protective-operations (D-02)
The executive protection program: overt EP, covert protection / protective surveillance, advance work, movement operations, residential and event security, and the detail’s operating documents. Stood up 2026-07-03 as the sibling cell to D-01; the two form the firm’s dual synthesis: intelligence products flow into protective planning, and the detail’s Priority Intelligence Requirements (EP-019) flow back to drive collection (OSINT-006).
Organization (initials only, per CLASSIFICATION.md)
- BR: Operations Manager (logistics, travel, pay)
- RF: Team Leader / CEO (embedded with the family office client)
- MR, JM: Operators
- CS: Developer / Systems Engineer / Protective Intelligence / Decision Support
Capability nodes
| Node | Scope |
|---|---|
| 01-protective-advance | Site and venue advance surveys; travel packages |
| 02-movement-operations | Route analysis, motorcade planning, secure transport |
| 03-residential-security | Residential surveys and hardening |
| 04-event-security | Event-specific protective planning |
| 05-covert-protection | Protective surveillance, surveillance detection, covert details |
| 06-protective-intelligence-ops | Principal profiles, PIR management, daily briefs |
| 07-detail-operations | OPORDs, post orders, comms plans, retainers, AARs |
| 08-crisis-response | Emergency action plans and crisis procedures |
Seams
Consumes: ART-protective-intel-assessment, ART-travel-risk-assessment, ART-subject-dossier, ART-kr-risk-assessment, ART-insider-threat-monitoring, ART-vendor-due-diligence (D-01); ART-threat-alert-stream, ART-common-operating-picture, ART-comms-loadout, ART-medical-loadout (D-03); ART-engagement-order, ART-vendor-roster (D-04); ART-daily-brief (D-05); ART-region-package (CC-01). Produces: ART-pir-set and ART-field-contact-report (to D-01), ART-after-action-report (to D-05).
Process layer (added 2026-07-06)
Beyond the product templates, the domain carries its operating processes as cells: EP-020 Advance Planning Cycle (D-14 baseline, compressed 72h/24h variants, gates G1-G5) and EP-021 Detail Battle Rhythm (daily/weekly cadence) govern planning; EP-022 (advance mission), EP-023 (detail execution), EP-024 (covert protection/SD), and EP-025 (crisis actions drill library) are the execution playbooks that chain the templates into runnable missions. EP-026 Warning Order (2026-07-06) completes the order family alongside EP-010 OPORD: the abbreviated five-paragraph advance order the planning cycle issues at Gate G1 to alert the detail and start the clock. The intelligence-side counterpart is OSINT-064 (D-01 production cycle).
Collections / process maps (added 2026-07-06)
The domain now mirrors D-01’s collections layer. collections/ holds
XMind-importable step-by-step process maps (_SHAPES.md defines six
operational shapes: Planning-Cycle, Warning-Order, Advance, Detail-Execution,
Covert/SD, Crisis-Actions, all building on D-01 shape E). The seven
planning/playbook cells (EP-020 through EP-026) each have a process map that an
operator ticks through during the operation, every branch mapped to its parent
cell’s phases and gates. reference/guanacaste-site-visit-worked-plan.md is
the capstone: a synthetic full-scope worked operation (Operation GUARDIAN
TEMPISQUE, principal codename GARZA, Parque Tempisque site visit) that
instantiates the whole set end to end, including a complete five-paragraph
warning order and detail operations order, grounded in RGN-002, OSINT-065, and
BIZ-013, respecting the unarmed-foreign-operator posture and lawful-effects
doctrine.
Gap-closure layer (added 2026-07-06)
Six cells close the operational blind spots surfaced in the 2026-07-06 model review. EP-027 Field Contact and Suspicious Activity Report is the observation half of the protective-intelligence cycle: any operator observation becomes a structured, graded report that crosses the new ART-field-contact-report seam into D-01 TAM case intake (OSINT-052), the inverse of the EP-019 PIR loop. EP-028 Kidnap Response Runbook picks up where EP-025’s missing-principal drill ends, consuming OSINT-034 via ART-kr-risk-assessment: CMT stand-up, insurer and response-consultant integration, proof-of-life, family communication discipline, with ransom decisions expressly reserved to client, insurer, and counsel. EP-029 Training and Readiness Program elevates EP-025’s rehearsal standard into the readiness system (qualification standards, collective task list, currency records) feeding EP-021. EP-030 Protective Medicine Plan is the per-engagement medical standard (facility mapping, medevac decision tree, kit echelons from SYS-012 via ART-medical-loadout). EP-031 TSCM Inspection Brokerage replaces EP-013’s bare exclusion with a brokered posture (vendor vetting via ART-vendor-due-diligence, escort and findings-intake discipline). EP-032 Family and Household Protection Program covers the people at the residence, consuming ART-insider-threat-monitoring (OSINT-012) so continuous staff re-vetting signals finally reach the detail. EP-005/EP-006 gained lawful passive counter-UAS annexes; EP-017 AARs now cross ART-after-action-report into D-05 lessons ingestion (AGT-010).
Gaps
- 32 cells; independent review to approved is open (the planning/playbook set and EP-026 are review-ready with process maps authored; the gap-closure set EP-027 to EP-032 is newly drafted and needs both review and process maps).
- Collection process maps exist for the planning/playbook set (EP-020 to EP-026); the remaining product-template cells (EP-001 to EP-018) still need their shape-E mirrors.
- Vendor-sourced surge staffing lives in D-04’s vendor pipeline, not here.