **A write scope.** Because no one confirms each step, the write tools you check when you add the action become the agent's boundary. Leave them all unchecked and it's effectively read-only. See [Run it unattended in a Flow](/super-magic/meet-super-magic-your-ai-assistant-in-the-inbox). That's the whole difference. Every agent below can also be run by hand in Super Magic — which is how you prove one before you wire the trigger. | Tier | What it means | Availability | | ----------------- | --------------------------------------------------------------------------------------------------------------- | --------------------------------- | | **Agent** | A Flow runs it unattended on a matching ticket, via the **New Super Magic Agent** action. | Beta — per workspace | | **Agent + Skill** | Runs unattended in a Flow via **New Super Magic Agent**, and as a hands-on sweep across tickets in Super Magic. | Flow trigger beta; Super Magic GA | | **Skill** | You run it in Super Magic and confirm each write. There's no Flow trigger for this one. | Generally available | ## Agents you can build A starting set, spanning every surface that can run a job without a technician in the loop. Each one is a scoped job with a name — not one agent that does everything. | Agent | What it does | Starts when | Build it with | | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | **Triage Agent** | greets every incoming chat or email request, asks the right questions, and hands the technician a fully-prepped ticket | a request arrives by chat or email | [Magic Agents → Triage Agent](/ai-agents/setting-up-your-triage-agent-user-guide) | | **Service catalog Intents** | handles a specific request type end to end — asks its own questions, requests approval, and resolves without a technician | an incoming request matches the Intent | [Magic Agents → Catalog → Create Intent](/ai-agents/building-your-magic-agents-service-catalog) | | **Reminder Agent** | follows up with an end user when a thread stalls, then moves it to a post-reminder status if nobody replies | a thread goes quiet | [Magic Agents → Reminder Agent](/ai-agents/reminder-agent) | | **Voice AI Overflow agent** | answers the calls your team can't, takes an intelligent message, and creates the PSA ticket | a call overflows or comes in after hours | [Voice → Agents → Overflow](/ai-agents/voice-ai-setup-phase-2-overflow-after-hours) | | **Voice AI Attendant** | replaces the phone menu with a natural conversation that identifies the caller, opens the ticket, and routes the call | an inbound call | [Voice → Agents → Attendant](/ai-agents/voice-ai-attendant-modes) | | **On-call paging agent *(beta)*** | phones your on-call rotation in order and keeps ringing until a technician accepts the ticket | a Flow matches an after-hours escalation | [Flow → Call an On-Call Technician](/ai-agents/voice-ai-on-call-escalation) | | **Catchall agent** | identifies the client and contact behind an ownerless ticket and routes it to the right place | a Flow matches a ticket with no company | [Flow → New Super Magic Agent](/inbox/flows) · [prompt](/skill-library/triage-and-routing/catchall-routing) | | **QA agent** | reviews closed tickets against your own rubric and flags the ones that don't meet it | a Flow matches a ticket moving to closed | [Flow → New Super Magic Agent](/inbox/flows) · [prompt](/skill-library/qa-and-closure/ticket-qa-review) | | **First-touch agent** | triages a brand-new ticket — reads it, classifies it, and sets it up for whoever picks it up | a ticket is created | [Flow → New Super Magic Agent](/inbox/flows) · [prompt](/skill-library/triage-and-routing/ticket-triage) | | **Duplicate agent** | checks whether a new ticket duplicates something already open and merges it only on an exact match | a ticket is created | [Flow → New Super Magic Agent](/inbox/flows) · [prompt](/skill-library/triage-and-routing/duplicate-hunter) | | **Noise agent** | closes the tickets nobody needs to read — auto-replies, bounces, and monitoring chatter | a ticket is created | [Flow → New Super Magic Agent](/inbox/flows) · [prompt](/skill-library/triage-and-routing/noise-auto-close) | | **Alert storm agent** | merges a flood of monitoring tickets for the same underlying incident into one | a monitoring alert lands on a ticket | [Flow → New Super Magic Agent](/inbox/flows) · [prompt](/skill-library/triage-and-routing/alert-storm-merge) | | **Dispatch agent** | assigns and schedules the ticket by who has the expertise and the capacity | a ticket is ready to assign | [Flow → New Super Magic Agent](/inbox/flows) · [prompt](/skill-library/scheduling-and-dispatch/smart-dispatch) | | **Backup failure agent** | works a backup-failure alert through its runbook and escalates only what needs a human | a backup-failure alert lands on a ticket | [Flow → New Super Magic Agent](/inbox/flows) · [prompt](/skill-library/devices-and-infrastructure/backup-failure-triage) | | **Voicemail agent** | turns a voicemail into a properly-formed ticket with the caller, the client, and the ask | a voicemail arrives | [Flow → New Super Magic Agent](/inbox/flows) · [prompt](/skill-library/voice-and-messenger/voicemail-to-ticket) | | **VIP agent** | spots a VIP contact's ticket and gives it the priority and handling your agreement promises | a ticket is created or updated | [Flow → New Super Magic Agent](/inbox/flows) · [prompt](/skill-library/triage-and-routing/vip-priority-handling) | Want one that isn't here? Any of the Flow-triggerable entries below becomes an agent the moment you give it a trigger and a write scope. ## Agent Built for a trigger: a Flow fires them on a matching ticket and they do the job unattended. Reset a NinjaOne alert only after the condition is genuinely healthy, posting an explanation note first. Attended or embedded in a recovery Flow. Work APC UPS alerts: on-battery events, low runtime, self-test failure, or replace-battery indicators. Separate utility issues from UPS hardware faults. A client missed a scheduled appointment: log the no-show on the ticket, draft a courteous rebooking email, and apply the repeat-no-show policy on miss #3. Before firing an approval, check if the ticket submitter is the client's designated approver — if so, skip send\_approval and advance with an audit note. When note evidence shows an intent or external automation finished the work, verify and auto-close the ticket — abort if any human message arrives after. Detect automation-error signatures in notes — 4xx/5xx bodies, Jinja errors, webhook failures — flag the ticket and ping Teams so broken flows get noticed. Triage Auvik network alerts: separate device-down, interface-down, and config-change events, and use the topology map to spot cascades early. Triage an AV/EDR agent-offline alert — decide if the device is off or up with a dead agent, quantify unprotected time, and route on the protection gap. Triage Axcient x360Recover alerts: distinguish appliance vs Direct-to-Cloud failure families, verify retention, and state the last recoverable point. Classify a backup failure by alert text and device state, check for recurrence, and decide whether to fix locally or escalate to the backup vendor. Distinguish a backup that never ran (missed) from one that ran and errored (failed) — two different routes — and always state exposure via last-known-good. Triage a certificate expiry alert — tier urgency by days remaining, identify what the cert secures and who owns renewal, and route into renewal work. Flow that fires on Change Approval status: resolve the client's Change Approver and send\_approval with the change summary — note-and-stop if unresolved. Capture a live Messenger chat's context into a real ticket with title, description, contact, priority, and steps tried — no repeating for the user. At resolution, re-read the thread and correct the ticket's type/subtype/item and category to match the actual work, using only configured board values. Catch renewal and expiry notices in the service queue and route them to the right sales or account manager, retitled and moved with context attached. When a thanks-only client reply flips a resolved ticket back to open, revert it to the correct status per a fixed per-board map — the only permitted write. Work N-able Cove Data Protection backup tickets: classify the failure family, verify recoverability, and keep archive and retention sessions straight. Spot the same symptom appearing across multiple clients within a short window, flag a possible vendor or major incident, and propose a parent incident ticket. Work Datto BCDR alerts: screenshot-verification failures, local vs cloud sync lag, virtualization tests. Separate backup-ran from backup-boots and verify. Detect and close voice sessions that were dead air, instant hangups, or robocalls so they don't pollute the queue — human speech means it isn't dead air. Build a full ticket recap covering messages, notes, time entries, related sibling tickets, timeline, and current blockers — beyond the default summary. Work a device-offline alert or "won't connect" ticket — site-wide check first, maintenance windows, last activities, and clear escalate criteria. Triage a low-disk-space alert from any monitor — separate threshold noise from real pressure, read growth rate from history, rank consumer hypotheses. Work a disk-pressure alert or full-drive ticket — identify likely consumers from RMM signals and give the tech a safe cleanup sequence with a device link. Find tickets where a security- or configuration-impacting change (firewall, MFA, DNS, admin access) was made with no linked or matching documentation update. Parse raw email headers for a spoofing verdict: analyze authentication results, the received path, and spoof indicators with explicit confidence. Grammar and idiom cleanup for technicians writing in non-native English — "fix my English" or "mejorar ingles," technical content untouched. Draft the first-touch acknowledgment on a new ticket — what we understood, how seriously we're treating it, next steps, and when the client hears back. Replace a Flow's static "add note" text with an AI step that resolves the real owner and ticket context to compose a note with actual names and specifics. Triage a CPU or memory threshold alert — separate a transient spike from sustained pressure via history, and route servers versus workstations differently. Triage Hyper-V and VMware host alerts — datastore capacity, snapshot sprawl, CPU/memory pressure — deciding if the issue is host-level or VM-level first. Run the criteria check, declare or explicitly decline a major incident, assign incident roles, and start the comms clock from one declaration checklist. Configured clients require the designated approver to authorize work on every new ticket — fire send\_approval on intake, hold, and record the outcome. Classify NinjaOne condition and threshold alerts (offline, resource, service, patch, hardware, security) and route each class with a deep-link handoff. Figure out which device a ticket is about — from the person, their remembered devices, or a hostname in the thread — find it in NinjaOne, and drop the live device details and a deep link into the ticket so the tech starts with context. Triage a patch-failure alert — separate a one-off from a repeat offender, detect reboot-pending as the usual culprit, correlate against the patch window. On a priority change, if AI triage lowered a priority a human or client explicitly set higher, restore the higher priority — deterministic, restore only. When a ticket is converted to a project or moved to a project board, set the attribute that removes it from live inbox and queue views so dispatch is tidy. Generic Thread ↔ PSA reconciliation pattern (ConnectWise, Autotask, HaloPSA): rule out sync lag first, then move Thread to match PSA, never the reverse. Handle a quarantined email release request: verify the requester, assess why the filter caught it, and recommend release or refusal with reasoning. Triage a RAID degraded or failed-member alert with zero-margin urgency — one failure from data loss — and enforce the verify-backups-BEFORE-rebuild rule. When a new ticket subject starts with RE: or FW: on a recently closed subject, find the closed parent and flag it as a reopen instead of working new. Draft the closure email for a resolved ticket — what was wrong, what we did, how to reopen — built from the ticket's actual evidence, not memory. Take a ticket off the intake board end to end: send it to the right queue, assign the best-suited available technician, explain both choices with supporting docs, and log the time. Match a ticket against the desk's approved runbooks and post up to three runbook links as a single internal note — only when confident, otherwise nothing. Find "can we get on a call / book a time" requests hiding in recent tickets and route them to scheduling — skipping tickets where a tech has already engaged. Extract the text from a pasted screenshot — an error dialog, email, or app screen — translate it to English if needed, and summarize what it actually says. Restart a crashed Windows service via the RMM — allowlisted safe services only, state verified before and after, with a ticket note posted on completion. Resolve a ticket's site, look up the per-site approver from a documented mapping, and send the approval request to that contact — not one hardcoded name. Composite dispatcher skill: classify a new ticket, consult a routing matrix of tech specialties and client familiarity, then assign and schedule. Sweep recently resolved tickets for documentation-worthy resolutions like recurring fixes and vendor workarounds, ranking SOP and KB article candidates. Work Synology NAS alerts: degraded RAID or storage pool, disk-health warnings, full volumes, DSM updates. Treat a degraded array as near data loss. Draft the final "we're closing this ticket" email after three documented contact attempts with no client response — only when evidence exists. Dispatch a new ticket by support tier: classify T1/T2/senior, check that tier's technicians against today's schedule, then assign and book the work around the customer's deadline. Rewrite rough technician text into a polished, client-ready version — "write this nicely," "clean this up" — preserving every fact exactly. Work a typosquat or lookalike domain alert impersonating a client: gather registrar and DNS facts without visiting, gauge capability, draft a warning. Diagnose Veeam backup job failures: classify by taxonomy (VSS, credentials, repository, network), apply retry discipline, and state the last restore point. Check vendor status pages and outage reports for M365, ISPs, and SaaS apps, then post sourced findings to the ticket to confirm is it down for everyone. Identify the client and contact behind an unknown caller on a voice ticket with only a phone number, using number, name, and company clues from transcript. Turn a pasted call transcript into ticket action — extract caller, client, issue, and commitments, then create or update the ticket with a time entry. Convert a voicemail transcription into a ticket with a callback commitment — urgency read from what the caller actually said, not from tone guesses. Page the on-call engineer for a P1 via PagerDuty, tell the requester who was paged, and mirror the ack/resolve loop back to the ticket. Post ticket updates and escalations into Microsoft Teams channels — client shared channels, internal escalations channel, or per-board feeds. ## Agent + Skill Equally at home either way — wire one to a Flow for every matching ticket, or run it by hand as a sweep across a board. Collapse a burst of identical alert tickets fired within a few hours into the earliest ticket as parent, so a flapping monitor does not flood the queue. Classify a monitoring or security alert ticket and rewrite its title into the desk's standard format using a controlled vocabulary, with an internal note. Atera-synced desk playbook: ticket lifecycle, resolved-vs-closed nuance, contract types (retainer, block hours, monitoring, project), labor pricing. Set a ticket's priority from its title and description against the partner's own priority definitions — built for alert boards and intake flows. Read Autotask contract type at triage (recurring, block, retainer, T\&M, fixed) to label covered vs billable and add burn-down notes on hourly deals. Autotask queue model: queues are work pools, not workflow containers — route by moving tickets between queues with correct ownership semantics. Autotask SLA event model — First Response, Resolution Plan, Resolved — with clock-pausing statuses and breach-risk assessment for synced desks. Classify Autotask tickets with configured Issue Type + Sub-Issue Type pairs and ticket category/type — never invent classification values not in the board. Route catch-all tickets to the right board (NOC, procurement, security, help desk) by walking a prioritized keyword-and-signal rule list to a result. Identify the correct client and contact for a ticket that landed in a catchall or no-company mailbox, including forwarded mail and vendor alert routing. Check a ticket's closure note against the house standard — issue, cause, actions, outcome, confirmation — and draft the compliant version when it's short. Base skill defining how a skill behaves when an integration it wants isn't connected — do the job with what's native, name the gap, never fake the missing source. ConnectWise Manage triage: read the client's CW agreement type at intake and route or label the work as covered vs billable before anyone touches it. ConnectWise Manage multi-board desks: pick which board work belongs on and execute cross-board moves without losing status, classification, or history. ConnectWise Manage status mapping: align Thread statuses with CW board statuses, take safe transitions, reconcile closed-in-CW-but-open-in-Thread drift. Classify ConnectWise Manage tickets with the three-level Type → Subtype → Item taxonomy using only values configured on the board — never invented ones. Work dark-web and credential-exposure alerts: age stale exposures, document closure notes, and notify affected users with rotation guidance. When a ticket arrives with no contact, look up the company's documented default contact, confirm with a search, and assign under a confidence gate. Handle registrar expiry and renewal notices safely: verify the sender is the real registrar, confirm the expiry date, and route to the renewal owner. Check whether a ticket duplicates an existing open ticket for the same client, contact or asset, and symptom — and merge only on an exact reference match. Review tickets entering Escalation Requested status against the escalation checklist and bounce incomplete ones back to the tech with itemized feedback. Draft a polite, escalating follow-up when a client hasn't replied on a ticket — first nudge, second nudge, or final pre-closure attempt with tone. HaloPSA team and section routing: team selects the pool, agent selects the person, and unassigned-within-team is a legitimate state — not an error. HaloPSA SLA and priority interplay: priority sets response and fix targets within the client's SLA, and configured hold statuses pause the clock. HaloPSA transitions run through configured Actions, not raw status edits — pick the action that fires the right status, note visibility, and notifications. Walk a new ticket through the Incident, Request, or Problem decision tree and recommend a matching type, subtype, and item for consistent classification. Base skill for machine integrations: when an external system calls Super Magic and parses the reply, respond with only a raw JSON object matching schema. Kaseya BMS-synced desks: navigate the status/queue/location model, respect the service-desk vs projects split, and audit Thread ↔ BMS drift regularly. Work Kaseya Dark Web ID compromise alerts: parse alert anatomy (source, date, data classes) and run the age-and-notify lifecycle with a no-crack policy. Merge companion tickets that multiple monitoring tools opened for the same event on one device, folding them into a single parent within a time buffer. One-pass first touch on a new ticket: classify it, check duplicates, pull similar resolved tickets, and draft an acknowledgment for the tech to review. Close pure-noise tickets — bounce-backs, vendor auto-replies, thanks-only messages, reconnected offline alerts — behind independent stop conditions. Route a ticket to the least-loaded technician in the client's assigned service pod: read the pod from company record, load-balance, assign, and note it. Catch tickets closed on assumption without customer confirmation — work summaries treated as sign-off, closes minutes after last change — then reopen. When an incident recurs past threshold, create a problem/RCA ticket linking the incidents and documenting the workaround so the pattern gets a real owner. Base skill defining how a note or reply is written when it may sync to a PSA — plain text, internal vs client-visible, and what never goes in a permanent record. PSA internal-vs-external note semantics (ConnectWise, Autotask, HaloPSA) with a leak-prevention checklist — a wrong-visibility note goes to the client. Catch tickets one person opened for a colleague ("submitting this on behalf of Jane") and move the ticket's contact to the person the request is actually for — so it's attributed, notified, and reported against the right end user. Verify scheduled maintenance tickets (backup checks, patch cycles, monthly server reviews) carry real completion evidence and flag skipped cycles fast. Distribute incoming tickets fairly across a named technician roster in rotation, honoring exclusion rules — runnable unattended inside a Flow. Explain why a ticket thread received its sentiment score by citing the exact messages that drove it — no hand-waving, no re-scoring. Find tickets where the client replied but no technician responded within threshold — surface each with wait time, @mention the tech, and draft a reply. Close tickets from known-spam senders and patterns after verifying a human did not forward the message in for investigation or phishing analysis. Chase tickets stuck in a waiting status — re-send the pending approval or post the templated client nudge, never nudging twice inside one window. Syncro PSA-RMM idioms: tenant-configured ticket statuses, worksheets as embedded checklists, ever-running timer culture, and RMM alerts inside the desk. Grade a completed ticket against the closure rubric — resolution, classification, owner, time logged, title, client message — pass or bounce it back. Classify a new or unassigned ticket, gauge severity, catch duplicates, and route it to the right board, status, and priority for the queue. Base skill defining the output contract for any prompt or skill that runs unattended inside a flow, where the agent's entire reply is posted verbatim. Detect VIP contacts and VIP clients at ticket intake, apply the configured priority bump, and fire notify rules without letting VIP status skew triage. Assign a ticket to the tech with the best availability score — base capacity minus open tickets minus scheduled blocks — with math shown, runs in Flows. Base skill defining the gates that sit in front of any action that changes something — confidence bar, show-me-before-send, when-in-doubt-do-nothing, and never invent data. ## Related topics - [Configure Reminder Agent](/ai-agents/reminder-agent.md) - [Triage Agent Settings](/ai-agents/triage-agent-settings.md) - [Halo Agent Teams](/skill-library/psa-specific/halo-agent-teams.md)