Runbooks

What to do when something specific breaks. Each runbook starts with how to tell it is this problem, then the steps, then who to tell. If you are on call and none of these fit, open an OPS ticket and follow On-call.

Runbook	Typical first signal
A depot can't sign in with single sign-on	SUP ticket from a customer's IT; SAML errors for one client
Switch a depot back to passwords	a depot's first single sign-on fails on a switch weekend
SMS codes not arriving	receipt-lag alarm; depot workers can't sign in
Notice emails not arriving	approvers say they never got the email; bounce alarm
Access requests stuck or closed	"my request disappeared", "nobody can approve this"
Credential stuffing and lockouts	failed sign-in alarm; many lockouts at once

Operations runbooks (backups, restores, certificates, disaster recovery) are in the Operations runbook.

Writing a runbook

• Name it after the symptom, not the cause.
• Commands you can copy. Say which region.
• Say what not to do, if there is a tempting wrong move.
• After an incident, update the runbook in the same week, and say so in its change history.