KYNDRYL OPERATIONSCommand Centre
SYNTHETIC DEMO
PROPOSAL
BUSINESS VALUE
OPERATIONS & AUDIT
AGENTIC AI AUTOMATION FOR ITSM & SECURITY OPERATIONS

Evidence-led decisions.
Governed execution.

AI understands the ticket, retrieves precedent, plans the action and proposes the correct autonomy level. Governance decides. The platform executes, verifies, records and learns.

System of Record+ System of Action= Governed Resolution
AUTONOMY MIX

AUTO / APPROVE / HUMAN

Within policy
OPERATING TREND

Automation and SLA risk

14-week programme
TOWER LOAD

Ticket volume by tower

Month to date
CONFIDENCE

Evidence confidence trend

+4.8 pts
REAL-TIME CONTROL PLANE

Live Operations Console

Follow every in-flight ticket from intake to verified closure. All records below are synthetic and generated for the demonstration.

TicketTowerCurrent AgentModeCurrent StepSLAStatus
LIVE EXECUTION

No active run

Rollback: READY
Select a ticket or start a demo scenario to see deterministic execution.
SYSTEM HEALTH

Execution connectors

24 available
EVIDENCE WORKSPACE

Ticket Explorer

Inspect ticket context, classification, historical evidence and the executable plan in one traceable view.

MULTI-AGENT CONTROL PLANE

Agent Orchestrator

Specialist agents operate under one durable state machine. The orchestrator controls sequence, dependency, pause, retry, rollback and hand-off.

SEC0004482Geo-IP blocking request across security controls
Trace IDTRC-KYN-9A72F
Entra ID→Firewall→WAF→SIEM→Verification
POLICY BEFORE ACTION

Approval & Guardrails

Evidence informs the decision. Configurable Kyndryl policy determines the permitted level of autonomy.

APPROVAL REQUIRED
SEC0004482 · SECURITY

Block high-risk geo-origin traffic

P1

Security Operations requested a geo-IP block after correlated access attempts were identified. The plan affects perimeter firewall, WAF and SIEM watchlists.

12precedents
91.7%success rate
KB-SEC-042knowledge article
4,200users affected

AI proposed execution plan

  1. Perimeter controlsApply the approved geo-origin deny rule to the firewall policy.
  2. Application controlsSynchronise the equivalent WAF policy and validate propagation.
  3. Monitoring controlsAdd the indicator to SIEM watchlists, verify events and update ServiceNow.
Planned command preview
set rulebase security rules "GEO-RISK-2026-08" source-region ["RU","KP"] action deny log-end yes
ROLLBACK READYRemove GEO-RISK-2026-08 and restore prior policy revision r1842Validated against last known good configuration · estimated recovery 46 seconds
GOVERNANCE CHECK PANEL

Decision gate

Audit enabled
FINAL ROUTINGAPPROVAL REQUIREDHigh blast radius + mandatory approval category
CONTROLLED AUTONOMY

Automation Maturity

Autonomy is earned from evidence. Categories progress from Shadow to Assisted to Automatic, and can be demoted if precision deteriorates.

00BASELINEHuman-owned operation
→
01SHADOWAI observes and compares
→
02ASSISTEDHuman approves, AI executes
→
03AUTOMATICZero-touch within policy
CategoryCurrent ModePrecisionApproval RateDriftStatusNext Gate
MATURITY RAMP

Work distribution by automation stage

Illustrative
ENGINEERING EFFORT

Human effort required — Current vs AI Ops

Hours / month
CONTINUOUS LEARNING

Feedback becomes governed evidence

Queue 14
Human decision→Labelled event→Validation→Model version→Controlled promotion
SECURITY BY ARCHITECTURE

Security & Governance

Separation of decision and execution, short-lived privilege and immutable evidence keep every action controlled and reviewable.

Fail-safe by default
Identity & AccessEntra ID · MFA · RBAC · Segregation of duties
↓
PresentationEngineer · Approver · Tower Lead
OrchestrationDurable state · SLA · Agent control
IntelligenceClassification · RAG · Planning
GovernancePolicy · Risk · Blast radius · Deny-list
↓
Secrets BrokerShort-lived credentials
ExecutionLeast privilege connectors
AuditImmutable action trace
SIEM ExportContinuous evidence
↓
Kyndryl-controlled environmentTicket store · models · vector index · audit logs · configurable retention · encrypted at rest and in transit
SYSTEM OF ACTION

Integration Landscape

Approximately 24 connector patterns across the Kyndryl estate. Demo connectors simulate vendor-native calls; production integrations require validated access and testing.

Demo connectorProduction target
AGENT ORCHESTRATOR24connector patterns
Honest demo boundaryClassification, policy evaluation, orchestration, logging, ROI and state transitions run locally. External system actions are deterministic simulations until connected to approved Kyndryl instances.
EDITABLE ASSUMPTIONS

Business Value & ROI

Every assumption remains editable during the discussion. Outputs are illustrative and subject to due diligence against Kyndryl data.

Ticket volumes

Automation & effort

Cost, deployment & currency

Currency display uses the editable FX rate. Switching INR/USD changes presentation only, not the underlying economics.
Illustrative calculation based on selected assumptions. Final baseline will be validated during due diligence.
WORK DISTRIBUTION

AUTO / APPROVE / HUMAN

ENGINEERING CAPACITY

Capacity released over 36 months

NET BENEFIT

36-month cumulative value

TOTAL COST OF OWNERSHIP

Cost composition

2 + 12 WEEK PROGRAMME

Delivery Roadmap

Due diligence locks scope, evidence, infrastructure and acceptance gates before three four-week delivery milestones.

Total: 14 weeks
WEEKS 1–2

Due Diligence & Execution Planning

Validate ticket baseline, task groups, connector scope, ownership, infrastructure and UAT gates.

Scope and execution plan locked
WEEKS 3–6 · MILESTONE 1

Foundation & Core Automation

Ingestion, evidence, single-system planning, core guardrails, approvals, audit and Tier A activation.

Indicative backlog: 44 capabilities
WEEKS 7–10 · MILESTONE 2

Assisted Execution & Governance

Multi-system plans, blast radius, rollback, drift monitoring, extended connectors and Tier B activation.

Indicative backlog: 39 capabilities
WEEKS 11–14 · MILESTONE 3

Advanced Operations & Autonomy

Multi-agent orchestration, proactive remediation, controlled promotion and advanced operating insights.

Indicative backlog: 17 capabilities
100100-Feature Capability Backlog

Final prioritisation, sequencing and committed scope will be validated during the Due Diligence & Execution Planning phase. Feature counts are indicative planning inputs, not an unconditional commitment.

ENGAGEMENT

ThirdEye Data responsibilities

  • Platform design, development and customisation
  • Model training and precedent configuration
  • Connector implementation and validation
  • Deployment, UAT support and knowledge transfer
ENGAGEMENT

Kyndryl responsibilities

  • Infrastructure, access and platform owners
  • Historical ticket and action data under NDA
  • Approval policy and named decision owners
  • UAT participation and milestone acceptance
KyndrylThirdEye Data
CONFIDENTIAL · INTERACTIVE SOLUTION PROPOSAL

Kyndryl — Agentic AI Automation for ITSM & Security Operations

Proposed by ThirdEye Data

AI reads→understands→plans→governance controls→executes→verifies→learns
01 · EXECUTIVE SUMMARY

A system of action alongside the system of record

AI Ops reads incoming work, grounds decisions in Kyndryl’s resolution history, creates an executable plan and operates within configurable risk policy. ServiceNow remains authoritative; AI Ops performs governed action and writes every outcome back.

SYSTEM OF RECORDServiceNowAuthoritative ticket state, SLA and audit reporting
+
SYSTEM OF ACTIONAI OpsEvidence, planning, governance, execution and verification
02 · OPERATING CHALLENGE

The current model does not compound

~200,000tickets per year
~16,700monthly run rate
~4,000security/access per month
1 in 3L1 → L2 escalation
Linear cost scalingEvery increment of volume consumes more engineer time.
Knowledge concentrationReliable resolution logic sits in closure notes and expert memory.
Security queue riskDelay in consequential actions widens exposure.
24×7 coverageCapacity is funded against the clock, not only demand.
03 · AGENTIC AI ARCHITECTURE

Seven layers with explicit separation of duties

Presentation Command Centre · Approval Workspace · Ticket Explorer
Orchestration Durable state · SLA · Specialist agent control
Intelligence Classification · precedent retrieval · planning · verification
Governance Risk · blast radius · deny-list · approval · rollback
Integration ServiceNow · identity · cloud · security · VDI · collaboration
Data Ticket store · vector index · evidence · model registry
Security & Platform RBAC · vault · audit · encryption · Kyndryl infrastructure
04 · OPERATING MODEL

Governance determines autonomy for each action

AUTOHigh confidence, low risk, tested rollback, permitted blast radius.Password reset · account unlock · approved software
APPROVEAI prepares evidence and plan; a human approves before execution.Firewall · geo-IP · multi-system access · provisioning
HUMANPolicy retains human ownership for consequential or physical work.Privileged access · live incidents · decommissioning
05 · TICKET CATALOGUE

Coverage organised by operating domain

06 · INFRASTRUCTURE & GOVERNANCE

Deployed in a Kyndryl-controlled environment

Kyndryl usersSSO · MFA · RBAC
↓
AI Ops platformData store · models · audit logs · vector index · connectors
↓
Connected systemsNative API/CLI under least privilege

Ticket data, models, action traces and audit history remain within the controlled environment. Hosted reasoning may use minimised and redacted context where permitted; self-hosted alternatives can be used where policy requires.

07 · DELIVERY

Due diligence, then three governed milestones

W1–2Due diligence & plan
W3–6Foundation & core automation
W7–10Assisted execution & governance
W11–14Advanced operations & autonomy

The 100-feature capability backlog is an indicative planning basis. Final committed scope and sequence will be validated during due diligence.

08 · FULL APPROVED PROPOSAL

Complete 35-page proposal — source of truth

The interactive sections above provide the presentation story. The embedded document below is the complete approved Word proposal converted to PDF without replacing its wording, section order, tables or diagrams.

Complete proposal · Confidential · ThirdEye Data
09 · NEXT STEPS

Baseline first. Lock the plan on evidence.

  1. Confirm connector scope
  2. Share task-group details
  3. Confirm ownership structure
  4. Confirm infrastructure
  5. Provide historical ticket data
  6. Baseline and lock the plan
KyndrylGoverned Agentic OperationsThirdEye Data
TTEDRA