Incident states 0 to 7, decide at state 3 and verify at state 5; the parent and child case pattern playbooks follow; and the ITIL 4 crosswalk across the six seats.
The KTP mechanism
Deautomation under pressure: as conditions worsen, supervision rises and scope narrows, and the spine says where a person must decide.
KTP's supervision levels are a floor a consumer may raise and never lower. The process spine is where that floor sits in an incident: a machine may carry the early states, a person decides at state 3, an independent verifier confirms at state 5, and every state names who is accountable and what gate advances it. The six real playbooks stay with the deployment; the pattern they share travels.
The working form, from the workbook
Eight states with their accountable party, minimum work, gate to advance, and what each joint version adds. The playbook summary and inter-playbook relationships as column designs (opens, triggered by, handoff with, related). Thirty-four ITIL 4 practices with the chapter's interpretation, and the matrix of practices against the six seats and the process states.
A machine may carry the early states. At state 3 a person decides; at state 5 someone other than the actor verifies recovery; at state 6 a person accepts the residual risk. The full table, with each joint version's additions, is below.
Acequia, Inc. is an invented organization. These pages present a working design, not deployment results; its contracted stages and change freezes are illustrative. The sections below mirror the Governed Autonomy workbook (v0.50): its columns, rules, invariants and catalogs, as written, with the worked example's organization named as it is there. The deployment's own rows, parties, contract identifiers and configuration stay with the deployment; where a table's rows stay, its columns are shown.
01The process spineworkbook tab 20 · Process spine
Decide at state 3; verify at state 5, by someone other than the actor.
What this is for. One path for every incident, from intake through lessons.
Playbooks plug into this path. They do not become versions of it. How to use it. Read the diagram, then the table. Decide at stage three; verify at stage five.
Stages 0 through 7. Each playbook plugs into these stages, and maturity grows on this path rather than a separate ladder.
The Information Technology Infrastructure Library (ITIL) column is shared service vocabulary, not certification evidence.
The diagram shows the security case lifecycle, P0 to P7. P3 decides. P5 verifies recovery separately from response.
Service blueprint impact; accepted risk vs autonomy paths; mission schedule as-of if the object exists. Physical-safety declared if the object exists.
V3 agentic delta
Purpose scope + policy basis; autonomy may contract.
V4 / Horizon — joint design
Live service consequence or in-session schedule can change the path; purpose/scope stay on the case. Physical safety adjudicated (ADJ) can constrain; camera/PACS remain evidence, not a declaration.
ITIL practices (1° direct)
Information security management; Risk management; Availability management; Capacity and performance management; Incident management; Monitoring and event management; Service configuration management; Service level management
Ticket tasks + API execution; log result; escalate failures.
Gate to advance
Execution on case; deviations logged.
V2 bridge delta
Dry-run; scoped credentials; manual fallback. Coordinate consume-only Physical Security / Public Safety / law enforcement liaison when declared.
V3 agentic delta
Bounded execute from register only.
V4 / Horizon — joint design
Live context can narrow or stop a class already in the register; revoke still works. law enforcement / national-security event designation handoff remains consume-only; CAD ingest does not grant dispatch control.
ITIL practices (1° direct)
Information security management; Knowledge management; Risk management; Availability management; Capacity and performance management; Change enablement; Incident management; Monitoring and event management; Service configuration management; Service level management
Independent verification via service, telemetry, and path analytics; pre/post; return to 3 if fail.
Gate to advance
ARQ acceptable or case re-opened.
V2 bridge delta
ARQ standard; no off-path data-analytics dependency.
V3 agentic delta
Acting != verifying enforced for agents.
V4 / Horizon — joint design
Independent ARQ can fail a security-green action; restore is not automatic.
ITIL practices (1° direct)
Information security management; Knowledge management; Risk management; Availability management; Capacity and performance management; Incident management; Monitoring and event management; Service configuration management; Service level management
Perkins, C. (2026). The process spine, and the playbook pattern. Kinetic Trust Protocol. https://kinetic-trust-protocol.net/governed-autonomy/playbooks
Plain text
Chris Perkins, "The process spine, and the playbook pattern," Kinetic Trust Protocol, https://kinetic-trust-protocol.net/governed-autonomy/playbooks.
Page created 28 October 2026 · last modified 2026-10-27
