Build a Triage / Routing Agent

Objective

Triage is the front door: every incoming request — a ticket, a lead, an alert, a message — must be categorized, scored for urgency, and routed to the right queue or escalated to a human. Get it wrong and P1 incidents sit in a backlog. A triage agent combines semantic classification (what kind of request?) with an ML urgency score (how bad is it?) and a routing decision. Here you'll build all three on one database, composing this cluster's intent and self-improving blocks. The same brain drives any framework or a voice agent — see Use it from your agent at the end.

Step 1: Create the category examples (semantic classifier)

A few labeled examples per category so the agent classifies incoming requests by meaning.

CREATE TABLE IF NOT EXISTS recipe_triage_examples (
  example_id INTEGER PRIMARY KEY,
  category   TEXT,                                    -- the queue this routes to
  utterance  TEXT,
  embedding  VECTOR(384)
);
INSERT INTO recipe_triage_examples (example_id, category, utterance) VALUES
 (1,'security','Someone logged into my account from another country.'),
 (2,'security','I think my data was exposed in a breach.'),
 (3,'billing','I was overcharged on my last invoice.'),
 (4,'billing','My payment failed and I need to fix it.'),
 (5,'bug','The app crashes every time I export.'),
 (6,'bug','I get a server error when saving.'),
 (7,'howto','How do I invite a teammate?'),
 (8,'howto','Where do I change my notification settings?');
UPDATE recipe_triage_examples SET embedding = EMBED(utterance);

Step 2: Train an urgency-scoring model (AutoML)

Learn from past requests which signals predict a true emergency.

CREATE TABLE IF NOT EXISTS recipe_triage_history (
  hist_id        INTEGER PRIMARY KEY,
  is_security    INTEGER,                             -- 1 if a security category
  users_blocked  INTEGER,                             -- how many users impacted
  revenue_risk   INTEGER,                             -- 1 if paying/at-risk revenue
  mins_open      INTEGER,                             -- how long it has been open
  emergency      INTEGER                              -- label: 1 = page someone now
);
INSERT INTO recipe_triage_history
 (hist_id, is_security, users_blocked, revenue_risk, mins_open, emergency) VALUES
 (1,1,1,1,10,1),(2,0,1,0,120,0),(3,1,50,1,5,1),(4,0,1,1,15,0),
 (5,1,1,1,20,1),(6,0,2,0,90,0),(7,1,30,1,8,1),(8,0,1,1,12,0),
 (9,1,1,1,25,1),(10,0,1,0,75,0),(11,1,40,1,6,1),(12,0,1,1,18,0),
 (13,1,1,1,14,1),(14,0,3,0,110,0),(15,1,60,1,4,1),(16,0,1,1,16,0),
 (17,1,1,1,22,1),(18,0,2,0,80,0),(19,1,45,1,7,1),(20,0,1,1,13,0);
CREATE EXPERIMENT triage_urgency_exp AS
SELECT is_security, users_blocked, revenue_risk, mins_open, emergency AS target
FROM recipe_triage_history
WITH (
  task_type = 'binary_classification',
  target_column = 'target',
  optimization_metric = 'auc',
  algorithms = ['logistic_regression', 'random_forest', 'gradient_boosting'],
  validation_strategy = 'stratified_kfold',
  n_folds = 3,
  max_trials = 15
);
DEPLOY MODEL triage_urgency FROM EXPERIMENT triage_urgency_exp;

Step 3: Classify an incoming request

Route "someone broke into my account" to a category by meaning.

SELECT category, AVG(similarity) AS confidence
FROM (
  SELECT category,
         COSINE_SIMILARITY(embedding, EMBED('a stranger accessed my account and changed my password')) AS similarity
  FROM recipe_triage_examples
  ORDER BY similarity DESC
  LIMIT 4
)
GROUP BY category
ORDER BY confidence DESC
LIMIT 1;

Step 4: Score the request's urgency

Feed the request's signals to the model — a security event impacting a paying user is an emergency.

SELECT AUTOML.PREDICT('triage_urgency', 1, 1, 1, 12) AS emergency_probability;

Step 5: Combine category + urgency into a routing decision

Turn the category and the urgency score into a concrete queue + escalation action.

SELECT
  'security' AS category,
  AUTOML.PREDICT('triage_urgency', 1, 1, 1, 12) AS urgency,
  CASE
    WHEN AUTOML.PREDICT('triage_urgency', 1, 1, 1, 12) >= 0.6 THEN 'security-queue | PAGE on-call now'
    ELSE 'security-queue | normal SLA'
  END AS route;

Step 6: Contrast with a low-urgency how-to

Classify and route a benign question — same pipeline, very different action.

SELECT category, AVG(similarity) AS confidence
FROM (
  SELECT category,
         COSINE_SIMILARITY(embedding, EMBED('how can I add another person to my workspace?')) AS similarity
  FROM recipe_triage_examples
  ORDER BY similarity DESC
  LIMIT 4
)
GROUP BY category
ORDER BY confidence DESC
LIMIT 1;

Cleanup (Optional)

DROP TABLE IF EXISTS recipe_triage_examples;
DROP TABLE IF EXISTS recipe_triage_history;

Expected Outcomes

• Step 3 classifies the account-breach message as security by meaning.
• Step 4 scores it a high emergency probability — security + revenue risk + user blocked.
• Step 5 routes it to the security queue and pages on-call because urgency cleared the threshold.
• Step 6 classifies the teammate-invite question as howto — same pipeline, routed to self-serve with no page.

You've built a triage agent that categorizes by meaning, scores urgency with ML, and routes confidently — on one database.

Use it from your agent (framework-agnostic — this is the whole point)

The triage brain is just a classifier + an urgency model + a routing rule, so any agent shell drives it with no framework lock-in:

• REST / SDK — POST /v1/query/execute (any language), or @synapcores/sdk client.executeQuery(...). On each incoming item your agent runs classify (Step 3) → score (Step 4) → decide (Step 5) and acts on route — assign the queue, page on-call, or self-serve.
• MCP (native, on by default) — point any MCP client (Claude Code, Cursor, a custom loop, a voice runtime) at ws://<your-instance>/mcp?token=<jwt> (JWT from one POST /v1/auth/login → access_token). The query tool classifies, scores, and decides; the execute tool logs the routing and adds new examples — triage as tool calls.
• Any framework — OpenClaw, a LangGraph router, a custom loop, or a voice intake line that triages callers in real time all call the same brain. The database is the brain; the framework is swappable.

Key Concepts Learned

• Triage = semantic classification (what kind?) + ML urgency scoring (how bad?) + a routing rule (where to?).
• Embedding labeled examples gives a training-free, add-by-insert classifier; AutoML supplies the urgency score.
• One CASE over category + urgency turns the two signals into a concrete, auditable routing action.
• Because it's plain data ops (SQL + AutoML / REST / MCP), the triage agent works from any framework — the agent-agnostic backend pattern this cluster builds on.