Halo has shared its AI strategy for 2026 across three pillars: platform intelligence, embedded agents, and headless integration via MCP. Every capability announced — from machine learning clustering to a full agent oversight console — runs inside the existing Halo licence. No AI add-ons, no per-call metering.
Understand your data better
Halo today groups tickets using K-means clustering. Working with 813 real tickets, the engine produces 20 named incident clusters — "Laptop and Dock Performance Issues", "Corporate VPN Failures", "Account Access and Password Reset" — each with a plain-language summary and a suggested resolution. Tickets that mean the same thing land in the same cluster, even when the wording differs.
Three more unsupervised learning methods are coming, each one a new lens on the same ticket data:
- HDBSCAN + BERTopic — groups tickets by semantic meaning and gives each cluster a topic label, without requiring a fixed number of groups upfront.
- Gaussian Mixture Models — soft membership scoring, so a ticket can read as 60% access issue and 30% network issue. Cross-theme patterns become visible.
- Isolation Forest — anomaly detection that surfaces novel incidents and SLA-risk spikes before they become queues.
The underlying vector database is AWS OpenSearch, embedded in the platform and included in every Halo licence. No separate infrastructure to provision, no additional cost.
Embedded agents you can trust
A live triage agent is available in Halo today. It acts under its own scoped identity, inside your existing role-based permissions. Every action it takes runs through your existing structure and is attributed and fully reportable.
Ten things are coming. On the build side: an expanded tool set of built-in platform actions, a broader model range through AWS Bedrock, support for local OpenAI-compatible models, a natural language agent builder, a downloadable Agent Library of pre-built runbook-ready agents, and an MCP Marketplace with curated connections to the tools you already use.
On the trust side, three announcements stand out. Runtime Native Halo Approvals means reads run freely, but high-impact actions pause for human review in the same UI — reject, and the agent adapts. The Agent Oversight Console centralises every agent's activity in one view: what it did, why, what it consumed, and any approvals awaited. OpenTelemetry output support means standard telemetry flows from every agent step into whichever observability tooling you already run.
Halo running headless
Halo already has an open REST API and MCP that connects Claude, Copilot, and Codex directly to your service desk. Core MCP tools ship out of the box — search tickets and users, add notes, apply AI suggestions, search the knowledge base, log time, and more. A custom tool builder lets you create bespoke tools: trigger an AI ability, execute a runbook, pull report data. Scoped endpoints mean each external agent sees only the tools you choose to expose, with enterprise-grade Bearer token authentication across the full API surface.
Five things are coming on the headless side, with one announcement that changes how external agents work with Halo: Halo Blueprint. Blueprint is a queryable semantic knowledge layer — it lets any agent understand Halo's data model, how entities relate, and how your processes are structured before it acts. Tools give an agent the ability to act; Blueprint gives it the framework for understanding what it is acting on.
Alongside Blueprint: Official Halo Skills published to public directories, including one-click connect from Claude, Cursor, and Codex; full workflow execution across the whole Halo platform via MCP; and native Halo approvals for external agents — the same approval framework whether the agent is running inside Halo or connecting from outside it. External agents interact with Halo at no additional cost with no per-call metering.
What this means in practice
The three-pillar structure — Understand, Act, Integrate — is the architecture for an AI-augmented service desk that does not require a platform change or additional spend to unlock. The contrast with ServiceNow is direct: AI on ServiceNow is tiered across Foundation, Advanced, and Prime, metered by token pools, and priced separately. On Halo, the vector database, the triage agent, the oversight console, and Blueprint are all part of the base licence.
If you are evaluating Halo or looking at what AI capabilities your current platform will actually cost to enable, Allied ESM can walk you through the specifics.