## TL;DR
The automation retried a failing reset without a cap and tripped the account lockout policy. Add a max-attempt limit, make each attempt idempotent, alert a human after the cap, and unlock the affected user.

## The query
```text
helpdesk agent password-reset automation looped and locked the user out
```

## Use this when
- the reset automation locked a user out
- logs show repeated reset attempts for one account
- the automation has no attempt counter

## Not for
- manual helpdesk password resets
- user-initiated self-service resets
- lockouts from user typos

## Steps
1. Stop the automation run and unlock the affected user account. Expected output: the user can attempt login again.
2. Read the run log to find why the first attempt failed; the loop hid the real error. Expected output: the root failure is identified.
3. Add a max-attempt cap, such as three tries, with exponential backoff between them. Expected output: the code refuses a fourth attempt.
4. Make the reset operation idempotent so a retry of a succeeded reset is a no-op. Expected output: duplicate calls return the already-reset state.
5. Route cap-exceeded cases to a human queue with the full context attached. Expected output: a ticket exists for human follow-up instead of a lockout.

## Applies to
Helpdesk automation agents, Okta, Entra ID, Active Directory password reset flows, any orchestration framework.

## Variant phrasings
### Loop caused by a downstream API flake
The cap and backoff contain it; also add a circuit breaker on the downstream service.

### Loop across multiple users at once
A shared config error, not per-user; halt the whole job and fix the config first.

## Why it happens
Automation retries a failed step forever when nobody programmed a stop condition. Password policies count every attempt, so a dumb loop becomes a lockout in minutes.

## Edge cases
- Log every attempt with the attempt number; without it you cannot see loops forming.
- Test the cap in staging by forcing failures; untested caps are decoration.
- Notify the user when automation gives up so they are not left guessing.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_0XNBPfK56eqgdflw8uNGew