AI in IT Support: Approval by the Four-Eyes Principle

An AI that is allowed to do everything is not support. It is a risk with a chat window.

As soon as an AI agent can run commands on the device, the most important question is no longer “What can it do?” but “What is it allowed to do on its own?” In SuperSupport, the answer has three parts: some things the agent does itself, some only with approval, and some never. Here is what that looks like in real chats.

What does the agent do itself?

Everything that only looks, plus harmless, reversible steps. From our agent's chats:

• “Which programs are using the most memory right now?” – checking processes.
• “How much space is left on the system drive?” – checking drives.
• “The printer isn't printing.” – listing printers, looking at the queue, sending a test page.
• “When was the computer last restarted?” – reading the uptime.

Reading does no harm. That is exactly why it is the agent's most common step. See What employees really ask IT support.

What needs approval?

Everything that changes the system. A real case: a wireless headset kept losing its connection at the docking station. The agent found that USB power saving was the likely cause. But it did not simply change the setting. The step changes the system, so it was submitted as an action. See Headset loses connection at the docking station.

Typical candidates for approval:

• Power and security settings,
• drivers and updates,
• registry changes,
• installations,
• services that affect other programs.

What does the approval look like?

As a card in the chat, not as a checkbox somewhere in the background. In SuperSupport it is titled “Approval required (four-eyes principle)” and shows:

• what is to be changed on the device,
• why,
• whether the action is reversible,
• how long the approval is valid,
• the concrete command that would be run.

Below it are two buttons: “Approve action” and “Reject.” If the time runs out, the approval expires. Nobody approves anything blindly, because the command is visible.

What does the agent never do?

Anything destructive, accounts, and infrastructure. A real chat: someone wrote “vssadmin delete shadows.” The command deletes all shadow copies, that is, the Windows restore points. This is exactly what attackers do before encrypting. The agent's answer began with “STOP. This is a high-risk command,” explained why, and asked about the actual goal.

In addition, there are areas the agent does not touch on principle:

• Passwords – see Why no password resets by AI,
• user accounts – see Why no user management by AI,
• firewall – see Why no firewall changes by AI,
• servers – see Why no server maintenance by AI.

Why not just automate everything?

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial

Because a mistake on the device costs more than an approval. An approval costs one click. A wrongly changed security setting can cost days, or trigger an incident. The four-eyes principle makes sure the AI is fast where it is harmless and careful where it matters.

And who decides what belongs where?

IT. For in-house and third-party software, IT describes in runbooks which checks and fixes are allowed and who has to approve. See Runbooks in IT support. Every step and every approval is recorded in the case. See Poorly documented IT tickets.

At a glance

• Category: On its own – Examples: Checking processes, drives, network, logs, printers; clearing the queue; Who decides: Agent
• Category: With approval – Examples: Power/security settings, drivers, registry, installations; Who decides: Human via approval card
• Category: Never – Examples: Destructive commands, passwords, accounts, firewall, servers; Who decides: Nobody; the agent declines

Try it yourself

How approvals feel in daily work shows on the first real case. SuperSupport can be tested for free and without a credit card, for internal IT teams and MSPs.

Frequently asked questions

What does the four-eyes principle mean for AI in IT support?

The AI is not allowed to carry out risky changes on the device on its own. It submits them as a concrete action, and a human (the employee or IT) approves or rejects it. Only then does anything happen.

What may the AI do without approval?

Check and read: processes, drives, network, logs, printers, installed programs. Plus harmless, reversible steps such as clearing a print queue or ending a frozen program after asking.

What needs approval?

Everything that changes the system or is hard to undo, such as power or security settings, drivers, the registry, installations, or services that affect others.

What does the AI never do?

Destructive commands such as deleting all restore points, plus password resets, user accounts, firewall, and servers. It declines such requests and explains why.

What does an approval look like in SuperSupport?

A card titled “Approval required (four-eyes principle)”: it states what is to be changed on the device, the reason, whether it is reversible, and how long the approval is valid, and it shows the concrete command. It also has the buttons “Approve action” and “Reject.”

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial