operator runbooks
Intended Documentation
Operator Workflows
Operational playbooks for authoring policy, simulating impact, deploying and rolling back, monitoring the control center, and running an incident — driven through the Policies API and the console, not a fictional CLI command group.
Operator Workflows#
These runbooks cover the day-to-day operation of the authority control plane: writing the rules the runtime enforces, previewing the effect of a change before it ships, promoting it through review and deployment, watching the runtime, and containing an incident when something goes wrong.
How operators actually drive these workflows
Policy authoring and the draft → review → approve → deploy → rollback lifecycle run through the Policies API (/authority/policies and /policy/*) and the console — not through a CLI command group. The Intended CLI is a flat set of hyphenated commands (intent-submit, simulate, deploy-policy, audit-query, escalations-approve, verify, inspect-token, …). There is no intended policy … parent command, no intended deploy …, and no intended emergency …. Anywhere a first-class CLI verb would be convenient but does not yet exist, these pages call it out and label it Roadmap.
The five runbooks#
- Author a Policy — build a policy set as a governed draft, scope its rules, and submit it for review.
- Simulate Impact — read the draft impact summary and dry-run individual intents before you promote anything.
- Deploy and Rollback — approve, deploy a draft to an active version, and roll back to a prior version.
- Control Center — monitor runtime pressure, decisions, and connector health from the console.
- Incident Response — query the audit chain, inspect a decision token, and use the emergency-control actions to contain a tenant or environment.
Vocabulary you will need#
| Term | What it means here |
|---|---|
| Policy set | The unit the engine evaluates: { name, version, defaultDecision, rules[] }. Rules carry bindings, conditions, and an effect. |
| Draft | An uncommitted policy change moving through the lifecycle. Promote drafts; do not hand-edit the live set in production. |
/intent decision | APPROVED (200), ESCALATED (202), or DENIED (403) — the runtime enum returned by POST /intent. |
/authority/evaluate decision | ALLOW, DENY, REQUIRE_APPROVAL, or ESCALATE — the modern engine enum. Keep it distinct from the /intent enum. |
| Authority Decision Token | The Ed25519 JWT minted only on APPROVED. TTL is 300s (default and max), single-use via a unique nonce. |
Info
Decisions are default-DENY and combine most-severe-wins (DENY > REQUIRE_APPROVAL > ESCALATE > ALLOW). Interpretation-layer (LIM) signals can only upgrade severity — they never soften a decision. Authoring policy is, in practice, deciding what each binding should escalate or deny.