Stop 1 of 9 · Daily
Intake to triage
Turn a sentence like laptop is being weird into a ticket with a severity, a category and the three questions that actually unblock it.
What lands in the shared mailbox
Tariq's shared IT mailbox takes about thirty messages a day and almost none of them are tickets. They are sentences like "laptop is being weird again", screenshots with no caption, and forwarded threads where the actual problem is buried in the fourth reply. The first job is not fixing. It is turning that into a ticket: what broke, how badly, who is stopped, and the two or three answers he needs before he can even guess.
Triage is the part Claude does well and Tariq does slowly. Paste the message, get back a severity, a category, the questions to ask, and a reply that asks them politely. He reads it, changes a word, sends it. Four minutes becomes forty seconds, and the ticket in Atera starts life with a title someone can search next year.
Redact first, every time
Three things come out of a user's message before it leaves Outlook: credentials, one-time codes, and other people's data. Users hand over passwords constantly because they think it saves a step. MFA codes arrive the same way. Licence keys, a screenshot of an accounts payable screen with client names and amounts, a partial bank record in a log line: all of it stays behind.
| What you see | What you paste |
|---|---|
| "my password is Autumn2026" | "[password redacted, being reset]" |
| A six-digit code from an SMS | "[MFA code removed]" |
| A screenshot with client names and figures | Crop to the error dialog only |
| A log line with a user's home address | "[PII removed]" |
The rule is a habit, not a policy document. Read the message once with your finger on the delete key, swap what should not travel for a bracketed placeholder, then paste.
The triage prompt
You are triaging for the internal IT desk of a 60-seat accounting firm. Read the message below and return four things and nothing else. 1. Severity. P1 is several people stopped or data at risk, P2 is one person blocked, P3 is annoying but they can still work, P4 is a request rather than a fault. 2. Category, one of: account, hardware, network, application, printing, security, request. 3. The three questions I should ask first, ordered so that the answer to the first one changes what I ask second. 4. A reply under 100 words that asks those questions. Plain language, no jargon, no apology longer than one line. If something is missing that would change the severity, say which fact you are missing instead of guessing. [paste the user message with passwords and codes removed]
Below are the messages that came into the IT mailbox overnight, separated by five dashes. Give me one row per message: a title under ten words, severity P1 to P4, category, and the single question that unblocks it. After the rows, list any messages you think share one underlying cause and say what that cause would be. [paste the messages]
That second prompt is the one that earns its keep. Three separate "internet is slow" messages from the same floor stop being three tickets and start being one uplink to check.