Expert method, encoded, and withheld when you are not ready for it.
A playbook is not a document. It is structured data with prerequisites and a maturity gate, which is why IO will sometimes tell you that the sophisticated intervention you want to run is the wrong one for this quarter.
Six required fields. No playbook ships without all six.
The correlated condition that makes this playbook relevant right now.
What must already exist. Missing prerequisites block the playbook and are prescribed first.
The organisational maturity below which this playbook reliably fails. IO withholds it rather than setting you up to lose.
The ordered work, with owner, effort and dependency named.
What should be observably different when this is done.
The measure, its source system, its population, and the interval before re-measurement.
Written from your policy, not ours.
Where the playbook starts
Every encoded playbook traces back to a policy statement, control requirement or operating constraint that you already own. IO does not ship a library of generic templates and ask you to adopt them. It reads your policy library, control framework and exception register, then builds the ordered method that would make that statement hold in practice.
What changes when policy changes
When a policy is revised, the associated playbook, verification criterion and maturity gate are updated together. The same signal that tells you a statement is drifting also tells you whether the method written for the old version still matches the new one.
Why IO tells you no.
The failure it prevents
Most security programmes fail by attempting the right intervention at the wrong time. A behavioural campaign aimed at a cohort you cannot yet identify. A policy exception workflow with no owner. The work happens, the measure does not move, and the conclusion drawn is that the method does not work.
What IO does instead
The playbook stays locked and the missing prerequisite becomes the prescribed action. You get a shorter queue of things that will actually hold, and the sophisticated playbook unlocks when the ground under it is real.
See it before you talk to anyone.
Two quarters of recorded activity across sixteen seats. One click, no install.