Appendix B — Engineering Moves

B.9 Externalize Recurring Operational Judgment

Problem. Operational work remains expensive when each incident requires an operator to reconstruct the same judgment: what healthy state looks like, what a symptom means, which procedure applies, and what evidence confirms recovery.

Move. Make recurring operational judgment explicit. Generate or execute what can be mechanized; provide guidance where judgment remains necessary; and keep both tied to the system they describe.

Figure B.9-1 traces the system model into the operational model.

C.9 Externalize recurring operational judgment: derive an operational model from the system model, then serve the operator A system model carries what healthy looks like, the states a subsystem can be in, and the relations among subsystems. Those feed an operational model, which splits the recurring judgment into what can be generated — a procedure — and what still needs contextual reasoning — guidance. Both reach the operator. Because the operational model is tied to the system model, the procedure does not drift away from the system it is meant to explain. SYSTEM MODEL healthy? states relations OPERATIONAL MODEL generated procedure reasoning guidance OPERATOR Separate what can be generated or executed from what still needs judgment — and keep the representation tied to the system it describes.
Figure B.9-1. From system model to operational guidance. Healthy-state predicates, states, and relations feed an operational model that produces generated procedure where possible and reasoning guidance where judgment remains necessary.

Example — Generated runbook. DocAble's lifecycle model names operational subsystems and their healthy-state predicates. The operator runbook is generated from that representation, keeping procedure aligned with the system model. When a subsystem's healthy-state predicate changes, the generated runbook changes with it.

Example — Event-bound playbook. The orchestrator reacts to typed fleet events through per-topic playbooks. The playbook records the trigger and response once, so the orchestrator can execute them when the event recurs rather than reconstructing the procedure each time.

Related mechanisms: Lifecycle model → generated runbook · Operational playbooks · Operator runbook skill · Encoded Operational Judgment · Orchestrator-as-reactor.

© James C. Davis, 2026–present