The instinct when automating a service desk is often to start with the highest-volume ticket category. That's a reasonable filter, but it isn't sufficient on its own — volume alone doesn't tell you whether a request is well-suited to automation.
The better starting criteria combine volume with two other factors: how well-defined the resolution steps are, and how low the risk is if automation gets it wrong. Password resets and access requests routinely score well on all three, which is why they're a common first phase — not because they're the biggest category everywhere, but because the combination is right.
Categories with high volume but variable resolution paths — general 'my application isn't working' tickets, for instance — are usually better candidates for AI-assisted triage and routing first, with full automation following once patterns in root cause become clearer.
Whatever the starting point, publish deflection and resolution data back to the employees using the service desk. Visible improvement in response time builds the trust that later, more ambitious automation phases depend on.