SGA Internal · VP of AI Initiative · Portfolio 03

IT AI Agents
A specialized department, on a short runway.

Where we're taking SGA IT operations — framed, scoped, and mapped for the ThoughtPass demo.

SGA Dental Partners · Scott Guest
Prepared April 22, 2026 · For ThoughtPass Demo
Agenda
ThoughtPass Demo · 45-Minute Walk-Through · April 22, 2026

What we'll walk through together

The frame, the proof, the flow, and the loops. Then Claude Code goes live on Zoho tickets — the "intern" moment, in real time.

01
The Strategic Frame
From one-off AI projects to a repeatable AI workforce.
02
What's Already Working
Operation Daybreak + People's Index — proof points in flight.
03
AI Workforce Maturity Model
Intern → Associate → Assistant Manager → Manager → Department.
04
How It Works
Data flow · anatomy of an agent · the three IT agents.
05
The Three Loops
Feedback · self-improvement · self-healing.
06
Roadmap & Commitments
What ships in 30 days, what we're asking of IT, what's next.
SGA × IT · VP-of-AI Portfolio
02 / 11
01 · Strategic Frame
The shift — VP of Operations → VP of AI
From one-off AI projects to a repeatable AI system — one that governs, scales, and compounds.
Practices In Scope
265
One IT team · rising ticket volume · flat headcount
AI Agents Planned
3 +1
Triage, Health, Risk · plus Staffing (future)
Maturity Stages
5
Intern → Department · months, not years
Proof of Concept
Today
Claude Code + Zoho live demo · this session
What This Means
The goal is not "AI projects." The goal is an AI workforce — agents that take responsibility for a domain, learn from the humans around them, and compound over time. That requires governance, not one-offs.
Why IT Is Next
IT has the clearest data surface (tickets, logs, monitoring), the most repeatable decisions, and the strongest ROI per agent-hour. Two proof points already work. IT makes three.
SGA × IT · VP-of-AI Portfolio
03 / 11
02 · Proof Points
Two Systems Already Live · The Pattern Is Proven
Before IT, two AI systems were built in the same mold. Both work. Both compound.

Different domains, same architecture: ingest, recommend, act, learn. IT Agents is the third application of a pattern we've already shipped.

Proof 01 · Operations
OM Daily Report
codename · OPERATION DAYBREAK
Daily AI-written briefing — top actions per office manager, scored and fed back.
Practices / day
248
History depth
23d
Score domains
6
Status: Operational. Runs automatically every morning against Power BI, writes a one-page Morning Brief for each OM, and records whether the recommended actions moved the score. The feedback loop sharpens every cycle.
Proof 02 · People
People's Index
codename · TBD
Living scorecard — who to hire, develop, and part ways with, grounded in SGA ops metrics.
Scorecards
3
Gates live
5/6
Entities
4
Status: In build. Headcount / RIS / HIS scorecards unified into one cross-navigable system. Provider-level, location-level, region-level, network-level. Feedback captured from hiring and performance decisions.
What This Tells Us
The pattern works across domains. The build time per new agent system is shrinking — each one inherits infrastructure, patterns, and lessons from the last.
Why It Matters For IT
IT Agents won't start from zero. They'll reuse the same ingest-recommend-act-learn loop, and they'll compound alongside the other two.
SGA × IT · VP-of-AI Portfolio
04 / 11
03 · Maturity Model
AI Workforce Maturity · The Progression
Your AI team evolves the way your human team does — faster.

An intern needs supervision on one task. A department runs autonomously across many. An AI workforce can move through these stages in months.

Where We Are
01
Intern
"Look at this spreadsheet."
Single task. Tight supervision. Someone asks, AI answers. No memory, no cadence, no compounding value.
Today's Demo
02
Associate
"Handle related tasks."
Claude Code runs a few workflows with guidance. Today's live Zoho demo lives here.
Stage 03
03
Asst. Manager
"Own ticket triage."
Agent owns a domain end-to-end. Makes routing decisions, escalates edge cases, reports results.
Stage 04
04
Manager
"Coordinate domains."
Multiple agents working together. One's output is another's input. Shared memory, shared priorities.
Target State
05
Department
"Run IT ops."
A specialized IT agent team operating autonomously across 265 locations. Humans govern, don't execute.
Human-In-Loop
Autonomous
SGA × IT · VP-of-AI Portfolio
05 / 11
04 · Data Flow
How Data Moves Through The System
Data flows up. Agents synthesize. Tools stay where they are.

Five data sources stream into a normalization layer. Three agents read from it, coordinate with each other, and push decisions upward.

OUTPUTS AGENT LAYER INGESTION DATA SOURCES ROUTING DECISIONS tickets → right tech, ranked PREDICTIVE ALERTS failures before they page RISK FLAGS compliance gaps, exposure EXEC BRIEFINGS weekly rollup to leadership AGENT 01 Triage Classify · predict · route AGENT 02 Health Monitor Anomalies · predict · prevent AGENT 03 Risk Scorer Logs · access · exposure COORDINATION BUS — agents share findings in real time Ingestion & Normalization Layer streaming + scheduled · every source becomes uniform agent-readable events Zoho Desk TICKETING Monitoring UPTIME / PERF SIEM / EDR SECURITY Workday STAFFING Power BI ANALYTICS API · WEBHOOKS STREAMING · BATCH NORMALIZED EVENT STREAM SYNTHESIS CROSS-AGENT ACTIONABLE DECISIONS
Read The Diagram, Bottom Up
01 · Sources
Five existing tools — kept exactly as they are. Zoho, monitoring, SIEM, Workday, Power BI. No migrations, no replacements.
02 · Ingestion
Each tool's data gets normalized into a uniform event stream — agents speak one language, not five.
03 · Agent Layer
Three agents read the stream. They also talk to each other via the coordination bus — a security flag can change how Triage ranks a ticket.
04 · Outputs
Decisions leave the system as routing, alerts, risk flags, and briefings — pushed to the people and tools that act on them.
SGA × IT · VP-of-AI Portfolio
06 / 11
04 · Anatomy Of An Agent
One Agent, Zoomed In · How The Work Happens Inside
Every agent is the same shape: input, modules, memory, output, feedback.

Triage is shown. The other two agents have different modules — but the same architecture.

INPUT Zoho Ticket #4427 · Memphis TN "Printer offline · can't check in patients" via Zoho webhook AGENT 01 · TRIAGE (all agents share this shape) MODULE 01 Classifier Category: Hardware-Printer · Severity: P2 · Impact: Patient Flow MODULE 02 Ranker Urgency 8/10 · Queue position 3 · TTR estimate 45 min MODULE 03 Router → Maria (Field IT SE) · confidence 0.91 · rationale attached MEMORY past 18,400 decisions + outcomes feed every module above MEMORY → MODULES OUTPUT Routing Decision Assign → Maria Queue pos: 3 TTR: 45 min Confidence: 91% ↻ FEEDBACK → MEMORY
INPUT
A raw event arrives from any data source — a ticket, a metric, a log line. One event = one trigger.
MODULES
Each agent has 2–4 internal modules chained together. Triage: Classify → Rank → Route. Each reads Memory.
OUTPUT
A decision with a confidence score and rationale. Human can override. Every output is logged.
FEEDBACK
Whatever actually happened — ticket resolved in 30 min, escalated, reassigned — flows back to Memory and retrains.
SGA × IT · VP-of-AI Portfolio
07 / 11
04 · Agent Portfolio
Three Agents · One Architecture · Different Domains
The same anatomy, three different jobs.

Each agent follows Ingest → Decide → Learn. What differs is the data source, the modules inside, and the decisions it's empowered to make.

Agent 01 · Triage
Ticket Triage & Routing
INGEST
Zoho tickets — subject, description, location, reporter, device.
DECIDE
Classify severity & business impact, predict TTR, route to the right tech.
LEARN
Track routing accuracy and actual vs. predicted TTR. Learns which tech is fastest per category.
Data Sources
Zoho DeskWorkdayHistorical resolution
Agent 02 · Monitoring
Infrastructure Health Monitor
INGEST
Performance metrics from 265 locations — uptime, latency, resource usage.
DECIDE
Flag anomalies in real time, predict failures, recommend preventive action.
LEARN
Track whether predictions prevented outages. Precision & recall improve weekly.
Data Sources
Monitoring toolsAsset inventoryTicket history
Agent 03 · Security
Security Risk Scorer
INGEST
Logs, access patterns, vulnerability feeds across all locations.
DECIDE
Surface suspicious activity, compliance gaps, exposure ranked by location.
LEARN
IT triage decisions teach real risk vs. false alarm. Fewer false alerts monthly.
Data Sources
SIEM / EDRAccess logsVuln feeds
The Bonus Agent
IT Staffing Optimization — correlates Zoho volume against Workday headcount and skill mix. Surfaces "Location X has 40% more tickets than Y with same staff." Blocked on Workday integration.
Where We Start
Agent 01 (Triage) first. Cleanest data, clearest ROI, natural follow-on from today's demo. Agents 02 and 03 phase in once Agent 01 is trusted.
SGA × IT · VP-of-AI Portfolio
08 / 11
05 · The Three Loops
How The System Gets Smarter · Three Loops, Three Cadences
Every agent runs three loops simultaneously — each at a different speed.

Feedback (daily) corrects individual decisions. Self-improvement (weekly) sharpens the model. Self-healing (monthly) catches drift before it becomes damage.

Loop 02WEEKLY
Self-Improvement
The agent reads its own history and upgrades itself.
STEP 01 DECISIONS STEP 02 PATTERNS STEP 03 MODEL UPD. STEP 04 SHARPER SELF- IMPROVEMENT full model
Each week the agent reads ALL its past decisions + outcomes, finds new patterns ("Category X routed to Tech Y always re-opens"), and updates the ranking model itself. Day 30: decent. Day 90: sharp. Day 365: expert.
Loop 03MONTHLY
Self-Healing
The agent watches itself — and fixes drift before it costs you.
STEP 01 PREDICT STEP 02 OBSERVE STEP 03 DRIFT? STEP 04 RECALIBRATE SELF-HEALING drift correction
Agent compares its predictions against reality. If accuracy drops (new ticket category, changed vendor, unusual spike), it flags itself and triggers recalibration before anyone notices. No silent degradation.
Why This Matters For IT
Without these loops, an agent is a fancy classifier. With them, it's a teammate that improves alongside your team — and catches its own mistakes before production does.
What We Instrument Day 1
Loop 01 from launch. Loop 02 activates at Week 4 (needs 3+ weeks of labeled data). Loop 03 activates at Week 8 (needs baseline accuracy to detect drift). Non-negotiable — we don't launch loops that can't close.
SGA × IT · VP-of-AI Portfolio
09 / 11
06 · "We Already Have Tools"
The Only Objection That Matters · Answered Directly
The biggest pushback: "We already have software for this." Correct — and the agents sit above it.

This is the question every technical audience asks. It deserves a precise answer, not a defensive one.

What The Tools Already Do Well
Zoho, monitoring, and SIEM earn their keep
  • Zoho captures every ticket, assigns ownership, tracks SLA.
  • Monitoring catches uptime drops and performance anomalies at the host level.
  • Security tooling flags known IOCs, vulnerabilities, failed logins.
  • Workday is the system of record for staffing and skills.
  • Each tool is best-in-class within its lane.
What No Single Tool Sees
The coordinated pattern across tools
  • A security flag + perf dip + ticket spike at the same location in the same hour.
  • A tech who handles Category A 3× faster than Category B — and gets routed wrong.
  • A location where ticket volume correlates with falling patient satisfaction.
  • A recurring failure whose upstream cause sits in a different tool.
  • Any story that needs two data sources to see.
What The Agents Add
A coordination layer, not a replacement
  • Read every tool at once. Synthesize across them in real time.
  • Make decisions that require cross-tool context. Route, flag, predict.
  • Record the outcome of every decision and retrain on it.
  • Keep existing tools running. Nothing ripped out. Zero migration risk.
  • The value is emergent intelligence — not another dashboard.
The One-Line Answer
"We're not replacing your tools. We're making them smarter together than they are apart."
The One-Line Proof
"Operation Daybreak already does this for Office Managers across 248 practices. IT is next."
SGA × IT · VP-of-AI Portfolio
10 / 11
06 · What We're Building
SGA × IT Commitments · Next 30 Days
What we own, what we're asking of IT, and what's next.

Most of this list sits on the VP-of-AI team. A few small asks of IT — flagged clearly — so Agent 01 has the data surface it needs.

#What We're DoingOwnerTargetWho
1ThoughtPass demo — live Claude Code session against Zoho ticket data, today.VP of AITodaySGA
2Agent 01 (Triage) v1 — daily Zoho run, severity classification, routing recommendations, Loop 01 instrumented from Day 1.VP of AI + Claude4 weeksSGA
3Small ask: API access or scheduled export from Zoho Desk — whichever is cleaner for the IT team.IT Leadership1 weekIT
4Small ask: two weekly IT team members to rate Triage recommendations. 5 minutes a day — closes Loop 01.IT + SGAWeek 2Both
5Loop 02 (self-improvement) activates — Agent 01 begins weekly self-retraining on accumulated labeled data.VP of AIWeek 4SGA
6Loop 03 (self-healing) activates — drift detection online. Agent 02 (Health Monitor) scoping begins.VP of AIWeek 8SGA
MORE IN THE HOPPER — Agent 03 (Security Risk Scorer), IT Staffing Optimization (once Workday lands), and cross-agent coordination (Agent 01 output triggering Agent 02 attention) all scoped for Q3. Specifics at the next working session.
SGA × IT · VP-of-AI Portfolio · Growth Team
11 / 11
1 / 11