Developer Handover Pack

Developer Handover Pack

Password Reset & Access Requests

Receives inbound requests from either the Slack slash command (/it-request) or the web intake form, classifies the request as a password reset or a new access request, extracts the relevant structured details (requester identity, system name, urgency), and creates a populated Jira ticket. Eliminates all manual reading, copying, and triage so that no human intervention is required at the top of the funnel. Complexity: Moderate.

// Input
slack_payload: {
  user_id: string,          // Slack user ID of requester
  user_name: string,        // Display name
  command: '/it-request',
  text: string,             // Raw request text from slash command
  response_url: string,     // Ephemeral reply endpoint
  trigger_id: string        // Used to open modal if needed
}
// OR form_submission: {
  requester_email: string,
  request_type: 'password_reset' | 'new_access',
  system_name: string,
  urgency: 'normal' | 'urgent',
  additional_notes: string
}

// Output
jira_ticket: {
  ticket_id: string,         // e.g. 'IT-4821'
  summary: string,           // Auto-generated from classification
  request_type: 'password_reset' | 'new_access',
  requester_slack_id: string,
  requester_email: string,
  system_name: string,
  status: 'Open',
  created_at: ISO8601,
  source_channel: 'slack_command' | 'web_form'
}

Handles two parallel verification paths based on the ticket's request_type. For password resets, it triggers an Okta identity verification challenge to the requester's registered MFA device or secondary email without any IT involvement. For new access requests, it sends the requester's direct manager a structured Slack message containing the ticket summary and one-click Approve or Deny buttons. Monitors for responses, sends a single automated reminder after 2 hours of no response, and escalates to the IT escalation queue after 24 hours. Records the outcome on the Jira ticket before handing off. Complexity: Complex.

// Input
jira_ticket: {
  ticket_id: string,
  request_type: 'password_reset' | 'new_access',
  requester_email: string,
  requester_slack_id: string,
  system_name: string
}

// On password_reset branch:
okta_authn_response: {
  status: 'SUCCESS' | 'MFA_CHALLENGE' | 'LOCKED_OUT',
  session_token: string | null,
  factor_type: 'email' | 'sms' | 'totp'
}

// On new_access branch:
azure_ad_manager: {
  manager_email: string,
  manager_slack_id: string,   // Looked up via Slack users.lookupByEmail
  manager_display_name: string
}
slack_approval_response: {
  action_id: 'approve' | 'deny',
  responder_slack_id: string,
  responded_at: ISO8601,
  ticket_id: string
}

// Output
verification_result: {
  ticket_id: string,
  outcome: 'verified' | 'approved' | 'denied' | 'failed' | 'timeout',
  method: 'okta_mfa' | 'manager_slack_approval',
  decided_by: string,        // email of approver or 'okta_system'
  decided_at: ISO8601
}

Executes the approved access change across Okta and Google Workspace, notifies the requester with a formatted Slack message, and closes the Jira ticket with a complete audit log entry. This agent only runs when verification_result.outcome is 'verified' or 'approved'. If the outcome is anything else, this agent does not execute and the escalation path handles the ticket. Complexity: Moderate.

// Input
verification_result: {
  ticket_id: string,
  outcome: 'verified' | 'approved',
  method: 'okta_mfa' | 'manager_slack_approval',
  decided_by: string,
  decided_at: ISO8601
}
jira_ticket: {
  request_type: 'password_reset' | 'new_access',
  requester_email: string,
  requester_slack_id: string,
  system_name: string,
  ticket_id: string
}

// On password_reset branch:
okta_reset_response: {
  reset_password_url: string,  // Temporary link sent to requester
  expires_at: ISO8601
}

// On new_access branch:
okta_role_response: {
  role_id: string,
  assigned_at: ISO8601
}
google_workspace_response: {
  group_email: string,         // Group the user was added to
  membership_status: 'ACTIVE'
}

// Output
audit_record: {
  ticket_id: string,
  action_taken: string,        // Human-readable summary
  okta_change: string,         // Role or reset reference
  google_workspace_change: string | null,
  approved_by: string,         // decided_by from verification_result
  approval_method: string,
  executed_at: ISO8601,
  jira_status: 'Done',
  slack_confirmation_sent: boolean
}

// ============================================================
// TRIGGER: Staff member submits Slack slash command or web form
// ============================================================
INPUT {
  source: 'slack_command' | 'web_form'
  user_id: string                   // Slack user ID
  user_name: string
  requester_email: string           // Resolved via Slack users.info if source=slack_command
  text: string                      // Raw request text
  trigger_id: string                // Slack modal opener (if needed)
}

// ============================================================
// AGENT 1: Request Intake Agent
// ============================================================
// Classification step
classify(text) -> request_type: 'password_reset' | 'new_access'
classify(text) -> system_name: string
classify(text) -> urgency: 'normal' | 'urgent'

// Dedupe check
GET /rest/api/3/issue/search?jql=project=IT AND status=Open
  AND reporter.email={requester_email} AND summary~{system_name}
-> existing_ticket_id: string | null
IF existing_ticket_id != null -> notify requester, STOP

// Jira ticket creation
POST /rest/api/3/issue
BODY {
  fields.project.key: 'IT'
  fields.summary: '[{request_type}] {system_name} - {user_name}'
  fields.issuetype.name: 'IT Request'
  fields.description: {text}
  fields.customfield_requester_email: {requester_email}
  fields.customfield_requester_slack_id: {user_id}
  fields.customfield_request_type: {request_type}
  fields.customfield_system_name: {system_name}
  fields.customfield_source_channel: {source}
}
-> ticket_id: string              // e.g. 'IT-4821'
-> jira_ticket_url: string

// HANDOFF 1->2: ticket_id, request_type, requester_email,
//               requester_slack_id, system_name

// ============================================================
// AGENT 2: Verification and Approval Agent
// ============================================================
IF request_type == 'password_reset' {
  // Okta MFA challenge
  POST /api/v1/authn
  BODY { username: {requester_email}, password: null }
  -> stateToken: string
  POST /api/v1/authn/factors/{factorId}/verify
  BODY { stateToken: {stateToken} }
  -> status: 'SUCCESS' | 'MFA_CHALLENGE' | 'LOCKED_OUT'
  -> sessionToken: string | null
  // Challenge link expires: 15 minutes
}

IF request_type == 'new_access' {
  // Resolve manager from Azure AD
  GET /v1.0/users/{requester_email}/manager
  -> manager_email: string
  -> manager_display_name: string
  // Resolve manager Slack ID
  GET /api/v1/users.lookupByEmail?email={manager_email}
  -> manager_slack_id: string

  // Send approval message
  POST /api/v1/chat.postMessage
  BODY {
    channel: {manager_slack_id}
    blocks: [Block Kit approval card with ticket_id, requester, system_name]
    actions: [{ action_id: 'it_approve' }, { action_id: 'it_deny' }]
  }
  // Wait for interactive callback (2hr reminder, 24hr escalation)
  <- slack_callback: { action_id, responder_slack_id, responded_at }
}

// Outcome written back to Jira
POST /rest/api/3/issue/{ticket_id}/comment
BODY { body: 'Verification outcome: {outcome} via {method} at {decided_at}' }

IF outcome IN ['denied','failed','timeout'] {
  // Transition ticket to 'Escalated', alert IT escalation channel
  POST /api/v1/chat.postMessage -> channel: '#it-escalations'
  STOP
}

// HANDOFF 2->3: ticket_id, request_type, requester_email,
//               requester_slack_id, system_name, outcome,
//               method, decided_by, decided_at

// ============================================================
// AGENT 3: Provisioning and Audit Agent
// ============================================================
IF request_type == 'password_reset' {
  POST /api/v1/users/{okta_user_id}/lifecycle/resetPassword?sendEmail=false
  -> reset_password_url: string
  -> expires_at: ISO8601
}

IF request_type == 'new_access' {
  // Okta role assignment
  POST /api/v1/users/{okta_user_id}/roles
  BODY { type: {mapped_role_for_system_name} }
  -> role_id: string
  -> assigned_at: ISO8601

  // Google Workspace group membership
  POST /admin/directory/v1/groups/{group_email}/members
  BODY { email: {requester_email}, role: 'MEMBER' }
  -> membership_status: 'ACTIVE'
}

// Slack confirmation to requester
POST /api/v1/chat.postMessage
BODY {
  channel: {requester_slack_id}
  blocks: [Block Kit confirmation card with action_taken,
           system_name, reset_password_url (if reset), next_steps]
}
-> slack_confirmation_sent: true

// Jira audit note + close
POST /rest/api/3/issue/{ticket_id}/comment
BODY { body: audit_note_string }  // action, system, approved_by, okta_ref, gws_ref, executed_at
POST /rest/api/3/issue/{ticket_id}/transitions
BODY { transition: { id: {done_transition_id} } }
-> jira_status: 'Done'

// ============================================================
// FINAL OUTPUT: audit_record persisted in Jira; requester unblocked
// ============================================================