PAITA classifies every request against a live use-case catalogue, grounds itself in your knowledge base, plans within a closed action allow-list, and gates anything risky behind a human approver — with a full audit trail. Explore it below.
Pick a scenario and a channel. The left pane is what the end user experiences. The right pane is the agent execution trace: each architecture component as it fires, with its internal state — tap any step to inspect the payload.
Simulation only — payloads are scripted to mirror the deployed pipeline's real state objects. In production the identical steps run against Azure OpenAI, Azure AI Search, Entra ID, and your ITSM.
Historical tickets are PAITA's raw material: they become the RAG knowledge that grounds answers, and they reveal new use cases hiding in your volume. Run the built-in 1,000-ticket sample, or drop your own CSV.
short_description column (or first column) · processed entirely in your browser
python -m paita.rag.ingestion ./dump --source tickets --groups it-staff — chunk (1,600 chars,
200 overlap) → embed (text-embedding-3-large) → upsert to Azure AI Search with group ACLs. Resolution
worknotes become retrievable fix knowledge; the same dump also seeds
evals/golden_set.jsonl so intent accuracy is measured on your phrasing.Clusters with meaningful volume that match no implemented intent. Each card shows the ready-to-paste Use Case Studio configuration and what (if anything) needs code.
The stack mirrors the solution blueprint: six user channels, a five-agent orchestration layer, an integration fabric, and two cross-cutting planes.
POST /v1/chat contract.
Teams uses Azure Bot Service + the Adaptive Cards adapter (channels/teams.py); voice fronts the same
endpoint with Azure Speech STT/TTS; the ITSM embed is an iframe widget authenticated by the same Entra ID token.
One API surface = one place to secure, throttle, and observe.itsm.approver; audit-logged decisions.orchestrator/graph.py.
Routing rule: answer-only → respond; any action with risk=high, any action in the HITL config list, or a
use-case-level "requires approval" toggle → the HITL gate. Session state sits in Redis (1h TTL), so the
API pods stay stateless and scale horizontally./v1/webhooks/itsm. Outbound: ServiceNow OAuth2 Table API or Jira REST v3,
both with correlation-key dedupe. Inbound: ITSM business rules push state changes to the webhook, which fans out
proactive Teams/email notifications.allowed_groups ACL field stamped at
ingestion — users can only retrieve documents their Entra groups permit. Embeddings: text-embedding-3-large,
1600-char chunks with 200 overlap. All services on private endpoints, accessed via Managed Identity — zero keys in code.itsm.user, itsm.approver,
itsm.admin). Content Safety screens input and output and fails closed in production.
Every classification, plan, approval and action emits a structured audit event — no message bodies stored.
CI release gate: unit tests + intent-accuracy eval ≥ 90% + red-team suite at 100% before any deploy.Expand only what you need. Every phase ends with an exit gate — don't move on until it's green.
api://paita with app roles itsm.user, itsm.approver, itsm.admin.az deployment group create -g rg-paita -f infra/main.bicep \ -p containerImage=<acr>.azurecr.io/paita:1.1.0
/readyz returns 200 from inside the VNet; Managed Identity can reach AOAI and Search.allowed_groups controls who can retrieve it.network, vpn, printers…) so use cases can narrow retrieval.python -m paita.rag.ingestion ./kb_export --source vpn --groups it-staff
/admin — the four launch workflows ship as editable seeds.evals/golden_set.jsonl with client utterances; run the eval gate weekly and on every KB refresh.python -m evals.eval_framework --golden evals/golden_set.jsonl
Savings = tickets deflected or auto-resolved × handle time × loaded agent cost, per category. Deflection rates default to conservative pilot figures; adjust to your baseline.