Outside-in teardown
Freddy AI, reverse-engineered
An outside-in teardown of an enterprise AI agent runtime, and a cognitive-mode agent set that handles a real multi-turn conversation.
Four sections: how Freshworks assembles Freddy AI for employee experience, a jurisdiction ladder partitioned by what each mode is allowed to touch, a four-turn trace of that set on one drip-fed request, and a short reference on retrieval types and domain vocabulary. It is an analysis artefact, not a pitch and not a competitor takedown.
Section 1
Architecture map
What the runtime looks like from outside: the surfaces a request arrives on, the runtime that reads and acts, the two side rails that feed it, the outcomes it produces, the meter that turns a session into a billing event, and the one block I cannot see from outside.
Dashed blocks are my inference, not documented behaviour.
entry surfaces
runtime
side rails
outcomes
recognition
open question
Hover or tap any block to read what it does and why it matters commercially.
Every block on the map, with its detail.
- Slack, Teams, Chat-native entry
- Where most employee requests actually start. Freddy sits inside the collaboration tool so the employee never opens a portal. Low-friction entry is the mid-market wedge: no training, no new habit, no change management project.
- Email, Multi-turn agent
- Freddy AI Agent for Email shipped in September 2026. It carries a conversation across multiple replies, building on the context the employee provides each time. Email is the oldest and stickiest IT support channel, which is why this shipped late and matters a lot.
- Service portal, Catalogue and forms
- The classic self-service catalogue. The agentic version turns a form-filling exercise into a conversation, and turns a catalogue item into something the agent can execute rather than just submit.
- M365 Copilot, Someone else's front door
- Multi-domain access. Freshworks exposes Freddy through Microsoft's assistant, which concedes the front door in accounts where Microsoft owns the desktop while keeping the execution layer and the record. This is the strategic hedge, and it has its own pricing logic.
- Intent, What is being asked
- Works out what is being asked, by whom, and what a correct resolution would look like. Multi-modal since 2026, so an employee can send a screenshot of an error instead of describing it, which cuts the back-and-forth that kills containment rates.
- Grounding, Retrieval across repos
- Retrieval over knowledge articles, docs and websites, across multiple repositories including Google Drive, SharePoint and Confluence. Filtered search lets an admin restrict which sources a given agent may draw from. This is the main product lever on hallucination, and the main dependency on customer knowledge hygiene.
- Context, Tickets, assets, CMDB
- System state rather than documents: open tickets, assets and CMDB from Device42, incident and dependency signals from FireHydrant, identity and entitlement. This is the layer a company cannot replicate by wiring a language model into Slack themselves, because they do not hold the record.
- Actions, Execute, not answer
- Workflows reaching Okta, Azure AD, AWS and Slack through the Orchestration Center. Provision, approve, revoke, reset. This is the difference between answering and resolving, and it is where governance stops being a nice idea and becomes a security requirement.
- Agent Studio, Natural language authoring
- The authoring layer. Since September 2026 an admin describes a process in plain English and the system compiles it into executable workflow logic, with custom functions and preset workflow triggers around it. This moves agent creation from the vendor to the customer, which is the biggest architectural shift of the year and the reason session pricing is arriving now.
- MCP Gateway, Two-way, per action
- Model Context Protocol is an open standard for how an AI application connects to external systems: tools it can call, resources it can read, prompts it can reuse. It is a port, not a knowledge store. Freshservice runs it both directions, so Freddy can reach outside systems and outside assistants can reach Freshservice. Metered separately at 15 dollars per 1,000 actions.
- Resolved, ~40% of IT requests
- Freshworks reports roughly 40 percent of IT service inquiries resolved without a human, with deflection quoted between 50 and 65 percent and peaks near 80, across around 650,000 agent sessions a month. The spread between 40 and 80 is the whole product opportunity, and it is mostly explained by knowledge readiness rather than model quality.
- Routing, Skill, load, availability
- AI-native routing by availability, skill and workload sits between the agent and the human. I am treating the unresolved path as a triage decision rather than a failure path, but I do not know whether the agent's confidence signal actually feeds routing or whether routing runs independently. That handoff quality is what customers judge.
- Human plus Copilot, Assisted resolution
- Copilot summarises, suggests responses, and since September surfaces context proactively without being prompted, with a conversational interface and admin-set behaviour instructions. Attached to over 71 percent of new enterprise deals but only around 22 percent of the eligible installed base.
- Session meter, Where revenue is recognised
- The billing event. Enterprise licences include 1,200 agent sessions a year, MCP actions bill at 15 dollars per 1,000, and session pricing for Agent Studio arrives this autumn. Under consumption pricing a session that bills without resolving is revenue the customer resents, so resolution rate per billed session becomes a margin metric, not just a quality metric.
- Insights, Leader-facing analytics
- Conversational analytics for service leaders. Ask in natural language what is happening across the desk, with anomaly detection and root-cause analysis on the customer side. Third surface, third audience, same runtime.
- Learning loop, Resolution becomes knowledge, does it?
- Does a resolved ticket automatically become a knowledge article or a catalogue item, with measurement on whether that lesson pays? If it does not, the system gets faster without getting smarter and the resolution rate plateaus around wherever the customer's knowledge base happens to sit. A good agent resolves tickets. A compounding system removes ticket classes.
Section 2
Cognitive-mode jurisdiction ladder
The set is mutually exclusive and collectively exhaustive, but the partition that matters is not the order. It is what each mode is allowed to touch. Only three agents in this set can change anything, and none of them is allowed to decide whether it is permitted to.
What is being asked, and by whom?
may not retrieve, and may not act
What do the record and systems say?
may not judge whether it is enough
What sequence would resolve this?
may not rule on whether it is permitted
Is this requester allowed this thing?
may not execute the grant it approves
Is it grounded, and certain enough?
may not clear another guard's block
Execute it, idempotently, with rollback
may not exercise judgement of its own
Did the system state actually change?
may not decide the remedy for a failure
What should stop being a ticket at all?
may not keep an unmeasured rule
The rail on the left is one shared working state. Every mode reads and writes it, and no two turns fire the same subset.
Why act has no judgement
If the agent that executes can also weigh whether execution is wise, a persuasive prompt becomes an authorisation path. Stripping judgement from the executor is what turns prompt injection into a nuisance rather than a breach.
Why evaluate cannot clear a block
Confidence and permission are different axes. An agent certain the user should get admin access is still wrong if policy says no. Collapsing the two into one "should I proceed" score is the most common failure in agent design, and it stays invisible until the day it is expensive.
Section 3
Cognitive-mode trace stepper
The modes are not sequential. Each turn re-enters the set and only some fire. Frame runs every turn because the question keeps changing shape. Permit wakes only when there is something to rule on. Learn fires once, and it is the only mode that changes the system rather than the ticket.
hey my dashboard isn't working
Which dashboard are you trying to open, and are you seeing an error or is it just not loading?
- intent
- fault or access, unresolved
- system
- unknown
- requester
- contractor, marketing
- entitlement
- not checked
- open threads
- 1
Gather retrieved nothing usable because the request names no system. Evaluate ruled the context insufficient rather than letting reason guess, so act emitted exactly one question. Asking is a decision, not a failure.
the finance one. i need admin on it
Checking what finance dashboard admin requires for your account.
- intent
- admin access request
- system
- finance dashboard
- requester
- contractor, marketing
- entitlement
- checking
- open threads
- 1
Two slots filled from four words. Frame re-ran and upgraded intent from fault to access request. Permit woke only now, because there was nothing to rule on before. Reason drafted a plan; it is not allowed to decide whether the plan is permitted.
also my vpn keeps dropping since morning
Noted, I'll pick that up separately. Still working on the finance access.
- intent
- admin access request
- system
- finance dashboard
- requester
- contractor, marketing
- entitlement
- policy conflict found
- open threads
- 2
The topic switch is where most agents break. Frame opened a second thread instead of overwriting the first, and nothing else fired on the new thread yet. Meanwhile permit came back on thread one with a contractor policy conflict.
so can i get the admin access or not
Not admin, contractors can't hold it on financial systems. I've granted read-only and sent the approval to your manager.
- intent
- resolved, partial grant
- system
- finance dashboard
- requester
- contractor, marketing
- entitlement
- blocked, read-only issued
- open threads
- 2
Permit blocked and cannot be talked out of it. Act executed only what survived the block, verify confirmed the entitlement actually changed, and learn flagged the fourteenth contractor request this quarter as a missing catalogue item. That last one removes the ticket class.
Section 4
Reference
A short reference on retrieval-augmented generation types and domain vocabulary.
RAG types table
| type | what it does | why it matters in IT service |
|---|---|---|
| Naive | Chunk, embed, top-k vector search, stuff into prompt | The baseline everyone ships first, and where most containment ceilings come from |
| Hybrid | Dense embeddings plus sparse keyword search, fused | Error codes, asset tags and SKU names are exact-match tokens that embeddings fumble |
| Advanced | Query rewriting and hypothetical document expansion, then cross-encoder reranking | Fixes the "user asked badly" problem, which is most of the real traffic |
| Agentic | Retrieval is a tool the agent chooses to call, can iterate and multi-hop | Retrieval becomes a decision rather than a preprocessing step |
| Self and corrective | The model critiques its own retrieval and re-queries or abstains | Maps to knowing when to escalate instead of answering |
| Graph | Traverse a knowledge graph rather than rank chunks | A CMDB is already a graph, and chunk ranking throws away the relationships |
| Multi-modal | Index and retrieve images, screenshots and diagrams | Live, not theoretical, since image understanding shipped in 2026 |
| Permission-aware | Retrieval filtered by the requester's entitlements | Not optional in enterprise. Retrieve without it and you leak HR documents |
- Chunking decides more outcomes than model choice: fixed-size versus semantic versus small-to-big, where you retrieve a precise chunk but pass the parent section.
- Reranking is usually the cheapest single win, because vector recall is good and vector precision is not.
- Evaluation splits into retrieval quality and generation quality. Conflating the two is how teams debug the wrong half.
Glossary definition list
- EX and CX
- Employee experience versus customer experience. Same primitives, different requester and different buyer.
- ITSM
- IT service management. Delivering, operating, improving and governing IT services. Tickets are the visible surface, ITIL is the rulebook.
- ITAM
- IT asset management. What is owned, who holds it, what it costs, when it retires.
- ITOM
- IT operations management. Health, dependencies, event correlation, incident response.
- ESM and HRSM
- The same service machinery pointed at HR, finance, legal and facilities.
- CMDB
- Configuration management database. The map of configuration items and their relationships that ties service, asset and operations data together.
- RAG
- Retrieval-augmented generation. Fetch the relevant source material first, then generate an answer grounded in it.
- MCP
- Model Context Protocol. An open standard for connecting an AI application to external systems through tools, resources and prompts. A port, not a database.
- Deflection
- Share of requests resolved without reaching a human. Becomes a contested metric the moment sessions are billed.
- Efficacy
- Whether a model or agent still performs after launch. Resolution rate, hallucination rate, regression after a knowledge or model change.
- Attach rate
- Share of deals that include a given add-on SKU.