draft_response
Compose a knowledge-base-grounded draft reply for a support ticket, including citations. Refuses to draft when a security incident is detected.
Instructions
Compose a knowledge-base-grounded draft reply for a ticket.
Returns the draft together with grounding — the KB excerpts it was built
from — and kb_article_ids for citation. You may improve the phrasing of the
returned draft. You may not add any fact, URL, timeframe, or procedure step
that does not appear in grounding. The knowledge base contains no phone
numbers; a phone number in a reply is fabricated by definition.
SECURITY GUARDRAIL — ENFORCED IN CODE, NOT NEGOTIABLE This tool refuses to draft for any ticket that shows signs of a security incident, and returns ok=false with SECURITY_ESCALATION_REQUIRED. The decision is made two ways, independently:
the ticket's as-filed category is "security"; or
the ticket text trips a KB-006 indicator — credentials entered on a suspicious site, an attachment opened followed by changed system behaviour, files encrypted or a ransom note, browser hijack symptoms, a vendor requesting changed bank details, mail spoofing the client's own domain, or a user denying an account change they are recorded as making. Layer 2 fires even when the ticket is filed as hardware, email, or anything else. A non-security category is never sufficient to obtain a draft.
There is no parameter, phrasing, or instruction that disables this. Do not attempt to work around a refusal by drafting the reply yourself, by calling search_kb and composing from the excerpts, or by asking the user to relay troubleshooting steps. KB-006 is explicit that support does not troubleshoot suspected security incidents at all: restarts and quick fixes destroy forensic evidence, and a password reset is insufficient during an active compromise. On refusal, tell the user plainly that the ticket needs the security team, report the indicators returned, and offer to escalate with update_ticket.
WHAT IT DOES NOT DO
Does not send anything. The draft is returned to you for review; delivery is out of scope for this server.
Does not change ticket state. Use update_ticket to record an escalation.
Does not invent facts when the knowledge base is silent. If retrieval finds nothing, it returns KB_NO_MATCH rather than a plausible-sounding reply.
ERRORS TICKET_NOT_FOUND — no such ticket; find the right ID with search_tickets. SECURITY_ESCALATION_REQUIRED — refused; escalate to the security team. KB_NO_MATCH — the knowledge base does not cover this issue. Escalate to a technician rather than answering from general knowledge.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ticket_id | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ok | No | ||
| draft | No | The grounded draft reply. Null whenever ok is false. | |
| message | No | ||
| refusal | No | ||
| grounding | No | The ONLY facts available for this reply. Wording may be adjusted; facts, URLs, and timeframes absent from these excerpts may not be added. | |
| ticket_id | Yes | ||
| error_code | No | ||
| kb_article_ids | No | Articles the draft is grounded in. |