SERVICE-STANDARD.md — Retained-Service Component Type (ongoing-cadence subscription/staffed service skeleton)
Governs the
(retained service)component type ONLY. A retained service is a PRESCRIPTIVE product — its value is what we watch, on what cadence, and what we do when a tripwire fires (an ongoing operating commitment), NOT knowledge about a subject — so it does NOT carry the report anatomy (BLUF / Key Judgments / ACH / KAC / PIR). It has its own spine, below.
1. What a retained service is
Value = a standing commitment to watch, report, and act on a defined subject or perimeter over time,
at a contracted cadence and service level. Imperative/prescriptive voice: it tells the client what we
will monitor, how often, what trips an alert, who we notify, and how fast — not what we judge to be
true. Two archetypes share this spine: (a) monitoring/watch subscription (entity- or
perimeter-anchored I&W watch — the flagship exemplar <DID>); (b) staffed operational service
(guard force, protective detail, GSOC/watch-floor staffing) — same scope/cadence/escalation/SLA/renewal
spine, but adds a Posts, Staffing & Post-Orders section (post diagram, shift matrix, standing orders
per post). Tag (retained service) only when value lives in the recurring cadence; the one-off product
that seeds it (dossier/profile/assessment) is a separate component.
2. Required anatomy (every service deliverable carries this spine; restate in each file)
# [SUBJECT / PERIMETER] — [SERVICE NAME]## Document Control(classification/handling, version, author, effective date, term/period of performance)## Scope, Authorities & Limitations— MUST contain the verbatim caveats in §3; states what the service does NOT cover and the sibling it routes to.## 1. Scope & Watch Criteria / Tripwires(table: watch item | indicator | tripwire threshold | severity (L×I) | escalation route)## 2. Collection Cadence & Sources(table: source/lane | collection method | cadence | source grade (Admiralty) | owner) — staffed archetype substitutes/adds## 2a. Posts, Staffing & Post-Orders.## 3. Reporting Cadence & Product Format(table: product | trigger/cadence | format | recipient | channel)## 4. Escalation & Notification Triggers(table: severity tier | trigger condition | notify | method | acknowledgement target)## 5. Service Levels (SLA)(table: metric | target | measurement | reporting | remedy/credit)## 6. Review & Renewal(cadence of service review, change-control, renewal/termination terms)## Annex A — Source & Watch-List Register (graded)## Annex B — Onboarding / Offboarding & Data-Handling ChecklistEND OF SERVICE PLAYBOOK
3. Mandatory verbatim caveats (reproduce exactly)
This is a monitoring/operational service, not an investigation, a guarantee of detection, or legal advice. Collection is limited to lawful, authorized sources within the agreed scope; no unlawful access, intrusion, pretexting, or surveillance of non-consenting third parties is performed. Alerting is best-effort within the stated SLA and does not warrant prevention of any event.
4. Sourcing & confidence discipline
Where a watch item or alert cites collected intelligence, each datum carries a NATO Admiralty
grade (reliability A–F × credibility 1–6, e.g. B2), reproduced verbatim in Annex A. Where a watch
item is risk-scored, reproduce the L×I 1–25 key verbatim (1–5 Low · 6–10 Moderate · 11–15
Elevated · 16–20 High · 21–25 Critical). A retained service makes no analytic judgment of its own —
it routes graded observations; it does not produce Key Judgments. Omit any scale the service does not use.
5. Retained-service-specific discipline (the load-bearing rule)
Every watch item has exactly three bound attributes: a tripwire (the observable threshold that fires it), a cadence (when/how often it is collected and reported), and an escalation route (who is notified, by what method, against what acknowledgement target). A watch item missing any of the three is not a watch item — it is unscoped collection and must be removed or completed. Reporting and escalation must trace back to a specific row in §1; SLAs in §5 bind the cadence and escalation timing.
6. Format
Pure heading hierarchy; bracketed [placeholders] everywhere content goes; markdown tables for every
matrix with empty/placeholder cells; no worked content; no live tools; blank skeleton (like the
report/profile skeletons).