SERVICE-STANDARD.md — Retained-Service Component Type (ongoing-cadence subscription/staffed service skeleton)

Governs the (retained service) component type ONLY. A retained service is a PRESCRIPTIVE product — its value is what we watch, on what cadence, and what we do when a tripwire fires (an ongoing operating commitment), NOT knowledge about a subject — so it does NOT carry the report anatomy (BLUF / Key Judgments / ACH / KAC / PIR). It has its own spine, below.

1. What a retained service is

Value = a standing commitment to watch, report, and act on a defined subject or perimeter over time, at a contracted cadence and service level. Imperative/prescriptive voice: it tells the client what we will monitor, how often, what trips an alert, who we notify, and how fast — not what we judge to be true. Two archetypes share this spine: (a) monitoring/watch subscription (entity- or perimeter-anchored I&W watch — the flagship exemplar <DID>); (b) staffed operational service (guard force, protective detail, GSOC/watch-floor staffing) — same scope/cadence/escalation/SLA/renewal spine, but adds a Posts, Staffing & Post-Orders section (post diagram, shift matrix, standing orders per post). Tag (retained service) only when value lives in the recurring cadence; the one-off product that seeds it (dossier/profile/assessment) is a separate component.

2. Required anatomy (every service deliverable carries this spine; restate in each file)

  1. # [SUBJECT / PERIMETER] — [SERVICE NAME]
  2. ## Document Control (classification/handling, version, author, effective date, term/period of performance)
  3. ## Scope, Authorities & Limitations — MUST contain the verbatim caveats in §3; states what the service does NOT cover and the sibling it routes to.
  4. ## 1. Scope & Watch Criteria / Tripwires (table: watch item | indicator | tripwire threshold | severity (L×I) | escalation route)
  5. ## 2. Collection Cadence & Sources (table: source/lane | collection method | cadence | source grade (Admiralty) | owner) — staffed archetype substitutes/adds ## 2a. Posts, Staffing & Post-Orders.
  6. ## 3. Reporting Cadence & Product Format (table: product | trigger/cadence | format | recipient | channel)
  7. ## 4. Escalation & Notification Triggers (table: severity tier | trigger condition | notify | method | acknowledgement target)
  8. ## 5. Service Levels (SLA) (table: metric | target | measurement | reporting | remedy/credit)
  9. ## 6. Review & Renewal (cadence of service review, change-control, renewal/termination terms)
  10. ## Annex A — Source & Watch-List Register (graded)
  11. ## Annex B — Onboarding / Offboarding & Data-Handling Checklist
  12. END OF SERVICE PLAYBOOK

3. Mandatory verbatim caveats (reproduce exactly)

This is a monitoring/operational service, not an investigation, a guarantee of detection, or legal advice. Collection is limited to lawful, authorized sources within the agreed scope; no unlawful access, intrusion, pretexting, or surveillance of non-consenting third parties is performed. Alerting is best-effort within the stated SLA and does not warrant prevention of any event.

4. Sourcing & confidence discipline

Where a watch item or alert cites collected intelligence, each datum carries a NATO Admiralty grade (reliability A–F × credibility 1–6, e.g. B2), reproduced verbatim in Annex A. Where a watch item is risk-scored, reproduce the L×I 1–25 key verbatim (1–5 Low · 6–10 Moderate · 11–15 Elevated · 16–20 High · 21–25 Critical). A retained service makes no analytic judgment of its own — it routes graded observations; it does not produce Key Judgments. Omit any scale the service does not use.

5. Retained-service-specific discipline (the load-bearing rule)

Every watch item has exactly three bound attributes: a tripwire (the observable threshold that fires it), a cadence (when/how often it is collected and reported), and an escalation route (who is notified, by what method, against what acknowledgement target). A watch item missing any of the three is not a watch item — it is unscoped collection and must be removed or completed. Reporting and escalation must trace back to a specific row in §1; SLAs in §5 bind the cadence and escalation timing.

6. Format

Pure heading hierarchy; bracketed [placeholders] everywhere content goes; markdown tables for every matrix with empty/placeholder cells; no worked content; no live tools; blank skeleton (like the report/profile skeletons).