Minimum-Service Runbook¶
Operating document — instantiates Surprise Preparedness
Translates critical-function floors into degraded-mode operating actions and checks.
The Minimum-Service Runbook is the operating manual for running at the floor — the document that converts each critical function's minimum acceptable output into concrete, executable steps and checks for when the normal systems are gone. Its distinguishing idea is operationalization: it is not a statement that a function matters, nor a decision about who may act, but the function-by-function instructions for actually keeping the non-negotiable service alive in degraded mode, with the equity floor written in as non-waivable rather than deferred. Where a charter says who may decide, the runbook says what must keep running and exactly how. It is the artifact a shift worker opens at 2 a.m. and follows.
Example¶
A metro transit agency keeps a Minimum-Service Runbook organized as a per-function table: train control, traction power, station access, passenger information, and emergency egress. For each function it records the owner, the normal implementation, the minimum viable output, the maximum tolerable interruption, and the degraded-mode procedure with its checks. If the signaling computer fails, the runbook's train-control tab says: fall back to manual block working, run reduced headway, and confirm each of a named set of safety interlocks before movement. Crucially, it embeds the equity floor as non-waivable — if station elevators fail, the accessibility commitment is not the first thing quietly dropped; the runbook specifies the bridge (accessible shuttle, staff assistance to a defined standard) so wheelchair users are not silently stranded.
When a real signaling outage hits, staff turn to the train-control tab and execute manual working against the listed checks, holding the declared floor instead of improvising. The runbook has already been tested by running the function end-to-end from fallback inputs to fallback output, so the floor is a demonstrated capability rather than a hopeful paragraph.
How it works¶
- Build a per-function floor table. For each critical function, record its minimum viable output and maximum tolerable interruption — the ledger the rest hangs on.
- Write the degraded procedure. Give the concrete operating actions that hold that floor when normal systems are unavailable.
- Attach checks. State how an operator confirms the floor is actually being met, not merely attempted.
- Fix the equity floor as non-waivable. Name who is protected and what access cannot be dropped first, inside the procedure rather than as an afterthought.
- Keep it usable offline. The runbook must work through independent channels, because the outage may include the systems that host it.
Tuning parameters¶
- Floor level — how minimal the "minimum" is. Set too high, the floor is unsustainable under stress; set too low, it is theater that protects nothing meaningful.
- Granularity — per-function versus per-system detail. Finer detail is more executable but heavier to maintain and quicker to go stale.
- Check stringency — how hard the floor is to certify as met. Strict checks catch silent shortfalls but slow degraded operations.
- Equity-floor scope — how broadly non-waivable protections extend. Wider scope protects more people but constrains improvisation under scarcity.
- Refresh cadence — how often the floor and procedures are re-tested from fallback inputs. Frequent testing keeps the runbook honest; rare testing lets it drift into fiction.
When it helps, and when it misleads¶
Its strength is turning "minimum viable continuity" from a slogan into steps a tired operator can execute, and keeping the equity floor from becoming the first casualty of a bad night. It is the applied form of graceful degradation — designing a system to shed capability in a controlled, prioritized way rather than collapsing outright.[n1]
Its signature failure is the paper floor: a runbook that lists a minimum service never once run from fallback inputs, so no one knows whether the degraded procedure actually works until it doesn't. A subtler failure violates the ethical invariant — treating accessibility, privacy, or due process as luxuries to "restore later," which silently removes vulnerable users from the operating picture. And a floor set implausibly low certifies readiness while protecting nothing. The guarding discipline is the archetype's continuity invariant: run the function from fallback inputs through fallback output, measure the declared floor, and keep the equity floor non-waivable rather than optional.
How it implements the components¶
critical_function_map— the runbook's per-function table is the critical-function ledger: owner, normal mode, minimum output, and interruption tolerance, function by function.minimum_viable_continuity— it specifies the degraded-mode operating actions and checks that actually hold each function's floor when normal systems are gone.ethical_priority_guardrail— it writes who is protected and what access is non-waivable directly into the service floor, so equity is structural rather than a later refinement.
It defines the floors and who is protected but does not delegate the authority to act under them — the time-bounded decision rights and action envelope are bounded_emergency_authority and response_capacity_envelope, the Emergency Authority Charter's. And it assumes the recombinable modules and trained people that execute the floor exist elsewhere: modular_contingency_option_set in the Modular Response Kit and cross_trained_response_roles in the Role-Substitution Rotation.
Related¶
- Instantiates: Surprise Preparedness — the runbook makes the archetype's minimum-viable-continuity claim testable and executable, function by function.
- Sibling mechanisms: Emergency Authority Charter · Alternate Communication Drill · Assumption-Failure Tabletop · Modular Response Kit · Post-Surprise After-Action Review · Role-Substitution Rotation · Red-Team Disruption Challenge · Strategic Reserve Plan
Editorial Notes¶
Form Classification¶
Form family: Protocol, Workflow & Routine
Rationale: Minimum-Service Runbook operates as a repeatable ordered procedure or handoff sequence that coordinates action because it translates critical-function floors into degraded-mode operating actions and checks.
Independent corroboration: The frozen evidence defines Minimum-Service Runbook as 'Translates critical-function floors into degraded-mode operating actions and checks', so its operative form is Protocol, Workflow & Routine.
Nearest alternative: Representation, Specification & Plan — The runbook is a document, but its operative content is the executable degraded-mode procedure and checks operators follow during disruption.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Disaster Management & Risk Reduction
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Degraded-mode operating runbooks for critical functions are continuity and emergency-management artifacts.
Related originating lineages:
- Engineering & Design — For Minimum-Service Runbook, metrology, reliability, signal processing, safety analysis, and artifact design materially shaped the mechanism's characteristic form.
- Organizational & Management Science — Business continuity management specifies owners, service floors, and operational checks.
Review resolution: Both independent reviews place the primary provenance in disaster_management. The queued differences (alternate_origin_disagreement) concern secondary metadata, not primary lineage. The final retains organizational_management, engineering_design only where a reviewer supplied a formative-lineage rationale; downstream use or broad applicability by itself is not treated as origin. origin_mode=cross_disciplinary_synthesis because the supplied rationales identify formative contributions that are composed in the mechanism's present form. domain_reach=multi_domain records established application breadth separately from provenance. confidence=high preserves the more cautious evidence assessment. encyclopedia_synthesis=false records whether either reviewer identified deliberate corpus-level composition.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
The Minimum-Service Runbook is the twin of the Emergency Authority Charter: both are documents a degraded operation depends on, but the runbook defines what service continues and how, while the charter delegates who may decide and how far. Kept together, one supplies the floor and the other the authority to hold it.
[n1] Graceful degradation — a design property in which a system, when stressed or partly failed, loses capability in a controlled, prioritized order and preserves its most critical functions rather than failing all at once. The runbook is where that priority order is written down and made operable. ↩