Playbooks

A playbook is a written response the portal runs unattended. It is the same response verbs, in an order you chose, with the questions a person still has to answer left as questions.

What a playbook holds

A playbook is built from the response verbs and nothing else. Anything it can do on its own is something you could have dispatched by hand from a case, which keeps the blast radius of a bad playbook the same as the blast radius of a bad afternoon.

The order is yours. Where a step needs a judgement the portal cannot make, the playbook carries the question rather than a default, and the run waits for someone to answer it. A playbook that asks nothing has simply had every judgement settled in advance.

Running one

A run is attached to the customer and the case it acts in. The verbs it dispatches land on that record exactly as a hand-dispatched verb does, with the outcome each layer reported, and the operator who started the run is named on it.

That means a playbook never creates a second history. There is one record per case, whether a person or a playbook did the work.

Versions

Each run records the version of the playbook it ran.

Editing a playbook does not rewrite what already happened. An older run still says which text it followed, so a case closed months ago can be defended against the playbook as it stood that day rather than as it stands now.

Where a playbook fits

A playbook is worth writing when the same sequence keeps being typed, and worth leaving unwritten when the judgement is the whole job.

Standing decisions and standing reactions are the two halves of the same instinct: policy across customers is the decision taken once in advance, and a playbook is the reaction taken the same way every time. Both end up readable in the record.

One playbook, one run

A detection lands on a name the graph scores badly. The playbook blocks the name for that customer, isolates the endpoint that reached it, and then stops: whether to quarantine the file the endpoint wrote is the question it hands back, because that step needs someone to look at the machine. An operator answers, the last verb dispatches, and the case carries the whole run with the playbook version beside it.