01. Wiki rot
Confluence playbooks
Written once, drift forever. Disconnected from the thing doing the work. The only honest version lives in someone’s head.
A visual, reusable, triggerable pipeline. The canvas is not a drawing of the configuration. The canvas is the configuration interface.
Drop a node, and infrastructure materialises beneath it. Run the runbook and the DAG walks itself: source, staging, view, enrichment, action and evidence-grade case output.
1. The Premise
A runbook is a visual, reusable, triggerable pipeline. Drop a node, and infrastructure materialises beneath it. Run the runbook and the DAG walks itself.
“Manual runbooks drift when they sit apart from the work. A manifested runbook keeps the playbook in the system, so authorised teams can tune what happens next and rely on the process to run consistently.”
Reasoning Canvas principle
2. What Runbooks Replace
These show up in many organisations. A runbook makes each one operational rather than aspirational.
01. Wiki rot
Written once, drift forever. Disconnected from the thing doing the work. The only honest version lives in someone’s head.
02. Hardcoded pipelines
Inflexible by design. A policy tweak means a code change, operators cannot shape the flow directly, and bespoke work piles up.
03. Ad-hoc work
Unrepeatable. The artefacts survive but the process does not. Analysts answer differently and nobody can prove why.
3. Anatomy
Each node maps to an operational layer in the runbook. The canvas remains the controlled configuration surface.
When the runbook runs, it walks this graph in topological order. Source nodes collect approved data. View nodes scope it. Enrich nodes classify it. Action nodes produce case outputs. The colours map to capability layers.
| Lane | Node type | Materialises as | Status surface |
|---|---|---|---|
| Sources | source | Approved data locations, custodians and connectors | Collection readiness and progress |
| Staging | intake | Normalised evidence set ready for review and automation | Evidence intake progress |
| Views | view | Reusable filtered lens over the collected material | Scoped view readiness |
| Enrich | enrich | Classification, extraction, confidence and review rules | Enrichment progress and review state |
| Actions | action | Case creation, export packs, notifications and hand-off tasks | Output-specific action status |
4. Canonical Example
This runbook shows the platform pattern end to end. Each step is a node on the canvas. Each step turns into infrastructure.
Value
Three of these a week, each delivered as a completed case with drill-down through the knowledge graph. They tune the runbook over time and it gets better.
Operational metric
Data pull, knowledge-graph build, affected-people lookup and report drafting. Reduce repeated manual investigation effort and measure the time returned to the security team.
5. Execution Models
Same DAG, different relationship to cases. Pick once at authoring time.
Mode 1. Ongoing
A single monitoring case. The pipeline re-runs on each trigger; new data flows through the same DAG into the same case. Continuous compliance monitoring lives here.
Mode 2. Triggered
Each trigger spawns a new case. The monitoring case becomes a dashboard; the triggered cases are investigations. Malicious URL response and DSAR intake live here.
6. Triggers
Manual, scheduled and polling triggers are available now; webhook and platform-event triggers are planned extensions.
| Type | Mechanism | Canonical use | Status |
|---|---|---|---|
| Manual | User clicks Run and fills slot dialog | Ad-hoc investigation | Live |
| Schedule | Temporal cron workflow | Nightly compliance sweep | Live |
| Poll | Scheduled interval pattern | Watch for new detections matching criteria | Live |
| Webhook | External POST to controlled endpoint | Security alert integration | Planned |
| System event | Platform event match | Platform-generated events | Planned |
7. The Core
Sources move bytes. Views filter them. Actions produce outputs. Enrich is where meaning gets attached and where the human authors the contract the model is held to.
Each LabelDefinition already has a ValueMode. Three options, mutually exclusive.
ValueSet
Predefined LabelAllowedValue entries. Example: Data Category - Financial, Health, Employment, Communications.
FreeText
Open-ended annotation such as reviewer notes on a triage, useful when the answer space cannot be enumerated.
Standalone
No value at all. The label being applied is the signal, for example Contains PII as a binary flag.
LabelAllowedValue.ParentLabelAllowedValueId already lets values nest. The AI classifies at the leaf; the parent is a grouping affordance for the review UI.
Data Category (LabelDefinition) Financial Data Bank Statements Tax Records Investment Docs Health Data Medical Records Insurance Claims Employment Data Communications Data
Author the taxonomy once; the model navigates it. “Show me all Financial items” expands the tree in the review UI.
The current model creates one LabelApplied row per value, so multi-value is technically possible. The gap is that nothing tells the AI or backend whether to pick one or many.
public enum LabelCardinalityMode
{
PickOne = 0, // Exactly one value. AI picks the single best match.
PickBest = 1, // Same as PickOne for AI, but UI shows confidence + override.
PickMany = 2 // AI tags all that apply. Multiple LabelApplied rows.
}
| Mode | Prompt instruction | Backend assertion | UI rendering |
|---|---|---|---|
| PickOne | Select exactly one value from the list. | Reject if >1 row per Detection | Radio buttons |
| PickBest | Select the single most appropriate value. | Reject if >1 row per Detection | Radio + confidence + override |
| PickMany | Select all values that apply. | No constraint, 0..N rows | Checkboxes |
The label configuration drives the prompt. There is no separate AI instruction system; the user authors the contract and the pipeline materialises it.
Each label gets two thresholds, per LabelDefinition, not global. Sensitivity might run hot at 80/60; Topic might run loose at 60/30.
AutoApplyThresholdReviewBandFloorWhen the runbook reaches an enrich node, six things happen in order.
The enrich node reuses the existing pipeline. The new work is cardinality enum, thresholds and prompt-injection logic that reads label configuration.
8. The Schema
Six entities, two new columns and one new FK in the source model; the implementation list below also captures the review floor field explicitly.
| Table | Field | Type | Purpose |
|---|---|---|---|
| LabelDefinitions | CardinalityMode New | int enum, not null, default 0 | How many values the AI should select |
| LabelDefinitions | AutoApplyThreshold New | int?, nullable | Confidence percent above which to auto-apply |
| LabelDefinitions | ReviewBandFloor New | int?, nullable | Confidence percent below which to skip entirely |
| Cases | TriggerDetectionId New | int? FK → Detections | Provenance: which Detection triggered this case |
9. The Three Layers
Palette ordering does real work. New users reach for what is at the top; power users scroll down.
Senior analysts compose primitives into compounds, compounds into templates, and the customer’s library accumulates over time.
10. Status
Runbook template library / sharing
Versioning of runbook definitions
Branching / conditional DAG edges
Cross-runbook dependencies
Policy-template migration
Webhook + system event triggers
11. The Vision
The canvas is the configuration interface. Labels define how AI classifies and what it can choose. The whole thing materialises into infrastructure already built, and every capability becomes customer-authorable.
Policy templates
Every hardcoded policy can be lifted into an L3 template that preserves the working pattern without keeping it trapped in code.
DSAR pipelines
Customers author at L2 and tune the workflow without waiting for engineering to move a filter or threshold.
Power users
The system gets smarter as runbooks accumulate cross-case learning and repeatable patterns.
See how runbook reasoning sits inside the broader graph, narrative export and defensible decision record.