{"id":31319,"date":"2026-08-10T14:52:00","date_gmt":"2026-08-10T12:52:00","guid":{"rendered":"https:\/\/botnation.ai\/helpdesk-chatbot\/"},"modified":"2026-08-10T15:14:39","modified_gmt":"2026-08-10T13:14:39","slug":"helpdesk-chatbot","status":"publish","type":"post","link":"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/","title":{"rendered":"Helpdesk chatbot: what it closes on its own, and where its right to act stops"},"content":{"rendered":"<p><script>(function(){var s=document.createElement(\"style\");s.appendChild(document.createTextNode(\".bn-art{--bn-cream:#faf8f2;--bn-card:#faf6ea;--bn-sand:#ebe3cb;--bn-sand-2:#f3ecd9;--bn-sand-zebra:#f6f0df;--bn-coral:#fe716b;--bn-coral-soft:#fdeeed;--bn-coral-line:#f6c9c6;--bn-coral-txt:#bd3a34;--bn-blue:#3358f0;--bn-blue-soft:#eef1fe;--bn-blue-line:#c9d4fb;--bn-green:#427632;--bn-green-soft:#eef6ea;--bn-ink:#3d351f;--bn-text:#414b56;--bn-muted:#6d6653;--bn-border:#e6dcc2;--bn-r:16px;--bn-r-sm:11px;--bn-sp:22px;--bn-sh:0 1px 2px rgba(61,53,31,.05),0 10px 26px rgba(61,53,31,.07);--bn-sh-sm:0 1px 2px rgba(61,53,31,.05),0 4px 12px rgba(61,53,31,.05);--bn-mono:'IBM Plex Mono','SFMono-Regular',ui-monospace,'Courier New',monospace;color:var(--bn-text);font-size:18px;line-height:1.75;max-width:820px;margin:0 auto}.bn-art *{box-sizing:border-box}.bn-art p{margin:0 0 1.15em;color:var(--bn-text)}.bn-art h2{color:var(--bn-ink);font-weight:700;line-height:1.25;font-size:1.72em;margin:2.2em 0 .7em;letter-spacing:-.01em}.bn-art h3{color:var(--bn-ink);font-weight:700;font-size:1.22em;margin:1.8em 0 .5em}.bn-art a{color:#3f5cd6;text-decoration:underline;text-underline-offset:2px;text-decoration-thickness:1px}.bn-art a:hover{color:var(--bn-coral)}.bn-art strong{color:var(--bn-ink);font-weight:700}.bn-art ul,.bn-art ol{margin:0 0 1.3em;padding-left:1.25em}.bn-art li{margin:.4em 0}.bn-art ul li::marker{color:var(--bn-coral)}.bn-art ol li::marker{color:var(--bn-blue);font-weight:700}.bn-klabel{display:inline-flex;align-items:center;gap:7px;font-family:var(--bn-mono);font-size:14px;font-weight:600;text-transform:uppercase;letter-spacing:.12em;color:var(--bn-coral);margin:0 0 .2em}.bn-klabel svg{width:15px;height:15px;flex:none}.bn-tldr{background:var(--bn-card);border:1px solid var(--bn-border);border-left:4px solid var(--bn-coral);border-radius:var(--bn-r);padding:20px 24px;margin:0 0 30px;box-shadow:var(--bn-sh-sm)}.bn-tldr p{margin:0;color:var(--bn-text)}.bn-tldr p+p{margin-top:.6em}.bn-toc{background:var(--bn-sand-2);border:1px solid var(--bn-sand);border-radius:var(--bn-r);padding:18px 22px;margin:0 0 34px}.bn-toc .bn-klabel{color:var(--bn-coral)}.bn-toc ol{margin:.4em 0 0;padding-left:1.2em;columns:2;column-gap:28px}.bn-toc li{margin:.25em 0;break-inside:avoid}.bn-toc a{color:var(--bn-ink);text-decoration:none;font-weight:600;font-size:.96em}.bn-toc a:hover{color:var(--bn-coral);text-decoration:underline}.bn-stats{display:grid;grid-template-columns:repeat(3,1fr);gap:16px;margin:28px 0}.bn-stat{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:20px 18px;text-align:center;box-shadow:var(--bn-sh-sm)}.bn-stat b{display:block;font-size:2em;line-height:1.1;color:var(--bn-coral);font-weight:800;letter-spacing:-.02em}.bn-stat span{display:block;margin-top:6px;font-size:.86em;color:var(--bn-muted);line-height:1.45}.bn-stat:nth-child(2) b{color:var(--bn-blue)}.bn-stat:nth-child(3) b{color:var(--bn-ink)}.bn-grid{display:grid;grid-template-columns:1fr 1fr;gap:18px;margin:26px 0}.bn-card{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:22px;box-shadow:var(--bn-sh-sm)}.bn-card h4{margin:.1em 0 .35em;color:var(--bn-ink);font-size:1.06em;font-weight:700;display:flex;gap:9px;align-items:center}.bn-card h4 svg{width:20px;height:20px;flex:none;color:var(--bn-coral)}.bn-card p{margin:0;font-size:.96em}.bn-ex{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:20px 0;box-shadow:var(--bn-sh);position:relative}.bn-ex-h{display:flex;align-items:center;gap:13px;margin-bottom:14px}.bn-ex-n{flex:none;width:38px;height:38px;border-radius:11px;background:var(--bn-coral-soft);color:var(--bn-coral);display:flex;align-items:center;justify-content:center;font-weight:800;font-size:1.1em;font-family:var(--bn-mono)}.bn-ex-h h3{margin:0;font-size:1.18em}.bn-ex-tag{font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.1em;color:var(--bn-muted);display:block;margin-top:2px}.bn-ex p{margin:.2em 0 .9em}.bn-ex .bn-ba{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-top:14px}.bn-ba div{border-radius:var(--bn-r-sm);padding:13px 15px;font-size:.9em;line-height:1.5}.bn-ba .biz{background:var(--bn-blue-soft);border:1px solid var(--bn-blue-line)}.bn-ba .cli{background:var(--bn-green-soft);border:1px solid #cfe6c4}.bn-ba b{display:block;font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.08em;margin-bottom:4px;color:var(--bn-muted)}.bn-tablewrap{overflow-x:auto;margin:26px 0;border-radius:var(--bn-r);border:1px solid var(--bn-border);box-shadow:var(--bn-sh-sm)}.bn-art table{width:100%;border-collapse:collapse;background:var(--bn-card);font-size:.94em;min-width:520px}.bn-art thead th{background:var(--bn-ink);color:#fbf7ec;text-align:left;font-weight:700;padding:13px 16px;font-size:16px}.bn-art tbody td{padding:12px 16px;border-top:1px solid var(--bn-border);color:var(--bn-text);vertical-align:top;font-size:16px}.bn-art tbody tr:nth-child(even){background:var(--bn-sand-zebra)}.bn-art tbody td:first-child{font-weight:700;color:var(--bn-ink)}.bn-cols{display:grid;grid-template-columns:1fr 1fr;gap:18px;margin:26px 0}.bn-col{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:22px;box-shadow:var(--bn-sh-sm)}.bn-col h4{margin:0 0 12px;font-size:1.05em;color:var(--bn-ink);display:flex;align-items:center;gap:9px}.bn-col h4 svg{width:20px;height:20px;flex:none}.bn-col.biz h4 svg{color:var(--bn-blue)}.bn-col.cli h4 svg{color:var(--bn-green)}.bn-col.warn h4 svg{color:var(--bn-coral)}.bn-col ul{margin:0;padding:0;list-style:none}.bn-col li{position:relative;padding-left:26px;margin:.55em 0;font-size:.96em}.bn-col li::before{content:'';position:absolute;left:0;top:.5em;width:13px;height:13px;border-radius:50%;background:var(--bn-coral-soft);border:2px solid var(--bn-coral)}.bn-col.biz li::before{background:var(--bn-blue-soft);border-color:var(--bn-blue)}.bn-col.cli li::before{background:var(--bn-green-soft);border-color:var(--bn-green)}.bn-call{display:flex;gap:14px;border-radius:var(--bn-r);padding:18px 20px;margin:24px 0;background:var(--bn-card);border:1px solid var(--bn-border);box-shadow:var(--bn-sh-sm)}.bn-call svg{width:22px;height:22px;flex:none;margin-top:1px}.bn-call b{color:var(--bn-ink)}.bn-call p{margin:0;font-size:.95em}.bn-call .bn-klabel{margin-bottom:3px}.bn-tip{border-left:4px solid var(--bn-green)}.bn-tip svg{color:var(--bn-green)}.bn-tip .bn-klabel{color:var(--bn-green)}.bn-warn{border-left:4px solid var(--bn-coral)}.bn-warn svg{color:var(--bn-coral)}.bn-warn .bn-klabel{color:var(--bn-coral)}.bn-info{border-left:4px solid var(--bn-blue)}.bn-info svg{color:var(--bn-blue)}.bn-info .bn-klabel{color:var(--bn-blue)}.bn-def{background:var(--bn-blue-soft);border:1px solid var(--bn-blue-line);border-radius:var(--bn-r);padding:20px 24px;margin:24px 0}.bn-def .bn-klabel{color:var(--bn-blue)}.bn-def p{margin:0}.bn-steps{counter-reset:s;list-style:none;padding:0;margin:24px 0}.bn-steps li{position:relative;padding:0 0 4px 56px;margin:0 0 18px;min-height:40px}.bn-steps li::before{counter-increment:s;content:counter(s);position:absolute;left:0;top:0;width:40px;height:40px;border-radius:12px;background:var(--bn-coral);color:#fff;font-weight:800;font-family:var(--bn-mono);display:flex;align-items:center;justify-content:center;box-shadow:var(--bn-sh-sm)}.bn-steps li b{display:block;color:var(--bn-ink);margin-bottom:2px}.bn-check{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-check h3{margin:.1em 0 .3em}.bn-check>p{font-size:.95em;color:var(--bn-muted);margin-bottom:14px}.bn-check ul{list-style:none;padding:0;margin:0 0 18px}.bn-check li{margin:0;border-top:1px solid var(--bn-border)}.bn-check li:first-child{border-top:none}.bn-check label{display:flex;align-items:flex-start;gap:13px;padding:12px 2px;cursor:pointer;font-size:.97em;color:var(--bn-text)}.bn-check input{appearance:none;-webkit-appearance:none;flex:none;width:22px;height:22px;margin-top:1px;border:2px solid var(--bn-coral-line);border-radius:7px;background:#fff;cursor:pointer;position:relative;transition:.15s}.bn-check input:checked{background:var(--bn-coral);border-color:var(--bn-coral)}.bn-check input:checked::after{content:'';position:absolute;left:6px;top:2px;width:6px;height:11px;border:solid #fff;border-width:0 2.5px 2.5px 0;transform:rotate(45deg)}.bn-result{border-radius:var(--bn-r-sm);padding:16px 18px;background:var(--bn-coral-soft);border:1px solid var(--bn-coral-line);font-size:.96em}.bn-result b{color:var(--bn-ink)}.bn-result .bn-score{font-family:var(--bn-mono);font-weight:700;color:var(--bn-coral)}.bn-result .bnc-res{display:none;margin-top:10px}.bn-result .bnc-res.on{display:block}.bn-result .bnc-res p{margin:0;color:var(--bn-text)}.bn-faq{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r-sm);margin:0 0 12px;box-shadow:var(--bn-sh-sm);overflow:hidden}.bn-faq summary{cursor:pointer;padding:17px 20px;font-weight:700;color:var(--bn-ink);list-style:none;display:flex;justify-content:space-between;align-items:center;gap:14px;font-size:1.03em}.bn-faq summary::-webkit-details-marker{display:none}.bn-faq summary::after{content:'+';font-family:var(--bn-mono);font-size:1.5em;color:var(--bn-coral);flex:none;line-height:1;transition:transform .2s}.bn-faq[open] summary::after{transform:rotate(45deg)}.bn-faq .bn-faq-b{padding:0 20px 18px;color:var(--bn-text)}.bn-faq .bn-faq-b p{margin:0}.bn-fig{margin:30px 0;text-align:center}.bn-fig img{width:100%;height:auto;border-radius:var(--bn-r);box-shadow:var(--bn-sh);display:block}.bn-fig figcaption{margin-top:10px;font-size:.85em;color:var(--bn-muted);font-style:italic}.bn-cta{background:var(--bn-ink);border-radius:var(--bn-r);padding:34px 32px;margin:36px 0 12px;text-align:center}.bn-cta h3{color:#fff;margin:0 0 .4em;font-size:1.4em}.bn-cta p{color:#e9e2cf;margin:0 auto 20px;max-width:560px;font-size:1em}.bn-cta-btn{display:inline-block;background:var(--bn-coral);color:#332c19 !important;text-decoration:none !important;font-weight:800;padding:15px 34px;border-radius:999px;font-size:1.02em;box-shadow:0 8px 22px rgba(254,113,107,.35);transition:.15s}.bn-cta-btn:hover{background:#ff8782;color:#fff !important}.bn-quiz{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-quiz .bnq-q{padding:14px 0;border-top:1px solid var(--bn-border)}.bn-quiz .bnq-q:first-of-type{border-top:none;padding-top:4px}.bn-quiz .bnq-qt{font-weight:700;color:var(--bn-ink);margin:0 0 10px;font-size:1.02em}.bn-quiz .bnq-opt{display:flex;align-items:flex-start;gap:12px;padding:9px 12px;margin:6px 0;cursor:pointer;font-size:.96em;color:var(--bn-text);border:1px solid var(--bn-border);border-radius:var(--bn-r-sm);background:#fff;transition:.15s}.bn-quiz .bnq-opt:hover{border-color:var(--bn-coral-line);background:var(--bn-coral-soft)}.bn-quiz .bnq-opt input{appearance:none;-webkit-appearance:none;flex:none;width:20px;height:20px;margin-top:1px;border:2px solid var(--bn-coral-line);border-radius:50%;background:#fff;cursor:pointer;position:relative;transition:.15s}.bn-quiz .bnq-opt input:checked{border-color:var(--bn-coral)}.bn-quiz .bnq-opt input:checked::after{content:'';position:absolute;left:3px;top:3px;width:10px;height:10px;border-radius:50%;background:var(--bn-coral)}.bn-quiz .bnq-opt:has(input:checked){border-color:var(--bn-coral);background:var(--bn-coral-soft)}.bn-quiz .bnq-btn{margin-top:16px;display:inline-block;background:var(--bn-coral);color:#332c19;border:none;font-weight:800;font-size:1em;padding:13px 30px;border-radius:999px;cursor:pointer;box-shadow:0 6px 16px rgba(254,113,107,.28);transition:.15s;font-family:inherit}.bn-quiz .bnq-btn:hover{background:#ff8782}.bn-quiz .bnq-res{display:none;margin-top:18px;padding:18px 20px;border-radius:var(--bn-r-sm);background:var(--bn-blue-soft);border:1px solid var(--bn-blue-line)}.bn-quiz .bnq-res.on{display:block}.bn-quiz #bnq-agent{background:var(--bn-coral-soft);border-color:var(--bn-coral-line)}.bn-quiz #bnq-hybrid{background:var(--bn-green-soft);border-color:#cfe6c4}.bn-quiz .bnq-rt{font-weight:800;color:var(--bn-ink);margin:0 0 6px;font-size:1.08em}.bn-quiz .bnq-res p{margin:0}.bn-spectrum{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-spectrum h3{margin:.1em 0 .3em}.bn-spectrum>p{font-size:.95em;color:var(--bn-muted);margin:0 0 20px}.bn-spec-track{margin:26px 4px 4px}.bn-spec-range{-webkit-appearance:none;appearance:none;width:100%;height:8px;border-radius:999px;background:var(--bn-sand);outline:none;cursor:pointer;margin:0}.bn-spec-range::-webkit-slider-thumb{-webkit-appearance:none;appearance:none;width:26px;height:26px;border-radius:50%;background:var(--bn-coral);border:3px solid #fff;box-shadow:var(--bn-sh-sm);cursor:pointer}.bn-spec-range::-moz-range-thumb{width:26px;height:26px;border-radius:50%;background:var(--bn-coral);border:3px solid #fff;box-shadow:var(--bn-sh-sm);cursor:pointer}.bn-spec-stops{display:flex;justify-content:space-between;margin-top:13px;font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.07em;color:var(--bn-muted);gap:8px}.bn-spec-stops span{flex:1;cursor:pointer;transition:.15s;text-align:center}.bn-spec-stops span:first-child{text-align:left}.bn-spec-stops span:last-child{text-align:right}.bn-spec-stops span.on{color:var(--bn-coral);font-weight:700}.bns-pane{display:none;margin-top:22px;border-radius:var(--bn-r-sm);padding:20px 22px;background:var(--bn-sand-2);border:1px solid var(--bn-sand)}.bns-pane.on{display:block}.bns-pane h4{margin:0 0 3px;color:var(--bn-ink);font-size:1.14em}.bns-tag{font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.1em;color:var(--bn-coral);display:block;margin-bottom:11px}.bns-pane>p{margin:0;font-size:.96em;color:var(--bn-text)}.bns-grid{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-top:15px}.bns-grid div{background:#fff;border:1px solid var(--bn-border);border-radius:var(--bn-r-sm);padding:11px 14px;font-size:.9em;color:var(--bn-text)}.bns-grid b{display:block;font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.07em;color:var(--bn-muted);margin-bottom:3px}.bn-roi{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-roi h3{margin:.1em 0 .3em}.bn-roi>p{font-size:.95em;color:var(--bn-muted);margin:0 0 18px}.bn-roi-fields{display:grid;grid-template-columns:1fr 1fr;gap:20px 28px;margin:18px 0 24px}.bn-roi-field:last-child{grid-column:1\/-1}.bn-roi-field label{display:block;font-size:.9em;color:var(--bn-text);font-weight:600;margin-bottom:11px}.bn-roi-field output{font-family:var(--bn-mono);font-weight:700;color:var(--bn-coral)}.bn-roi-out{display:grid;grid-template-columns:repeat(3,1fr);gap:16px;margin-top:4px}.bn-roi-stat{background:var(--bn-sand-2);border:1px solid var(--bn-sand);border-radius:var(--bn-r);padding:20px 16px;text-align:center}.bn-roi-stat b{display:block;font-size:1.85em;line-height:1.05;color:var(--bn-coral);font-weight:800;letter-spacing:-.02em;font-family:var(--bn-mono)}.bn-roi-stat:nth-child(2) b{color:var(--bn-blue)}.bn-roi-stat:nth-child(3) b{color:var(--bn-ink)}.bn-roi-stat span{display:block;margin-top:7px;font-size:.82em;color:var(--bn-muted);line-height:1.4}.bn-roi-note{font-size:16px;color:var(--bn-muted);margin:16px 0 0;font-style:italic}.bn-bot{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:22px 24px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-bot h3{margin:.1em 0 .3em}.bn-bot>p{font-size:.95em;color:var(--bn-muted);margin:0 0 16px}.bn-bot-win{border:1px solid var(--bn-border);border-radius:var(--bn-r-sm);background:#fff;overflow:hidden}.bn-bot-bar{display:flex;align-items:center;gap:11px;padding:12px 16px;background:var(--bn-sand-2);border-bottom:1px solid var(--bn-border)}.bn-bot-ava{flex:none;width:32px;height:32px;border-radius:50%;background:var(--bn-coral-soft);display:flex;align-items:center;justify-content:center}.bn-bot-ava svg{width:19px;height:19px;color:var(--bn-coral)}.bn-bot-id b{display:block;color:var(--bn-ink);font-size:.95em;line-height:1.2}.bn-bot-id span{font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.08em;color:var(--bn-green);display:inline-flex;align-items:center;gap:5px}.bn-bot-id span::before{content:'';width:7px;height:7px;border-radius:50%;background:var(--bn-green)}.bn-bot-log{padding:16px;min-height:130px;max-height:320px;overflow-y:auto;display:flex;flex-direction:column;gap:10px}.bn-bot-msg{max-width:82%;padding:10px 14px;border-radius:15px;font-size:.95em;line-height:1.5}.bn-bot-msg.bot{align-self:flex-start;background:var(--bn-sand-2);color:var(--bn-text);border-bottom-left-radius:4px}.bn-bot-msg.user{align-self:flex-end;background:var(--bn-coral);color:#332c19;border-bottom-right-radius:4px}.bn-bot-quick{display:flex;flex-wrap:wrap;gap:8px;padding:2px 16px 14px}.bn-art .bn-bot-qbtn{font-family:inherit;font-size:16px;color:var(--bn-ink);background:#fff;border:1px solid var(--bn-coral-line);border-radius:999px;padding:7px 14px;cursor:pointer;transition:.15s}.bn-art .bn-bot-qbtn:hover{background:var(--bn-coral-soft);border-color:var(--bn-coral)}.bn-bot-form{display:flex;gap:8px;padding:12px 16px;border-top:1px solid var(--bn-border);background:var(--bn-sand-2)}.bn-bot-input{flex:1;min-width:0;font-family:inherit;font-size:.95em;color:var(--bn-ink);background:#fff;border:1px solid var(--bn-border);border-radius:999px;padding:10px 16px;outline:none}.bn-bot-input:focus{border-color:var(--bn-coral)}.bn-art .bn-bot-send{flex:none;font-family:inherit;font-weight:700;font-size:16px;color:#fff;background:var(--bn-coral);border:none;border-radius:999px;padding:10px 20px;cursor:pointer;transition:.15s}.bn-art .bn-bot-send:hover{background:#ff8782}.bn-art .bn-bot-note{font-size:16px;color:var(--bn-muted);margin:14px 0 0;font-style:italic}.bbot-kb,.bbot-fallback{display:none}.bn-shot{margin:16px 0 2px;border:1px solid var(--bn-border);border-radius:var(--bn-r-sm);background:#fff;overflow:hidden}.bn-shot-bar{display:flex;align-items:center;gap:8px;padding:9px 13px;background:var(--bn-sand-2);border-bottom:1px solid var(--bn-border)}.bn-shot-dot{width:8px;height:8px;border-radius:50%;background:var(--bn-green);flex:none}.bn-shot-bar b{color:var(--bn-ink);font-size:.9em}.bn-shot-bar span{margin-left:auto;font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.06em;color:var(--bn-muted)}.bn-shot-log{padding:13px 14px;display:flex;flex-direction:column;gap:8px}.bn-shot .bn-bot-msg{max-width:86%;font-size:.9em}.bn-shot-quick{display:flex;flex-wrap:wrap;gap:6px;margin-top:2px}.bn-shot-quick span{font-size:14px;color:var(--bn-ink);background:#fff;border:1px solid var(--bn-coral-line);border-radius:999px;padding:4px 11px}.bn-exlink{margin:13px 0 0;font-weight:700;display:flex;align-items:center;gap:6px}.bn-exlink svg{width:16px;height:16px;flex:none;color:var(--bn-coral)}.bn-lb{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-lb h3{margin:.1em 0 .3em}.bn-lb>p{font-size:.95em;color:var(--bn-muted);margin:0 0 16px}.bn-lb-ctrl{display:flex;flex-wrap:wrap;gap:11px;align-items:center;margin:0 0 16px}.bn-lb-ctrl br{display:none}.bn-lb-search{flex:1;min-width:200px;font-family:inherit;font-size:16px;color:var(--bn-ink);background:#fff;border:1px solid var(--bn-border);border-radius:999px;padding:11px 18px;outline:none}.bn-lb-search:focus{border-color:var(--bn-coral)}.bn-lb-filters{display:flex;flex-wrap:wrap;gap:8px}.bn-art .bn-lb-fbtn{font-family:inherit;font-size:16px;color:var(--bn-ink);background:#fff;border:1px solid var(--bn-coral-line);border-radius:999px;padding:9px 16px;cursor:pointer;transition:.15s}.bn-art .bn-lb-fbtn:hover{background:var(--bn-coral-soft)}.bn-art .bn-lb-fbtn.on{background:var(--bn-coral);color:#fff;border-color:var(--bn-coral)}.bn-lb .bn-lb-th{cursor:pointer;user-select:none;white-space:nowrap}.bn-lb .bn-lb-th:hover{color:#fbf7ec;opacity:.85}.bn-lb-rank{font-family:var(--bn-mono);font-weight:700;color:var(--bn-coral);text-align:center}.bn-lb-score{font-family:var(--bn-mono);font-weight:700;color:var(--bn-ink);text-align:right;white-space:nowrap}.lb-empty{padding:16px;text-align:center;color:var(--bn-muted);font-size:.95em}.bn-lb-foot{font-size:16px;color:var(--bn-muted);margin:14px 0 0;font-style:italic}@media(max-width:680px){.bn-art{font-size:17px}.bn-stats,.bn-grid,.bn-cols,.bn-ex .bn-ba,.bns-grid,.bn-roi-fields,.bn-roi-out{grid-template-columns:1fr}.bn-roi-field:last-child{grid-column:auto}.bn-toc ol{columns:1}.bn-art h2{font-size:1.5em}.bn-bot-msg{max-width:90%}}.bn-art sup,.bn-art sub{font-size:14px;line-height:0}.bn-klabel.hc{color:var(--bn-coral-txt)}.bn-cdc{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-cdc h3{margin:.1em 0 .3em}.bn-cdc>p{font-size:.95em;color:var(--bn-muted);margin:0 0 18px}.bn-cdc br{display:none}.bn-cdc p:empty{display:none;margin:0}.cdc-q{padding:15px 0;border-top:1px solid var(--bn-border)}.cdc-q:first-of-type{border-top:none;padding-top:2px}.bn-art .cdc-qt{font-weight:700;color:var(--bn-ink);margin:0 0 11px;font-size:16px;line-height:1.45}.cdc-chips{display:flex;flex-wrap:wrap;gap:8px}.cdc-chips p:not([class]){display:contents}.bn-art .cdc-chip{display:inline-flex;align-items:center;font-size:16px;line-height:1.35;color:var(--bn-ink);background:#fff;border:1px solid var(--bn-coral-line);border-radius:999px;padding:9px 16px;cursor:pointer;transition:.15s}.bn-art .cdc-chip:hover{background:var(--bn-coral-soft)}.bn-art .cdc-chip:has(input:checked){background:var(--bn-coral);color:#332c19;border-color:var(--bn-coral);font-weight:700}.cdc-chip input{position:absolute;opacity:0;width:1px;height:1px;pointer-events:none}.cdc-out{margin:22px 0 0;border-radius:var(--bn-r-sm);background:var(--bn-sand-2);border:1px solid var(--bn-sand);padding:20px 22px}.cdc-line{padding:14px 0;border-top:1px solid var(--bn-sand)}.cdc-line:first-of-type{border-top:none;padding-top:2px}.cdc-line p:not([class]){margin:0}.bn-art .cdc-line b{display:block;font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.08em;color:var(--bn-coral-txt);margin-bottom:6px}.bn-art .cdc-line span{display:block;font-size:16px;line-height:1.62;color:var(--bn-text)}.bn-art .cdc-copy{margin-top:18px;display:inline-block;background:var(--bn-coral);color:#332c19;border:none;font-family:inherit;font-weight:800;font-size:16px;padding:13px 28px;border-radius:999px;cursor:pointer;box-shadow:0 6px 16px rgba(254,113,107,.28);transition:.15s}.bn-art .cdc-copy:hover{background:#ff8782}.bn-art .cdc-note{font-size:16px;color:var(--bn-muted);margin:12px 0 0;font-style:italic;min-height:1.5em}@media(max-width:680px){.cdc-chips{flex-direction:column;align-items:stretch}.bn-art .cdc-chip{justify-content:flex-start}}.bn-niv{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-niv h3{margin:.1em 0 .3em}.bn-niv>p{font-size:.95em;color:var(--bn-muted);margin:0 0 18px}.bn-niv br{display:none}.bn-niv p:empty{display:none;margin:0}.niv-q{padding:15px 0;border-top:1px solid var(--bn-border)}.niv-q:first-of-type{border-top:none;padding-top:2px}.bn-art .niv-qt{font-weight:700;color:var(--bn-ink);margin:0 0 11px;font-size:16px;line-height:1.45}.niv-out{margin:24px 0 0;border-radius:var(--bn-r-sm);background:var(--bn-sand-2);border:1px solid var(--bn-sand);padding:20px 22px}.bn-art .niv-score{display:flex;align-items:baseline;gap:10px;margin:0 0 13px}.bn-art .niv-score b{font-family:var(--bn-mono);font-size:2.1em;line-height:1;color:var(--bn-coral-txt);font-weight:800;letter-spacing:-.02em}.bn-art .niv-score span{font-size:16px;color:var(--bn-muted)}.niv-gauge{height:10px;border-radius:999px;background:var(--bn-sand);overflow:hidden;margin:0 0 18px}.niv-gauge p:not([class]){display:contents}.niv-gauge i{display:block;height:10px;background:var(--bn-coral);border-radius:999px;width:0}.nivv{display:none;border-radius:var(--bn-r-sm);padding:17px 19px;background:#fff;border:1px solid var(--bn-border)}.nivv.on{display:block}.bn-art .nivv b{display:block;font-size:1.08em;color:var(--bn-ink);margin-bottom:5px}.bn-art .nivv p{margin:0;font-size:16px;line-height:1.62}.bn-art .niv-weak{margin:15px 0 0;font-size:16px;color:var(--bn-text)}.bn-art .niv-weak b{font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.08em;color:var(--bn-coral-txt);display:block;margin-bottom:4px}.bn-art blockquote{margin:26px 0;padding:18px 22px;background:var(--bn-card);border:1px solid var(--bn-border);border-left:4px solid var(--bn-blue);border-radius:var(--bn-r);box-shadow:var(--bn-sh-sm)}.bn-art blockquote p{margin:0;font-size:17px;line-height:1.65;color:var(--bn-text)}.bn-chk{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-chk h3{margin:.1em 0 .3em}.bn-chk>p{font-size:.95em;color:var(--bn-muted);margin:0 0 18px}.bn-chk br{display:none}.bn-chk p:empty{display:none;margin:0}.chk-doc{border-radius:var(--bn-r-sm);background:#fff;border:1px solid var(--bn-border);padding:16px 18px;margin:0 0 6px}.bn-art .chk-doc b{display:block;font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.08em;color:var(--bn-coral-txt);margin-bottom:6px}.bn-art .chk-doc span{display:block;font-size:16px;line-height:1.62;color:var(--bn-text)}.chk-q{padding:15px 0;border-top:1px solid var(--bn-border)}.bn-art .chk-qt{font-weight:700;color:var(--bn-ink);margin:0 0 11px;font-size:16px;line-height:1.45}.chk-out{margin:22px 0 0;border-radius:var(--bn-r-sm);background:var(--bn-sand-2);border:1px solid var(--bn-sand);padding:20px 22px}.chk-pieces{display:grid;gap:10px;margin:0 0 16px}.chk-piece{border-radius:var(--bn-r-sm);background:#fff;border:1px solid var(--bn-border);padding:12px 14px}.chk-piece.hit{border-color:var(--bn-green);background:var(--bn-green-soft)}.bn-art .chk-piece b{display:block;font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.08em;color:var(--bn-muted);margin-bottom:5px}.bn-art .chk-piece.hit b{color:var(--bn-green)}.bn-art .chk-piece span{display:block;font-size:16px;line-height:1.6;color:var(--bn-text)}.bn-art .chk-verdict{border-radius:var(--bn-r-sm);padding:14px 16px;font-size:16px;line-height:1.55;background:var(--bn-green-soft);border:1px solid #cfe6c4;color:var(--bn-text);margin:0 0 12px}.bn-art .chk-verdict.ko{background:var(--bn-coral-soft);border-color:var(--bn-coral-line)}.bn-art .chk-stats{margin:0;font-size:16px;line-height:1.6;color:var(--bn-text)}.bn-art .chk-stats b{font-family:var(--bn-mono);color:var(--bn-coral-txt);font-weight:700}.bn-dev{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-dev h3{margin:.1em 0 .3em}.bn-dev>p{font-size:.95em;color:var(--bn-muted);margin:0 0 18px}.bn-dev br{display:none}.bn-dev p:empty{display:none;margin:0}.dev-q{padding:15px 0;border-top:1px solid var(--bn-border)}.dev-q:first-of-type{border-top:none;padding-top:2px}.bn-art .dev-qt{font-weight:700;color:var(--bn-ink);margin:0 0 11px;font-size:16px;line-height:1.45}.dev-out{margin:24px 0 0;border-radius:var(--bn-r-sm);background:var(--bn-sand-2);border:1px solid var(--bn-sand);padding:20px 22px}.dev-tiles{display:grid;grid-template-columns:repeat(4,1fr);gap:14px;margin:0 0 16px}.dev-stat{background:#fff;border:1px solid var(--bn-border);border-radius:var(--bn-r-sm);padding:16px 12px;text-align:center}.bn-art .dev-stat b{display:block;font-family:var(--bn-mono);font-size:1.5em;line-height:1.12;font-weight:800;letter-spacing:-.02em;color:var(--bn-coral-txt)}.bn-art .dev-stat:nth-child(2) b{color:var(--bn-blue)}.bn-art .dev-stat:nth-child(3) b{color:var(--bn-green)}.bn-art .dev-stat:nth-child(4) b{color:var(--bn-ink)}.bn-art .dev-stat span{display:block;margin-top:7px;font-size:14px;color:var(--bn-muted);line-height:1.4}.bn-art .dev-line{margin:0 0 14px;font-size:16px;line-height:1.6;color:var(--bn-text)}.bn-art .dev-line b{font-family:var(--bn-mono);color:var(--bn-coral-txt);font-weight:700}.dvv{display:none;border-radius:var(--bn-r-sm);padding:16px 18px;background:#fff;border:1px solid var(--bn-border)}.dvv.on{display:block}.bn-art .dvv b{display:block;font-size:1.06em;color:var(--bn-ink);margin-bottom:5px}.bn-art .dvv p{margin:0;font-size:16px;line-height:1.62}@media(max-width:680px){.dev-tiles{grid-template-columns:1fr 1fr}}.bn-fig.doc img{max-width:520px;margin:0 auto}.bn-nlu{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-nlu h3{margin:.1em 0 .3em}.bn-nlu>p{font-size:.95em;color:var(--bn-muted);margin:0 0 18px}.bn-nlu br{display:none}.bn-nlu p:empty{display:none;margin:0}.nlu-q{padding:15px 0;border-top:1px solid var(--bn-border)}.nlu-q:first-of-type{border-top:none;padding-top:2px}.bn-art .nlu-qt{font-weight:700;color:var(--bn-ink);margin:0 0 11px;font-size:16px;line-height:1.45}.bn-art .nlu-in{width:100%;font-family:inherit;font-size:16px;color:var(--bn-ink);background:#fff;border:1px solid var(--bn-border);border-radius:999px;padding:12px 18px;outline:none}.bn-art .nlu-in:focus{border-color:var(--bn-coral)}.nlu-ex{display:flex;flex-wrap:wrap;gap:8px;margin-top:12px}.nlu-ex p:not([class]){display:contents}.bn-art .nlu-exb{font-family:inherit;font-size:16px;line-height:1.35;color:var(--bn-ink);background:#fff;border:1px solid var(--bn-coral-line);border-radius:999px;padding:9px 16px;cursor:pointer;transition:.15s;text-align:left}.bn-art .nlu-exb:hover{background:var(--bn-coral-soft)}.nlu-out{margin:24px 0 0;border-radius:var(--bn-r-sm);background:var(--bn-sand-2);border:1px solid var(--bn-sand);padding:20px 22px}.bn-art .nlu-toks{margin:0 0 14px;font-size:16px;line-height:1.7;color:var(--bn-text)}.bn-art .nlu-toks b{font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.08em;color:var(--bn-coral-txt);display:block;margin-bottom:8px}.bn-art .nlu-tk{display:inline-block;font-family:var(--bn-mono);font-size:14px;background:#fff;border:1px solid var(--bn-border);border-radius:999px;padding:3px 11px;margin:0 6px 6px 0;color:var(--bn-ink)}.nlu-row{display:grid;grid-template-columns:1fr 130px 54px;gap:12px;align-items:center;padding:10px 0;border-top:1px solid var(--bn-sand)}.nlu-row:first-child{border-top:none}.bn-art .nlu-lab{font-size:16px;line-height:1.4;color:var(--bn-ink);font-weight:700}.nlu-bar{height:10px;border-radius:999px;background:var(--bn-sand);overflow:hidden}.nlu-bar i{display:block;height:10px;background:var(--bn-coral);border-radius:999px;width:0}.nlu-row.win .nlu-bar i{background:var(--bn-green)}.bn-art .nlu-sc{font-family:var(--bn-mono);font-size:16px;font-weight:700;color:var(--bn-coral-txt);text-align:right}.nlu-verdict{margin:16px 0 0;border-radius:var(--bn-r-sm);padding:16px 18px;background:#fff;border:1px solid var(--bn-border);border-left:4px solid var(--bn-green)}.nlu-verdict.ko{border-left-color:var(--bn-coral)}.bn-art .nlu-verdict b{display:block;font-size:1.06em;color:var(--bn-ink);margin-bottom:5px}.bn-art .nlu-verdict p{margin:0;font-size:16px;line-height:1.62}.bn-art .nlu-note{font-size:16px;color:var(--bn-muted);margin:14px 0 0;font-style:italic}@media(max-width:680px){.nlu-row{grid-template-columns:minmax(0,1fr) 64px 48px;gap:9px}.bn-art .nlu-lab{font-size:16px}}@media(max-width:560px){.nlu-row{grid-template-columns:minmax(0,1fr) auto;gap:7px 10px;padding:12px 0}.bn-art .nlu-lab{grid-column:1;grid-row:1}.bn-art .nlu-sc{grid-column:2;grid-row:1;text-align:right}.nlu-bar{grid-column:1\/3;grid-row:2}}.bn-art code{font-family:var(--bn-mono);font-size:16px;line-height:1.5;background:var(--bn-sand-2);border:1px solid var(--bn-sand);border-radius:6px;padding:1px 7px;color:var(--bn-ink);word-break:break-word}.bn-art pre{background:var(--bn-sand-2);border:1px solid var(--bn-sand);border-radius:var(--bn-r-sm);padding:16px 18px;overflow-x:auto;margin:22px 0}.bn-art pre code{background:none;border:none;padding:0;font-size:16px}.bn-hd{background:var(--bn-card);border:1px solid var(--bn-border);border-radius:var(--bn-r);padding:24px 26px;margin:28px 0;box-shadow:var(--bn-sh)}.bn-hd h3{margin:.1em 0 .3em}.bn-hd>p{font-size:.95em;color:var(--bn-muted);margin:0 0 18px}.bn-hd br{display:none}.bn-hd p:empty{display:none;margin:0}.hd-q{padding:15px 0;border-top:1px solid var(--bn-border)}.hd-q:first-of-type{border-top:none;padding-top:2px}.bn-art .hd-qt{font-weight:700;color:var(--bn-ink);margin:0 0 11px;font-size:16px;line-height:1.45}.hd-out{margin:22px 0 0;border-radius:var(--bn-r-sm);background:var(--bn-sand-2);border:1px solid var(--bn-sand);padding:20px 22px}.hd-head{display:grid;grid-template-columns:minmax(0,auto) minmax(0,1fr);gap:18px;align-items:center}.hd-n{font-family:var(--bn-mono);font-weight:800;line-height:1;color:var(--bn-ink);white-space:nowrap}.bn-art .hd-n span{font-size:34px}.bn-art .hd-n i{font-style:normal;font-size:16px;color:var(--bn-muted);font-weight:600}.hd-track{position:relative;height:14px;border-radius:999px;background:#fff;border:1px solid var(--bn-sand);overflow:hidden}.hd-fill{position:absolute;left:0;top:0;bottom:0;width:0;background:var(--bn-coral);transition:width .18s}.hd-parts{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:10px;margin-top:16px}.hd-part{background:#fff;border:1px solid var(--bn-sand);border-radius:var(--bn-r-sm);padding:11px 8px;text-align:center}.bn-art .hd-part span{display:block;font-family:var(--bn-mono);font-size:14px;text-transform:uppercase;letter-spacing:.05em;color:var(--bn-muted);line-height:1.3}.bn-art .hd-part b{display:block;font-family:var(--bn-mono);font-size:20px;font-weight:800;color:var(--bn-coral-txt);margin-top:4px}.hdv{display:none;margin-top:18px;border-radius:var(--bn-r-sm);background:#fff;border:1px solid var(--bn-sand);padding:17px 19px}.hdv-1{display:block;border-left:4px solid var(--bn-green)}.hdv-2{border-left:4px solid var(--bn-blue)}.hdv-3{border-left:4px solid var(--bn-coral)}.hdv-4{border-left:4px solid var(--bn-ink)}.bn-art .hdv b{display:block;font-size:18px;line-height:1.4;color:var(--bn-ink);margin-bottom:7px}.bn-art .hdv p{margin:0;font-size:16px;line-height:1.62;color:var(--bn-text)}.bn-art .hd-note{font-size:16px;color:var(--bn-muted);margin:14px 0 0;font-style:italic;line-height:1.55}@media(max-width:680px){.bn-hd{padding:20px 17px}.hd-out{padding:17px 15px}.hd-head{grid-template-columns:minmax(0,1fr);gap:12px}.hd-parts{grid-template-columns:repeat(2,minmax(0,1fr))}}\"));document.head.appendChild(s);})();<\/script><\/p>\n<div class=\"bn-art\">\n<div class=\"bn-tldr\">\n<p><strong>In short.<\/strong> A helpdesk chatbot is not judged on a deflection percentage, but on a list: the actions it is allowed to carry out on its own. Answering a question, opening a ticket, reporting its status: nobody argues about those. Resetting a password, unlocking an account, enrolling a new authentication phone: that is where internal support turns into a way in.<\/p>\n<p>On 10 August 2026 we read the text of the nineteen organic results returned by Google France for the query \u00ab chatbot helpdesk \u00bb. Not one of them writes \u00ab social engineering \u00bb, \u00ab phishing \u00bb or \u00ab identity theft \u00bb, and not one cites France\u2019s national cybersecurity agency. Yet that agency states in black and white that IT departments are being impersonated. This article fills the gap, with a proof-of-identity scale you can play with further down.<\/p>\n<\/div>\n<p>A helpdesk is the internal counter: the line an employee calls when their password stops working, when the printer on the second floor refuses to pair, when they need access to a tool they have never opened. That counter is buried under requests that repeat themselves, and the idea of putting a chatbot on it is as old as IT support itself.<\/p>\n<p>The pages selling that idea all tell the same story: available at night, never tired, it absorbs tier one and hands time back to the technicians. That is true. It is not wrong, it is incomplete, and the missing piece has a precise name: none of it says <strong>who the bot is actually talking to<\/strong>.<\/p>\n<p>A customer support chatbot picks the wrong answer and costs two minutes. An <em>internal<\/em> support chatbot that picks the wrong person hands a password to a stranger. This is not a textbook hypothesis: it is a modus operandi documented by France\u2019s national cybersecurity agency in its annual threat report. This article takes the problem in that order: what the bot really closes, who it is talking to, and what proof to require before letting it act.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Summary<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #3d351f;color:#3d351f\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #3d351f;color:#3d351f\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 eztoc-toggle-hide-by-default' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#What_a_helpdesk_chatbot_really_closes\" >What a helpdesk chatbot really closes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#Who_are_you_talking_to_The_question_the_product_pages_skip\" >Who are you talking to? The question the product pages skip<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#The_level_of_proof_has_to_follow_the_cost_of_a_mistake\" >The level of proof has to follow the cost of a mistake<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#How_much_proof_should_you_require_before_the_bot_acts\" >How much proof should you require before the bot acts?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#The_same_password_three_times_over\" >The same password, three times over<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#A_locked_account_and_the_detail_that_changes_everything\" >A locked account, and the detail that changes everything<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#Wiring_the_bot_without_opening_a_door\" >Wiring the bot without opening a door<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#What_the_company_gains\" >What the company gains<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#What_the_employee_gains\" >What the employee gains<\/a><\/li><\/ul><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#What_the_law_has_required_since_2_August_2026\" >What the law has required since 2 August 2026<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#Where_to_start_and_what_it_costs\" >Where to start, and what it costs<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#Frequently_asked_questions\" >Frequently asked questions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#What_to_take_away\" >What to take away<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/botnation.ai\/en\/helpdesk-chatbot\/#Build_the_first_brick_this_week\" >Build the first brick this week<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2 id=\"closes\"><span class=\"ez-toc-section\" id=\"What_a_helpdesk_chatbot_really_closes\"><\/span>What a helpdesk chatbot really closes<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Not every request arriving at an internal counter is the same, and mixing them up is the first scoping mistake. They fall into three families, which call for neither the same work nor the same level of trust.<\/p>\n<figure class=\"bn-fig\"><img fetchpriority=\"high\" src=\"https:\/\/botnation.ai\/wp-content\/uploads\/2026\/08\/bn-helpdesk-tri.jpg\" alt=\"A cream sorting chute drops coral, blue and green tokens into three bins of different sizes\" decoding=\"async\" width=\"1536\" height=\"1024\"><figcaption>The first job of a helpdesk chatbot is not to answer, it is to sort. The three bins never fill at the same speed.<\/figcaption><\/figure>\n<p>The first family is requests to <strong>know<\/strong>: how to connect to the VPN from abroad, where to find the expense claim procedure, which phone model is eligible for renewal. Nothing to execute, nothing to verify: what is needed is a good answer, up to date, and the ability to say it does not know. This is the natural ground of a bot plugged into a knowledge base.<\/p>\n<p>The second family is requests to <strong>record<\/strong>: report a fault, book a room, order a consumable, ask for the status of a ticket opened yesterday. The bot creates or reads an object in the ticketing tool. It opens no access, and the worst it can do is create a duplicate ticket.<\/p>\n<p>The third family is of a different nature. These are requests for <strong>access<\/strong>: forgotten password, account locked after five attempts, a new phone to enroll as an authentication factor, rights to widen on an application. They are extremely repetitive, and therefore extremely tempting to automate. They are also the only ones whose failure costs not time, but access to the information system.<\/p>\n<div class=\"bn-tablewrap\">\n<table>\n<thead>\n<tr>\n<th>Family of request<\/th>\n<th>What the bot does<\/th>\n<th>What has to be plugged in behind<\/th>\n<th>Cost of a mistake<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Know<\/td>\n<td>It answers, or it admits it does not know<\/td>\n<td>A knowledge base kept up to date, with dates<\/td>\n<td>A stale answer, a procedure followed for nothing<\/td>\n<\/tr>\n<tr>\n<td>Record<\/td>\n<td>It creates, reads and updates a ticket<\/td>\n<td>The ticketing tool, for both writing and reading<\/td>\n<td>A duplicate, a miscategorized ticket<\/td>\n<\/tr>\n<tr>\n<td>Access<\/td>\n<td>It performs an action on an account, or refuses<\/td>\n<td>The directory, the second factor, and a record of who decided<\/td>\n<td>Access handed to the wrong person<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>That third row is the subject of everything that follows. It also explains an oddity: when the large vendors describe their IT support agent, they stop right before it.<\/p>\n<figure class=\"bn-fig\"><img src=\"https:\/\/botnation.ai\/wp-content\/uploads\/2026\/08\/botnation-cap-microsoft-en.jpg\" alt=\"Screenshot of the Microsoft scenario library showing the steps of an IT helpdesk agent built with Copilot\" decoding=\"async\" width=\"1400\" height=\"900\"><figcaption>The \u00ab IT helpdesk agent \u00bb entry in the Microsoft scenario library, consulted on 10 August 2026. Five steps, none of which touches an account.<\/figcaption><\/figure>\n<p>The scenario published by Microsoft has five steps: create the agent, answer internal policy questions, check a ticket status, hand over to a human, update the support documentation. Across the 658 words of the page recorded on 10 August 2026, the words \u00ab identity \u00bb, \u00ab authentication \u00bb, \u00ab password \u00bb and \u00ab reset \u00bb do not appear once.<\/p>\n<p>This is not an oversight, it is a cautious choice: the scenario stays inside the \u00ab know \u00bb and \u00ab record \u00bb families. The problem is that the most frequent request at a helpdesk, the one that on its own justifies the project in the IT director\u2019s mind, belongs to the third family. Nobody says how to handle it, and everybody handles it anyway.<\/p>\n<div class=\"bn-call bn-info\"><svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><circle cx=\"12\" cy=\"12\" r=\"10\"><\/circle><path d=\"M12 16v-4M12 8h.01\"><\/path><\/svg>\n<div><span class=\"bn-klabel\">Worth knowing<\/span>\n<p>A helpdesk chatbot and a <a href=\"https:\/\/botnation.ai\/en\/products\/client-support\/\">customer support chatbot<\/a> are not designed the same way. The second talks to strangers about whom almost nothing is known, and everyone accepts that. The first talks to people the company knows perfectly well, which creates the comforting illusion that it knows who they are.<\/p>\n<\/div>\n<\/div>\n<h2 id=\"identity\"><span class=\"ez-toc-section\" id=\"Who_are_you_talking_to_The_question_the_product_pages_skip\"><\/span>Who are you talking to? The question the product pages skip<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The internal counter has one property customer support does not: it holds the power to hand access back. That power is exactly what makes it a target, and France\u2019s national cybersecurity agency, the ANSSI, has been documenting it for several years.<\/p>\n<figure class=\"bn-fig\"><img src=\"https:\/\/botnation.ai\/wp-content\/uploads\/2026\/08\/bn-helpdesk-identite.jpg\" alt=\"Overhead view of two hands in a cream knitted sweater holding a security key above a closed laptop, next to a blank badge\" decoding=\"async\" width=\"1536\" height=\"1024\"><figcaption>A security key, a badge, a phone. Three objects that prove an identity, and that a chatbot can neither see nor touch.<\/figcaption><\/figure>\n<p>In its <em>Panorama de la cybermenace 2025<\/em>, published in March 2026, the ANSSI devotes a whole section to social engineering. It writes: \u00ab <em>In 2025, the ANSSI observed the use of advanced social engineering techniques such as SIM swapping, MFA fatigue, identity theft and voice phishing by cybercriminal actors.<\/em> \u00bb And, a few lines further down: \u00ab <em>The ANSSI thus observed several cases of fake IT support scams, prompting employees to download RMM tools as the initial vector of compromise.<\/em> \u00bb<\/p>\n<figure class=\"bn-fig\"><img loading=\"lazy\" src=\"https:\/\/botnation.ai\/wp-content\/uploads\/2026\/08\/bn-cap-anssi-panorama.jpg\" alt=\"Excerpt from the ANSSI Panorama de la cybermenace 2025 describing social engineering techniques and the impersonation of the IT department\" decoding=\"async\" width=\"1305\" height=\"338\"><figcaption>Excerpt from page 30 of the ANSSI <em>Panorama de la cybermenace 2025<\/em>, legal deposit March 2026. The report is published in French only; the translations above are ours. The IT department is not only a victim, it is a disguise.<\/figcaption><\/figure>\n<p>The next passage is the most useful for anyone building a helpdesk. The agency describes French companies that were compromised, including luxury sector entities, and states: \u00ab <em>In at least one of the cases, the attackers are said to have impersonated the IT department in order to obtain access to a customer relationship management application.<\/em> \u00bb<\/p>\n<p>Impersonation works in both directions, and that is what makes the subject hard. The attacker can pose as support towards an employee, which is what the ANSSI describes. They can also pose as an employee towards support, and politely ask for a password reset. A chatbot placed at that counter mechanically inherits both risks.<\/p>\n<div class=\"bn-def\"><span class=\"bn-klabel\">Definition<\/span>\n<p><strong>Voice phishing.<\/strong> The ANSSI defines it as a \u00ab <em>malicious technique in which the attacker uses a telephone call to encourage the victim to disclose sensitive information or perform compromising actions, often by impersonating a trusted authority (IT department, bank, and so on)<\/em> \u00bb. Moved to written chat, the technique does not change: only the channel does.<\/p>\n<\/div>\n<p>Two recent shifts make that impersonation easier than it used to be. The first is how ordinary synthesis tools have become. In its threat summary published on 4 February 2026, the CERT-FR notes that \u00ab <em>many cybercriminals exploit deepfake services, for a few tens of dollars, for the purpose of identity theft<\/em> \u00bb. A voice on the phone is no longer proof, and neither is a writing style.<\/p>\n<p>The second shift is cultural. In its 2025 activity report, the French public service Cybermalveillance.gouv.fr ranks fake technical support scams fourth among threats to individuals, with 5.9 % of assistance requests and 18 000 cases handled, up 39 % year on year. In other words: your employees have been trained, in their private lives, to distrust anything that looks like IT assistance. They will apply that distrust to your chatbot, and they will be right to.<\/p>\n<div class=\"bn-call bn-warn\"><svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><path d=\"M12 9v4M12 17h.01M10.3 3.9L1.8 18a2 2 0 0 0 1.7 3h17a2 2 0 0 0 1.7-3L13.7 3.9a2 2 0 0 0-3.4 0z\"><\/path><\/svg>\n<div><span class=\"bn-klabel\">Common mistake<\/span>\n<p>Assuming a corporate chatbot is protected because it lives behind the intranet. As soon as you publish it on WhatsApp, on a phone number or on an open support address, it becomes reachable by someone who has no account with you at all. The question is not where the bot is hosted, it is what the channel proves at the moment of the request.<\/p>\n<\/div>\n<\/div>\n<h2 id=\"proof\"><span class=\"ez-toc-section\" id=\"The_level_of_proof_has_to_follow_the_cost_of_a_mistake\"><\/span>The level of proof has to follow the cost of a mistake<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The ANSSI offers no single recipe, and that is honest of it. In its guide <em>Recommandations relatives \u00e0 l\u2019authentification multifacteur et aux mots de passe<\/em>, published on 8 October 2021 and still current, the section on access recovery lists the possible methods, then explicitly declines to designate one.<\/p>\n<figure class=\"bn-fig\"><img loading=\"lazy\" src=\"https:\/\/botnation.ai\/wp-content\/uploads\/2026\/08\/bn-cap-anssi-r30.jpg\" alt=\"Excerpt from the ANSSI multi-factor authentication guide showing the access recovery section and recommendation R30\" decoding=\"async\" width=\"973\" height=\"524\"><figcaption>Section 4.7 and recommendation R30 of the ANSSI-PG-078 guide, version 2.0 of 8 October 2021, published in French only. \u00ab Contacting IT support \u00bb appears there as one recovery method among others.<\/figcaption><\/figure>\n<p>The text lists \u00ab <em>receiving a self-generated temporary password<\/em> \u00bb, \u00ab <em>receiving a single-use temporary reset link<\/em> \u00bb and \u00ab <em>contacting IT support<\/em> \u00bb, then draws the line: these methods \u00ab <em>come with their own problems: the choice of delivery channel (email, SMS, postal mail, telephone, and so on), the choice of validity period for temporary links, how complex these methods are for the user, whether or not a human verifier is added, and so on. This makes it very difficult to recommend any one method in particular.<\/em> \u00bb<\/p>\n<p>Recommendation R30 therefore does no more than require \u00ab <em>an access recovery method suited to the context of use<\/em> \u00bb. That is not a dodge, it is the real statement of the problem: there is no right level of proof in the abstract, there is a level of proof proportionate to what you are about to do. That is exactly what a helpdesk chatbot has to encode, and it is what the tool below turns into numbers.<\/p>\n<div class=\"bn-hd\" id=\"bn-hd\">\n<h3><span class=\"ez-toc-section\" id=\"How_much_proof_should_you_require_before_the_bot_acts\"><\/span>How much proof should you require before the bot acts?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Four questions, a risk score out of 26, and the action the chatbot is allowed to take. The scale is published: every answer carries its own number of points.<\/p>\n<div class=\"hd-q\">\n<p class=\"hd-qt\">What is being asked?<\/p>\n<div class=\"cdc-chips\">\n<label class=\"cdc-chip\" for=\"hd-a1\"><input type=\"radio\" id=\"hd-a1\" name=\"hdA\" data-p=\"0\" checked>Look up a procedure, or the status of a ticket<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-a2\"><input type=\"radio\" id=\"hd-a2\" name=\"hdA\" data-p=\"1\">Report an outage and open a ticket<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-a3\"><input type=\"radio\" id=\"hd-a3\" name=\"hdA\" data-p=\"2\">Book a room, order a consumable<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-a4\"><input type=\"radio\" id=\"hd-a4\" name=\"hdA\" data-p=\"4\">Unlock an account locked after too many attempts<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-a5\"><input type=\"radio\" id=\"hd-a5\" name=\"hdA\" data-p=\"6\">Reset a password<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-a6\"><input type=\"radio\" id=\"hd-a6\" name=\"hdA\" data-p=\"9\">Enroll a new authentication factor<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-a7\"><input type=\"radio\" id=\"hd-a7\" name=\"hdA\" data-p=\"9\">Change bank details, a payroll address, a recovery contact<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-a8\"><input type=\"radio\" id=\"hd-a8\" name=\"hdA\" data-p=\"10\">Create an account, or grant admin rights<\/label>\n<\/div>\n<\/div>\n<div class=\"hd-q\">\n<p class=\"hd-qt\">How is the requester recognized at the moment of the request?<\/p>\n<div class=\"cdc-chips\">\n<label class=\"cdc-chip\" for=\"hd-b1\"><input type=\"radio\" id=\"hd-b1\" name=\"hdB\" data-p=\"0\" checked>A corporate session open on a managed device<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-b2\"><input type=\"radio\" id=\"hd-b2\" name=\"hdB\" data-p=\"2\">A session open on a personal device<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-b3\"><input type=\"radio\" id=\"hd-b3\" name=\"hdB\" data-p=\"5\">No session: a known phone number or email address<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-b4\"><input type=\"radio\" id=\"hd-b4\" name=\"hdB\" data-p=\"7\">No session: the requester simply states who they are<\/label>\n<\/div>\n<\/div>\n<div class=\"hd-q\">\n<p class=\"hd-qt\">Which account is involved?<\/p>\n<div class=\"cdc-chips\">\n<label class=\"cdc-chip\" for=\"hd-c1\"><input type=\"radio\" id=\"hd-c1\" name=\"hdC\" data-p=\"0\" checked>A standard user<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-c2\"><input type=\"radio\" id=\"hd-c2\" name=\"hdC\" data-p=\"2\">Access to sensitive data (payroll, health, customers)<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-c3\"><input type=\"radio\" id=\"hd-c3\" name=\"hdC\" data-p=\"5\">A privileged account, an administrator or an executive<\/label>\n<\/div>\n<\/div>\n<div class=\"hd-q\">\n<p class=\"hd-qt\">What does the context of the request say?<\/p>\n<div class=\"cdc-chips\">\n<label class=\"cdc-chip\" for=\"hd-d1\"><input type=\"radio\" id=\"hd-d1\" name=\"hdD\" data-p=\"0\" checked>Nothing unusual<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-d2\"><input type=\"radio\" id=\"hd-d2\" name=\"hdD\" data-p=\"2\">An urgent, insistent request, outside working hours<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-d3\"><input type=\"radio\" id=\"hd-d3\" name=\"hdD\" data-p=\"3\">Several failed sign-ins on this account today<\/label><br>\n<label class=\"cdc-chip\" for=\"hd-d4\"><input type=\"radio\" id=\"hd-d4\" name=\"hdD\" data-p=\"4\">The authentication factor was changed less than seven days ago<\/label>\n<\/div>\n<\/div>\n<div class=\"hd-out\">\n<div class=\"hd-head\">\n<div class=\"hd-n\" id=\"hd-n-w\"><span id=\"hd-n\">0<\/span><i> \/ 26<\/i><\/div>\n<div class=\"hd-track\">\n<div class=\"hd-fill\" id=\"hd-fill\"><\/div>\n<\/div>\n<\/div>\n<div class=\"hd-parts\">\n<div class=\"hd-part\"><span>Request<\/span><b id=\"hd-pa\">0<\/b><\/div>\n<div class=\"hd-part\"><span>Recognition<\/span><b id=\"hd-pb\">0<\/b><\/div>\n<div class=\"hd-part\"><span>Account<\/span><b id=\"hd-pc\">0<\/b><\/div>\n<div class=\"hd-part\"><span>Context<\/span><b id=\"hd-pd\">0<\/b><\/div>\n<\/div>\n<div class=\"hdv hdv-1\" id=\"hd-v1\"><b>0 to 3 points: the bot handles it alone.<\/b>\n<p>The action gives away no access and changes nothing sensitive. The chatbot answers, opens the ticket, books the room. A timestamped record is enough, there is nothing else to check.<\/p>\n<\/div>\n<div class=\"hdv hdv-2\" id=\"hd-v2\"><b>4 to 8 points: the bot handles it, after strong re-authentication.<\/b>\n<p>The chatbot can go all the way, provided it asks for live proof at the moment of the action: a second factor approved on a device already enrolled, never a code sent to the very channel that was just used to ask. If the proof fails, the request moves to a human, it does not quietly disappear.<\/p>\n<\/div>\n<div class=\"hdv hdv-3\" id=\"hd-v3\"><b>9 to 14 points: the bot prepares, a human approves.<\/b>\n<p>The chatbot does everything that adds no human value: it qualifies, gathers the evidence, prepares the ticket and the decision record. But an identified technician is the one who presses the button, after an out-of-band check, for example a call back to the number already on file or an approval from the line manager.<\/p>\n<\/div>\n<div class=\"hdv hdv-4\" id=\"hd-v4\"><b>15 points and above: outside the bot\u2019s remit.<\/b>\n<p>At this level, automation becomes the weak link. The chatbot executes nothing: it takes the request, explains the procedure, opens the ticket and hands over. That refusal has to be written into the scenario, not left to the model\u2019s judgment.<\/p>\n<\/div>\n<p class=\"hd-note\">An indicative scale, to be recalibrated against your own security policy. It expresses one simple idea: the level of proof follows the cost of a mistake, not the convenience of the requester.<\/p>\n<\/div>\n<\/div>\n<p>Three examples, computed with this scale, show how far the verdict moves without the request changing at all.<\/p>\n<div class=\"bn-ex\">\n<div class=\"bn-ex-h\">\n<div class=\"bn-ex-n\">1<\/div>\n<div>\n<h3><span class=\"ez-toc-section\" id=\"The_same_password_three_times_over\"><\/span>The same password, three times over<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><span class=\"bn-ex-tag\">Reset<\/span><\/p><\/div>\n<\/div>\n<p>An employee asks for a password reset from a session already open on a company-managed workstation. Standard account, nothing unusual. The request is worth 6 points, recognition 0, account 0, context 0: <strong>6 points out of 26<\/strong>, the bot handles it after strong re-authentication. That is the nominal case, and it is perfectly automatable.<\/p>\n<p>Same request, but the requester has no session at all: they simply state who they are on an open channel, the account belongs to an administrator, and its authentication factor was changed five days ago. You move to 6 + 7 + 5 + 4, that is <strong>22 points out of 26<\/strong>: outside the bot\u2019s remit. The scenario has to refuse, explain and transfer.<\/p>\n<\/div>\n<div class=\"bn-ex\">\n<div class=\"bn-ex-h\">\n<div class=\"bn-ex-n\">2<\/div>\n<div>\n<h3><span class=\"ez-toc-section\" id=\"A_locked_account_and_the_detail_that_changes_everything\"><\/span>A locked account, and the detail that changes everything<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><span class=\"bn-ex-tag\">Unlock<\/span><\/p><\/div>\n<\/div>\n<p>Unlocking an account after too many failed attempts is worth 4 points, which makes it the least costly of the sensitive actions. From a session open on a personal device, on a standard account, you are at 6 points: the bot can do it after re-authentication.<\/p>\n<p>Add a single piece of context, \u00ab several failed sign-ins on this account today \u00bb, and the total moves to <strong>9 points out of 26<\/strong>. The verdict changes: the bot prepares the file, a human approves. That detail is precisely what separates an absent-minded employee from an attempt in progress.<\/p>\n<\/div>\n<div class=\"bn-call bn-tip\"><svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><path d=\"M9 18h6M10 22h4M12 2a7 7 0 0 0-4 12.7V17h8v-2.3A7 7 0 0 0 12 2z\"><\/path><\/svg>\n<div><span class=\"bn-klabel\">Tip<\/span>\n<p>The rule that does the most damage when it is forgotten fits in one sentence: <strong>never send the proof to the channel that was just used to ask<\/strong>. A code texted to a requester who introduced themselves by text proves nothing at all, it only confirms that the person is holding the phone they have just used. That is exactly what the SIM swapping cited by the ANSSI defeats.<\/p>\n<\/div>\n<\/div>\n<h2 id=\"wiring\"><span class=\"ez-toc-section\" id=\"Wiring_the_bot_without_opening_a_door\"><\/span>Wiring the bot without opening a door<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Going from principle to a running chatbot takes seven decisions, in this order. The first three are taken before a single line of scenario is written.<\/p>\n<figure class=\"bn-fig\"><img loading=\"lazy\" src=\"https:\/\/botnation.ai\/wp-content\/uploads\/2026\/08\/bn-helpdesk-brancher.jpg\" alt=\"A cream binder whose pages turn into colored cards feeding into the slot of a machine, with a closed padlock beside it\" decoding=\"async\" width=\"1536\" height=\"1024\"><figcaption>The bot knows nothing by itself. Everything it answers comes from a base that has to be fed, dated and locked.<\/figcaption><\/figure>\n<ol class=\"bn-steps\">\n<li><b>Count the real requests, not the imagined ones<\/b>Pull twelve months of tickets out of the ticketing tool and sort them into the three families. That sorting tells you what the bot will really absorb, and it often contradicts the steering committee\u2019s intuitions.<\/li>\n<li><b>Write the list of authorized actions<\/b>This is the founding document, and it fits on one page. For each action, the proof score required and what to do if the proof fails. Anything not on the list is refused by default.<\/li>\n<li><b>Choose the channel for what it proves<\/b>A widget inside the intranet inherits the corporate session, and therefore an identity already verified. A consumer messaging app only proves possession of a number. Both are legitimate, for different actions.<\/li>\n<li><b>Feed the knowledge base, with dates<\/b>The bot answers what you give it. A procedure with no update date will become a wrong answer, and nobody will know when it stopped being true.<\/li>\n<li><b>Wire the ticketing before the directory<\/b>Creating and reading tickets delivers most of the value for almost no risk. Connecting the directory and the second factor comes afterwards, once the list of authorized actions is settled and the scenarios have run in production.<\/li>\n<li><b>Keep the way out to a human always available<\/b>Not only when the bot fails: at any time, on request. A bot that keeps the user in a loop is experienced as a manoeuvre, and it pushes people to bypass the official counter, which is the worst possible security outcome.<\/li>\n<li><b>Log the decision, not just the conversation<\/b>For every sensitive action: the score computed, the proof obtained, the person or the rule that decided, the timestamp. That is what lets you understand after the fact, and it is what the audit will ask for.<\/li>\n<\/ol>\n<div class=\"bn-cols\">\n<div class=\"bn-col biz\">\n<h4><span class=\"ez-toc-section\" id=\"What_the_company_gains\"><\/span><svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><path d=\"M3 21h18M5 21V7l8-4v18M19 21V11l-6-4\"><\/path><\/svg>What the company gains<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<ul>\n<li>Requests to know and to record leave the queue<\/li>\n<li>Technicians handle incidents, not passwords<\/li>\n<li>Every sensitive action leaves a usable record<\/li>\n<li>The security policy becomes executable instead of being a document<\/li>\n<\/ul>\n<\/div>\n<div class=\"bn-col cli\">\n<h4><span class=\"ez-toc-section\" id=\"What_the_employee_gains\"><\/span><svg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><path d=\"M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2\"><\/path><circle cx=\"12\" cy=\"7\" r=\"4\"><\/circle><\/svg>What the employee gains<span class=\"ez-toc-section-end\"><\/span><\/h4>\n<ul>\n<li>An immediate answer at ten at night on a Sunday<\/li>\n<li>An interlocutor who does not judge the question asked<\/li>\n<li>The same journey whatever the site or the country<\/li>\n<li>An explanation when the bot refuses, not a wall<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2 id=\"law\"><span class=\"ez-toc-section\" id=\"What_the_law_has_required_since_2_August_2026\"><\/span>What the law has required since 2 August 2026<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The European artificial intelligence act, Regulation (EU) 2024\/1689, has applied since 2 August 2026. Its Article 50(1) speaks directly to every chatbot, internal ones included.<\/p>\n<blockquote>\n<p>Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use.<\/p>\n<\/blockquote>\n<p>For a helpdesk the obligation is easy to satisfy, and it serves the subject of this article. Announcing that you are talking to a machine also gives the employee a way to recognize the official counter, and to distrust anything that does not look like it. An explicit welcome sentence, a name that does not pretend to be human, and a reminder of the address or number the company actually uses to contact its people.<\/p>\n<p>Two reflexes complete the picture, without turning any of it into a project. The bot asks only for what it genuinely uses to handle the request, and nothing more. And logs containing identifiers or authentication material get a retention period decided in advance, not a default one.<\/p>\n<h2 id=\"start\"><span class=\"ez-toc-section\" id=\"Where_to_start_and_what_it_costs\"><\/span>Where to start, and what it costs<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The right first brick is not the most impressive one: it is the one that handles the first two families of requests, with a way out to a human that actually works. It goes live quickly, it touches no account, and it produces the material you will need for the rest, namely the real list of what people ask for.<\/p>\n<figure class=\"bn-fig\"><img loading=\"lazy\" src=\"https:\/\/botnation.ai\/wp-content\/uploads\/2026\/08\/botnation-cap-botnation-support-en.jpg\" alt=\"Screenshot of the Botnation product page for a customer support chatbot, with an example conversation\" decoding=\"async\" width=\"1500\" height=\"950\"><figcaption>The support product page on botnation.ai, captured on 10 August 2026. Botnation does not yet publish an English page dedicated to IT support; the French one exists. Qualify, guide, escalate: three verbs that describe the first brick well.<\/figcaption><\/figure>\n<p>On a no-code platform such as <a href=\"https:\/\/botnation.ai\/en\/products\/client-support\/\">Botnation for support<\/a>, that first brick is built without development: intents, answers, a connector to the ticketing tool, and an escalation rule. Moving to the third family, on the other hand, is not an interface question: it is a security policy question, and it is settled with the team that owns it.<\/p>\n<figure class=\"bn-fig\"><img loading=\"lazy\" src=\"https:\/\/botnation.ai\/wp-content\/uploads\/2026\/08\/botnation-cap-tarifs-en.jpg\" alt=\"Botnation pricing grid showing the For free, Basic, Pro and Entreprise plans\" decoding=\"async\" width=\"1500\" height=\"950\"><figcaption>Pricing grid recorded on botnation.ai on 10 August 2026, in euros when the page is opened from the European Union. The Entreprise plan explicitly lists \u00ab Chatbot creation management \u00bb.<\/figcaption><\/figure>\n<p>On budget, the order of magnitude for a platform can be read on the public grid: a free plan at 0 \u20ac, a Basic plan at 39 \u20ac per month, a Pro plan at 59 \u20ac per month, and an Entreprise plan on demand. These are platform prices, not project prices. Botnation publishes a no-code platform <strong>and<\/strong> builds bespoke chatbots for its clients, through the Entreprise plan and its chatbot creation experts; a helpdesk project is then quoted <a href=\"https:\/\/botnation.ai\/en\/contact\/\">on request<\/a>, because it depends entirely on the number of connectors and on the scope of the authorized actions.<\/p>\n<p>A third-party agency remains perfectly legitimate, in particular if you already have an integrator working on your ticketing tool, or a very specific business process to model. The difference, when the team that builds is also the team that publishes the platform, lies in what comes after: there is no bespoke development to take over, and the account, the scenarios and the base stay in the client\u2019s name, editable in the editor.<\/p>\n<h2 id=\"faq\"><span class=\"ez-toc-section\" id=\"Frequently_asked_questions\"><\/span>Frequently asked questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<details class=\"bn-faq\">\n<summary>Can a helpdesk chatbot reset a password?<\/summary>\n<div class=\"bn-faq-b\">\n<p>Yes, provided the proof of identity is supplied at the moment of the action and not at the moment of the request. In practice: a corporate session already open, or an approval on a second factor enrolled in advance on a known device. What proves nothing is a code sent to the channel that was just used to write, or a series of questions about a date of birth and a manager\u2019s name, two pieces of information an attacker obtains in minutes.<\/p>\n<\/div>\n<\/details>\n<details class=\"bn-faq\">\n<summary>What is the difference between a helpdesk chatbot and a customer support chatbot?<\/summary>\n<div class=\"bn-faq-b\">\n<p>The audience and the power. Customer support talks to people the company does not know, about subjects that rarely engage the security of the information system. The helpdesk talks to identifiable employees, but it can hand access back. That power is what imposes a proof scale, whereas customer support does without one most of the time. The understanding mechanism is the same in both cases: it is described in detail in our article on <a href=\"https:\/\/botnation.ai\/en\/how-chatbots-work\/\">how chatbots work<\/a>.<\/p>\n<\/div>\n<\/details>\n<details class=\"bn-faq\">\n<summary>Do you need a language model, or are rules enough?<\/summary>\n<div class=\"bn-faq-b\">\n<p>The two coexist very well, provided each is put where it belongs. A generative engine plugged into your documentation is excellent for the \u00ab know \u00bb family, because it absorbs the phrasings nobody anticipated. For the \u00ab access \u00bb family, the path has to stay a deterministic scenario: it is a chain of verifiable conditions, not a conversation. You do not delegate the decision to hand back access to a probabilistic model.<\/p>\n<\/div>\n<\/details>\n<details class=\"bn-faq\">\n<summary>How many requests does a helpdesk chatbot really absorb?<\/summary>\n<div class=\"bn-faq-b\">\n<p>No generic figure applies to your company, and trusting the ones printed everywhere amounts to buying a clothing size at random. The only honest calculation starts from your own tickets: sort twelve months of history into the three families and you get your theoretical ceiling. What is actually reached then depends on the quality of the knowledge base and on how clear the way out to a human is.<\/p>\n<\/div>\n<\/details>\n<details class=\"bn-faq\">\n<summary>Does the chatbot have to say it is a machine?<\/summary>\n<div class=\"bn-faq-b\">\n<p>Yes. The European artificial intelligence act has applied since 2 August 2026, and its Article 50 requires that people be informed they are interacting with an AI system, unless this is obvious from the circumstances. On a helpdesk it is good practice anyway: an internal counter that announces itself is a counter people can recognize, and therefore distrust when a copy takes its place.<\/p>\n<\/div>\n<\/details>\n<details class=\"bn-faq\">\n<summary>Can the helpdesk be opened on WhatsApp or by phone?<\/summary>\n<div class=\"bn-faq-b\">\n<p>Yes for the \u00ab know \u00bb and \u00ab record \u00bb families, which gain enormously from being reachable where employees already are, especially on industrial sites and on the move. No, as things stand, for actions that touch access: those channels only prove possession of a number, and the SIM swapping cited by the ANSSI targets exactly that possession. The same bot can serve both audiences, provided the list of authorized actions depends on the channel.<\/p>\n<\/div>\n<\/details>\n<h2 id=\"takeaway\"><span class=\"ez-toc-section\" id=\"What_to_take_away\"><\/span>What to take away<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A successful helpdesk chatbot is not a bot that answers everything. It is a bot whose permitted actions are precisely known, and which refuses the rest in a predictable way.<\/p>\n<p>Four questions to ask before launching the project, or to ask the supplier proposing it to you.<\/p>\n<ul>\n<li><strong>What is the list of authorized actions<\/strong>, and what happens to everything that is not on it?<\/li>\n<li><strong>What proof of identity is required<\/strong> for each one, and through which channel does that proof arrive?<\/li>\n<li><strong>What happens when the proof fails<\/strong>? A transfer to a human, or a silent dead end that will push the user to bypass the counter?<\/li>\n<li><strong>What is in the logs<\/strong> six months later: the conversation alone, or the decision, the proof and the timestamp?<\/li>\n<\/ul>\n<p>An internal helpdesk that also handles human resources requests raises exactly the same questions, with data that is more sensitive still: the subject is developed on our page dedicated to the <a href=\"https:\/\/botnation.ai\/en\/industries\/hr-chatbot\/\">HR chatbot<\/a>, and setting up a complete internal counter in our article on the <a href=\"https:\/\/botnation.ai\/en\/chatbot-company\/\">chatbot for companies<\/a>.<\/p>\n<div class=\"bn-cta\">\n<h3><span class=\"ez-toc-section\" id=\"Build_the_first_brick_this_week\"><\/span>Build the first brick this week<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Create a chatbot for free, plug it into your internal procedures and watch what your teams actually ask it. That list, and nothing else, is what will tell you where to draw the line of authorized actions.<\/p>\n<p><a class=\"bn-cta-btn\" href=\"https:\/\/botnation.ai\/en\/products\/client-support\/\">Create my support chatbot<\/a><\/p>\n<p><a href=\"https:\/\/botnation.ai\/en\/contact\/\" style=\"color:#f6c9c6\">Or have a project quoted by our chatbot creation experts<\/a><\/p>\n<\/div>\n<p style=\"font-size:16px;color:#6d6653;font-style:italic;margin-top:26px\">Sources: ANSSI, <em>Panorama de la cybermenace 2025<\/em>, legal deposit March 2026, ISSN 2970-8818, page 30; ANSSI, <em>Recommandations relatives \u00e0 l\u2019authentification multifacteur et aux mots de passe<\/em>, guide ANSSI-PG-078 version 2.0, published on 8 October 2021, section 4.7 and recommendation R30; CERT-FR, <em>L\u2019IA g\u00e9n\u00e9rative face aux attaques informatiques : synth\u00e8se de la menace en 2025<\/em>, 4 February 2026, TLP:CLEAR; Cybermalveillance.gouv.fr, <em>Rapport d\u2019activit\u00e9 2025<\/em>, page 52; Regulation (EU) 2024\/1689 of 13 June 2024, Article 50 and Article 113, English text of the Official Journal of the European Union; Microsoft Adoption scenario library, \u00ab IT helpdesk agent \u00bb entry, consulted on 10 August 2026; pricing and support pages of botnation.ai, consulted on 10 August 2026. The four ANSSI, CERT-FR and Cybermalveillance sources are published in French only and the translations are ours. The reading of the nineteen organic results for the query \u00ab chatbot helpdesk \u00bb was carried out on 10 August 2026 on Google France.<\/p>\n<\/div>\n<p><script>(function(){var r=document.getElementById(\"bn-hd\");if(!r){return;}var G=[\"hdA\",\"hdB\",\"hdC\",\"hdD\"],O=[\"hd-pa\",\"hd-pb\",\"hd-pc\",\"hd-pd\"],MAX=26;function up(){var t=0,i,k,el,v;for(i=0;i<4;i++){el=r.querySelector(\"input[name='\"+G[i]+\"']:checked\");v=el?parseInt(el.getAttribute(\"data-p\"),10):0;t=t+v;document.getElementById(O[i]).textContent=String(v);}document.getElementById(\"hd-n\").textContent=String(t);document.getElementById(\"hd-fill\").style.width=Math.round(t*100\/MAX)+\"%\";var lvl=1;if(t>3){lvl=2;}if(t>8){lvl=3;}if(t>14){lvl=4;}for(k=1;k<5;k++){document.getElementById(\"hd-v\"+k).style.display=(k===lvl?\"block\":\"none\");}}r.addEventListener(\"change\",up);up();})();<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In short. A helpdesk chatbot is not judged on a deflection percentage, but on a list: the actions it is allowed to carry out on its own. Answering a question, opening a ticket, reporting its status: nobody argues about those. Resetting a password, unlocking an account, enrolling a new authentication phone: that is where internal [&hellip;]<\/p>\n","protected":false},"author":8,"featured_media":31306,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[362],"tags":[],"class_list":["post-31319","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-chatbot-en"],"acf":[],"_links":{"self":[{"href":"https:\/\/botnation.ai\/en\/wp-json\/wp\/v2\/posts\/31319","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/botnation.ai\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/botnation.ai\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/botnation.ai\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/botnation.ai\/en\/wp-json\/wp\/v2\/comments?post=31319"}],"version-history":[{"count":3,"href":"https:\/\/botnation.ai\/en\/wp-json\/wp\/v2\/posts\/31319\/revisions"}],"predecessor-version":[{"id":31324,"href":"https:\/\/botnation.ai\/en\/wp-json\/wp\/v2\/posts\/31319\/revisions\/31324"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/botnation.ai\/en\/wp-json\/wp\/v2\/media\/31306"}],"wp:attachment":[{"href":"https:\/\/botnation.ai\/en\/wp-json\/wp\/v2\/media?parent=31319"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/botnation.ai\/en\/wp-json\/wp\/v2\/categories?post=31319"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/botnation.ai\/en\/wp-json\/wp\/v2\/tags?post=31319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}