Nexthink

Remediations run on the employee's actual device, and Spark makes an authenticated round trip into the customer's ITSM, raising tickets back with the transcript. Spark's action set is enumerated as "remote actions, agent actions, workflows and others", run during a conversation, with their execution results fed back as input to the next turn. Those act on the employee's device through the Nexthink Collector, so the writes land in the customer's estate rather than in Nexthink's own record store.

ServiceNow is named explicitly for knowledge-base and ticket indexing and for the service request catalog. Spark "retrieves past incidents from a third-party ITSM system" and raises escalated tickets back into it on the employee's behalf, carrying short description, actions taken and conversation transcript: an authenticated round trip into a system Nexthink does not own.

Spark also "executes actions to retrieve and link to third-party data" on the customer's instruction. Underneath sit a native connector system, published APIs and the Nexthink Query Language, with Amplify injecting DEX context and remediations directly into the ITSM console. Spark itself is embedded in tools such as MS Teams and ServiceNow Virtual Agent.

Sourcedocs.nexthink.com/legal/global-ai-hub/spark-ai-model-card and nexthink.com/platform/integrations-infinityread 2026-09-12

Spark picks its own tools in a loop until it needs the employee, and Flow adds customer authored, event driven workflows. The model card's data flow states that "Spark's LLM may select one or more relevant tools at its disposal to gather more information". Its tools query device and user data, connect to local data sources through the Collector, search knowledge articles, the service request catalog and the available remote actions, agent actions and workflows, and retrieve past incidents from ITSM.

It then offers or executes actions, escalates, or ends the conversation, and "the process above is repeated until input from the employee is needed": a loop with runtime tool selection, not a pre-coded branch. The Spark documentation calls it an "agentic AI resolution engine" that "understands employee issues expressed in natural language, evaluates DEX data and system context, and executes IT-approved actions to resolve issues autonomously."

The second surface is customer-authored: Flow runs low-code, event-driven workflows that detect, communicate, integrate and act, and remote actions, agent actions and workflows are configuration objects the customer creates and enables, so the sequence is authored rather than fixed. Workspace is published as a central agentic cockpit for IT.

Each participant has a distinct role, from the employee who asks and the administrator who defines the approved action set to the service desk agent who receives an escalated ticket with the transcript and actions taken. A worked example runs end to end from a slow-laptop complaint through diagnosis to remediation or escalation.

Sourcedocs.nexthink.com/legal/global-ai-hub/spark-ai-model-card, /platform/user-guide/spark and nexthink.com/platform/flowread 2026-09-12

An index of the customer's own knowledge base, past tickets and resolution notes is what Spark retrieves from, alongside live device telemetry.

Spark grounds resolutions in live DEX telemetry, full endpoint context and IT knowledge, and the model card lists its knowledge sources individually, including "knowledge base articles imported by the customer into Nexthink Infinity", past ticket insights and "human-authored resolution notes from third-party systems, which provide additional knowledge Spark uses to reduce escalations".

The preprocessing section states the mechanism: "ServiceNow KB and tickets are indexed for efficient retrieval", and the implementation section adds "manual upload of files that are indexed for efficient retrieval by the AI agent". That is a maintained index over the customer's own material, standing between runs.

Retrieval is active and selective per run: Spark's LLM "selects one or more relevant tools" to search knowledge articles, search the service request catalog, and "retrieve past incidents from a third-party ITSM system to suggest remediations based on resolution notes provided by human agents".

A vendor corpus sits behind it as a bounded fallback, a "curated list of trusted websites determined by Nexthink", searched only if customer-specific sources are insufficient, optional and requiring administrator enablement. Sources used to create a response are provided to users who want to check accuracy. Real time device telemetry adds diagnostic context.

Sourcedocs.nexthink.com/legal/global-ai-hub/spark-ai-model-cardread 2026-09-12

Before an impactful fix runs, the employee sees its impact and has to answer yes, and that consent step is on by default. Spark runs only within IT-defined guardrails using approved actions, and the model card's data flow documents the gate as a sequence: Spark will "offer the user to execute actions flagged by the administrator as requiring employee consent (e.g., remediations with an impact). In this case, the impact of the action is shown to the user based on the action configuration.

After user confirmation by an explicit yes answer, the action is then executed." The risk table states the default: "Spark always requires user approval before taking issue-resolution actions unless an admin has explicitly enabled actions to execute without user consent." The hold is on by default, the administrator decides which actions may bypass it, and the person sees the impact before answering.

Three further layers each work differently. An admin-defined allowlist: "customers vet and select the remote or agent actions Spark can use for issue resolution", and actions are only available if enabled during Spark configuration. Escalation gated on the employee: Spark escalates a ticket "to the support team after a confirmation by the employee".

And a supervisor review loop, where supervisors review interactions for quality and give feedback. Inference passes through AWS Bedrock Guardrails filtering six harm categories and blocking prompt attacks, and scope is bounded so Spark cannot answer about other users or their devices.

Sourcedocs.nexthink.com/legal/global-ai-hub/spark-ai-model-card and /platform/user-guide/sparkread 2026-09-12

Granular role based access governs the AI features, backed by a deep set of data controls, though most certifications cannot be read from the trust center as rendered. The AI model card's risk table states: "Admins control access to Nexthink Spark features for IT users through role-based access control (RBAC). This RBAC mechanism allows granular user permissions, enabling specific users or groups to access or utilize AI features while others are restricted."

Employee-side access is controlled through the admin console of the channel Spark is embedded in. Around it sit secure access tokens and scope bounded so an employee reaches only their own devices and data. Data moves over HTTPS and is encrypted with AES-256 at rest, personal data fields are removed automatically when NQL queries are generated, retention is configurable by the customer, and a DPA is available.

The certifications are present but only partly readable. The trust center publishes a certification strip under Our security standards; the AICPA mark is identifiable, and four further certification images carry no alt text beyond Certification 1 through 4, so the specific standards cannot be named from the page as rendered.

The CEO's signed statement on the same page names compliance with GDPR, CCPA and the EU AI Act, and the model card adds a dedicated AI Compliance Team of legal, privacy and security experts reviewing each AI component. The Security Hub at security-hub.nexthink.com is where the four unlabeled certifications would be named.

Sourcenexthink.com/trust-center and docs.nexthink.com/legal/global-ai-hub/spark-ai-model-cardread 2026-09-12

Audit logs cover Spark's conversations, decisions and remediations, including its internal reasoning, with retention stated in days and months. The Spark documentation states that the admin surface allows "defining approved actions, workflows and governance policies, and reviewing audit logs for conversations, decisions and remediations": three objects, all of them the agent's own conduct.

The reasoning is captured, not just the outcome: Spark "may log its internal reasoning and processes for supervisor review, but does not share this information with employees", and "reasoning details for supervisor review" are listed as a first-class system output. Escalated tickets carry actions taken and the conversation transcript into the service desk, so the record travels with the work.

Retention is stated in figures: full conversation previews including employee PII are available for 30 days, and the conversation summary with its user reference is kept for 13 months, under data retention settings configured by the customer.

A named audience reads it: service desk supervisors "gain increased visibility into Spark-employee conversations, as well as resolution-performance metrics". Sources used to build a response are surfaced to the employee for checking.

Real time observability across devices, networks and applications is the product Nexthink sells to watch the customer's estate, not a record of the agent.

Sourcedocs.nexthink.com/platform/user-guide/spark and /legal/global-ai-hub/spark-ai-model-cardread 2026-09-12

Working notes last only for the conversation; no memory persists between conversations. Spark writes and stores "internal notes, not exposed to the user, to maintain context throughout multi-step interactions", which is within a conversation, and the A2A documentation matches: context is carried by reusing contextId and taskId values within a conversation thread. That is session context only.

Three things that look like memory are not. Device timelines and endpoint state are the customer's operational data, held because monitoring devices is the product. Spark improving with each interaction is absorbed learning, which the model card describes as supervisor feedback driving reinforcement learning.

The retention figures, full conversation previews for 30 days and conversation summaries for 13 months, are how long the audit record is kept for supervisors.

The model card is a legal AI disclosure that enumerates every input, output, step and storage period Spark uses, and it names no persistent agent memory, preference store or decision trace carried across conversations; an absence in a document written to be exhaustive is a strong one.

Sourcedocs.nexthink.com/legal/global-ai-hub/spark-ai-model-card and /platform/configuring_nexthink/.../spark-agent2agent-integrationread 2026-09-12

Customer data, AI processing included, stays in the customer's region, but no list of regions or way to choose one is published. The model card states it three times. Its security section says "all data is stored in the customer's region." Its description says Spark leverages "GenAI models operated by Nexthink within the Nexthink AWS environment in your region."

Its FAQ closes the loop on the AI layer: "All data processing stays entirely within the Nexthink AWS environment. When using AI functionalities hosted on AWS, all processing takes place within the AWS region aligned with the customer's Nexthink deployment." That the AI processing follows the tenant's region rather than centralizing is a real, buyer-relevant commitment, and it implies the tenant has a region.

No page names a region list, a named customer environment or a selection surface: nothing enumerates which regions exist, shows where or when a customer chooses one, or offers a dedicated environment by name. Deployment is cloud only on AWS; the Collector is an endpoint agent feeding that cloud, not a deployment option, and no self-hosted or on-premise option is documented. The Security Hub and the services terms are the likeliest places for a region list.

Sourcedocs.nexthink.com/legal/global-ai-hub/spark-ai-model-card and nexthink.com/trust-centerread 2026-09-12

A first party automation catalog of remediations, which customers vet and switch on for Spark, ships alongside a published Library. The model card lists the Nexthink automation catalog among Spark's knowledge sources and names the units it holds as "remote actions, agent actions, workflows and others".

The selection step is explicit: these actions "are only available if the customer has enabled them during Spark configuration", and "customers vet and select the remote or agent actions Spark can use for issue resolution".

A customer picking a remediation out of a catalog and switching it on, after which it does work when Spark selects it, is a selectable unit doing work when selected, and removing one remediation leaves the rest whole.

A customer-facing Library is published as its own destination at nexthink.com/library, promoted in the site navigation. Flow ships as a low-code engine for building further workflows, and the platform is sold as Infinity plus named expansion modules and named AI agents, so the packaged units extend past remediations. The Library's size and whether its entries are written by the vendor or the community are not described here; the automation catalog with its documented enable and select path stands on its own.

Sourcedocs.nexthink.com/legal/global-ai-hub/spark-ai-model-card and nexthink.com/libraryread 2026-09-12

Employees reach Spark in Teams and other enterprise chats, and the platform also fires workflows on conditions detected on devices.

Spark is "embedded in third-party enterprise chats", "such as MS Teams and other chatbot solutions", and the FAQ names four: "MS Teams, ServiceNow Virtual Agent, Moveworks, Amazon Connect, or another supported channel", with further reach through "third-party integrations via APIs" and the A2A protocol into whatever conversational front end the customer already runs.

Nexthink ships its own Microsoft Teams application, and reach extends across LLM-supported languages with a tenant fallback of English or Japanese.

The event half is the platform's own and separate from the chat entry point: Flow runs event-driven workflows that detect, communicate, integrate and act, fired by real-time alerts off endpoint telemetry rather than by an employee opening a conversation, and the platform's alerting enables proactive IT management.

Requests therefore arrive two ways, an employee asking in a channel and a condition detected on a device. Two-way employee communication ships too: outbound messaging and surveys reach employees in-app, and Spark sends progress updates and questions mid-resolution rather than only a final answer. Events, schedules and multiple channels are all documented, and the A2A protocol keeps the channel set open ended.

Sourcedocs.nexthink.com/legal/global-ai-hub/spark-ai-model-card and nexthink.com/platform/flowread 2026-09-12

The models behind Spark are named, Meta Code Llama and Claude by Anthropic, but the customer cannot choose among them. The AI Model Card states that "Nexthink Spark uses vetted and fine-tuned off-the-shelf LLMs, including Meta Code Llama and Claude by Anthropic." Two providers, disclosed by the vendor about its own stack, is disclosed vendor-side multi-model use. Spark uses "AWS Bedrock LLM APIs for agentic reasoning workflows", with models "run within AWS infrastructure using AWS Bedrock"; Bedrock is the hosting and inference layer, not a second model.

Selection is Nexthink's, made per component: no model picker, admin setting or bring your own key path appears anywhere. The customer is told which models are used and that they are fine-tuned. The model card also discloses that models are not trained by Nexthink across customers, that Spark builds no global training set from customer interactions, and that no customer or personal data is shared with or hosted by the AI tool providers themselves, such as Anthropic or Meta.

Sourcedocs.nexthink.com/legal/global-ai-hub/spark-ai-model-cardread 2026-09-12

Third party agents can discover and invoke Spark over a published, vendor neutral A2A API, documented at setup guide depth. The Spark Agent2Agent integration documents A2A, an open standard letting third-party agents "discover, invoke, and track Spark capabilities, including querying rich device and user insights, executing safe and guardrailed actions, receiving asynchronous callbacks, and presenting clear, human-readable outcomes."

Spark "exposes its agent card" to a primary AI agent, which reads it and routes the employee request to Spark as a subagent, with contextId and taskId carried across turns and responses returned to a configured webhook over "authenticated, service-to-service communication". The page is a step-by-step setup guide for "the public vendor-neutral API", with outside agents calling in.

The wider developer estate sits on its own host: docs.nexthink.com carries the platform documentation, a legal and AI hub, and an llms.txt index at docs.nexthink.com/legal/llms.txt, with markdown versions of each page. Alongside it are the Nexthink Query Language, published APIs and Amplify, which injects Nexthink context into the customer's ITSM. Spark also runs inside third party systems such as MS Teams and Moveworks, which invoke Nexthink rather than the reverse.

Sourcedocs.nexthink.com A2A integration guide and /legal/global-ai-hub/spark-ai-model-cardread 2026-09-12

Spark model updates are validated against test datasets with precision and recall, and a feedback loop scoped to each tenant runs on top.

The Spark AI Model Card, under Evaluation data, states that "Nexthink employs a set of performance metrics, including precision, recall and proprietary in-house metrics, tailored to specific components of the system.

Test datasets are used to validate model updates, ensuring that the AI system's accuracy and reliability align with company standards." A change is under test, the test set is named as such, and precision and recall are readable comparable results.

A controlled post-deployment loop runs alongside, and this half is the customer's: "supervisors assess Spark conversation logs and provide feedback, which is applied in reinforcement learning cycles, helping to identify inaccuracies and improve model performance", with that learning "made available to the Spark agent only when processing conversations from their employees", so it is scoped to the tenant rather than pooled.

The system tracks metrics "such as resolution success rate and escalation frequency to measure the effectiveness of Spark", and supervisors get resolution-performance metrics. DEX scoring, benchmarking against fifteen million endpoints and AI adoption measurement all look at the customer's estate, not the agent. The precision-and-recall harness is Nexthink's own and gates Nexthink's model updates; no customer-run sandbox for testing a changed action or workflow before it reaches employees is documented.

Sourcedocs.nexthink.com/legal/global-ai-hub/spark-ai-model-cardread 2026-09-12

Devices are fixed through scripted actions run by an endpoint agent, not by operating a screen. Spark resolves issues by running "remote actions, agent actions, workflows and others" through the Nexthink Collector installed on the device, and by "connecting to local data sources via the Nexthink Collector for secure, accurate, and timely troubleshooting". Scripted remediation against an endpoint agent is machine-to-machine execution, and working through a terminal or shell is not the same as operating a screen.

Breakage from a changed screen layout does not apply, because nothing it does depends on what is drawn on screen: remediations target processes, services, configuration and files, not windows and buttons. No browser session, desktop control or RPA fallback appears in the model card's exhaustive enumeration of inputs, outputs and data flow. Spark can search a curated set of external web resources when customer knowledge is insufficient, but that is retrieval from a vendor curated allowlist.

Sourcedocs.nexthink.com/legal/global-ai-hub/spark-ai-model-card and /platform/user-guide/sparkread 2026-09-12