The two controls that limit the SuperIT agent, and who approves the rest
Two settings limit what the SuperIT agent does without a person: ticket automation decides which stages run on their own and where the SuperIT agent may write, and command policies decide which device commands run, are blocked, or wait for approval. Anything a command policy does not explicitly allow needs an engineer or admin to approve it.
For how the SuperIT agent works overall, see How SuperIT works.
How it works
Ticket automation: which stages run and where output goes
Under Settings → Ticket automation, an admin picks a ticket automation preset for each team:
| Preset | Runs automatically | Writes to the PSA | Contacts end users |
|---|---|---|---|
| None | Nothing | No | No |
| Balanced (recommended, the default for new teams) | Analysis, triage, investigation with device data | No. Results stay in SuperIT (SuperIT only). | No |
| Full | Analysis, triage, investigation with device data, end-user chat | Yes. Triage updates ticket fields; investigation adds an internal note. | Yes |
| Custom | What you choose | What you choose | What you choose |
By default, ticket automation writes nothing to your PSA. You can also stop automated triage from changing particular fields, such as the ticket summary. See Configure ticket automation.
Chats are separate from ticket automation. In a chat, including an end-user chat, the SuperIT agent can create tickets in your PSA and add notes to them so the work is recorded.
Command policies: which commands run
Every device command goes through your team's command policies before it is sent to the SuperIT RMM agent:
- Allow: the command runs.
- Deny: the command never runs, even if someone wants to approve it.
- Needs approval: the command waits for an engineer or admin.
- No matching rule: Needs approval.
SuperIT ships default rules (read-only diagnostics allowed, destructive commands denied); some are locked. Admins can add and change rules. Commands normally run as the signed-in user; running as SYSTEM needs approval, unless an engineer or admin has turned on Auto-approve in that chat. In an investigation, commands that need approval are gathered into one approval card per round. Workflow actions that run on a device follow their own authorization policy instead. See Command policies and approvals.
Who approves
| Situation | Who can approve |
|---|---|
| A chat with an engineer or admin | Admins and Engineers in the team, on the approval card in the chat. |
| An end-user chat | The end user is never asked. A command that needs approval is denied automatically, and if the SuperIT agent can't help without it, it hands the issue to your engineers with a summary. |
| An automatic ticket investigation (nobody in a chat) | Nobody, unless automatic command review is on for your team and approves the command. Otherwise the SuperIT agent skips commands that need approval and continues with what policy allows. |
| A chat with an engineer or admin, with automatic command review on | The AI reviewer can approve eligible commands, such as simple read-only diagnostics, without asking. Anything it doesn't approve waits for an engineer or admin. Automatic command review is rolling out to all teams. |
| A chat with Auto-approve turned on | Nobody is asked. New commands that need approval run straight away, including as SYSTEM. Only Admins and Engineers can turn this on. |
Command Approvals, in the account menu, lists command requests and their status. Approve or deny pending commands on the approval card in the chat.
What is recorded
- Each command the SuperIT agent runs on a device is recorded with the command, the device, who approved it and the result. Admins and Engineers see it on the device's Command history tab, and can see requests in Command Approvals.
- The SuperIT agent's actions on a ticket appear on the ticket in SuperIT, including triage results, investigation findings and recommended actions.
- SuperIT also keeps an audit record of every tool call the SuperIT agent makes.
What it's used for
- Start safely: on Balanced, the SuperIT agent triages and investigates but ticket automation writes nothing to your PSA and contacts nobody.
- Widen autonomy one step at a time: let triage update tickets, then allow end-user chat.
- Keep risky commands behind an engineer or admin with Needs approval, and block what must never run with Deny.
What it does not do
- Ticket automation does not override command policies. Even on Full, a command that needs approval is not run during an automatic investigation unless automatic command review approves it.
- Deny cannot be overridden by an approval, by Auto-approve or by automatic command review.
- End users can't approve commands, even on their own device.