Document coach
Operational Playbook
The runbook that works at 3am — exact commands, explicit forks, and a built-in moment to escalate.
Most runbooks are written from memory and fail their first real test at 3am. This guided playbook interviews you the way a staff SRE pressure-tests a runbook: the exact alert that triggers it and how to confirm you're in the right one, prerequisites checked before step 1, every step a copy-pasteable command paired with the output that proves it worked, decision points as explicit if/then forks, a hard escalation threshold so nobody struggles alone, and a recovery check that goes beyond "the alert stopped". Written for the reader you can't predict: smart, capable, and executing it cold at 3am.
What this expert will cover
- 2 questions
Responder
working notesWho runs this playbook and in what situation — a working note that sets the bar every step must clear, never part of the runbook itself. Complete means: the least-context responder who will execute it cold, what they can be assumed to know, and the state they are in when they open it.
- 4 questions
Trigger & Confirmation
Which page sends a responder here, and proof they are in the right playbook before they act. Complete means: the exact alert name and threshold, one confirmation command or check with its expected output, the lookalike failure that should send them elsewhere, and the time box — the clock the responder starts under, stated before step 1 rather than discovered in the escalation section too late.
- 3 questions
Prerequisites
Everything the responder must already have before step 1, so nothing is discovered missing mid-incident. Complete means: every access, permission, and tool named, each with a seconds-fast way to verify it works right now — plus the playbook's owner and the date it was last executed cold, the only honest defense against staleness.
- 2 questions
Diagnosis & Decision Points
The check that tells the responder which branch they are on, and explicit forks for every outcome. Complete means: a first diagnostic command pasted exactly, the distinct outputs it can produce with what each means, and an if/then for every branch — none ending in "use your judgment".
- 3 questions
Remediation Steps
The fix itself, executable cold. Complete means: numbered steps, each an exact copy-pasteable command paired with the output that confirms it worked ("run X; you should see Y"), expected waits with normal durations, and the risky step flagged with its precaution.
- 3 questions
Escalation & Abort
When to stop, who to wake, and how to back out. Complete means: the red-flag symptoms that force immediate escalation (the time box at the top already covers the clock), the exact rotation or person to page with the channel, and an abort path of exact commands back to a known-safe state.
- 3 questions
Verify Recovery
Proof the system is actually fixed, not merely quiet. Complete means: a positive recovery check (command or dashboard with the healthy value it should show) distinct from the alert clearing, a relapse-watch window with the metric to watch, and the after-recovery chores — alerts to unsilence, updates to post, follow-ups to file.
The kind of questions it asks
- Who will actually run this — realistically, the least-context person on the rotation? Name what they can be assumed to know cold, and what they will not know: which hosts, which shorthand, which tribal facts.
- Which alert or symptom sends a responder to this playbook? Give the exact alert name as it appears in your monitoring tool — copy it verbatim — plus the threshold that fires it.
- List every access the responder must already have before step 1 — VPN, SSH targets, admin roles, break-glass credentials.
Ready when you are.
Every answer inks the page in. Skip anything; return anytime.