GUARDIAN TEMPISQUE - FULL-SCOPE PROTECTIVE OPERATION WORKED EXAMPLE
SYNTHETIC / TRAINING ARTIFACT - NOT AN OPERATIONAL RECORD. Every name, initial, vendor, finding, timing, and figure below is invented-but-plausible and built solely to demonstrate the D-02 protective-operations planning cycle and playbook set operating end to end on one engagement. This is the only cell in the repository permitted to contain filled (non-templated) values. Geography, legal posture, medical infrastructure, and intelligence configuration are grounded in the real RGN-002 Costa Rica region package and the real OSINT-065 Costa Rica monitoring system; the principal, party, detail, dates, and vendor are fictional. Do not treat any figure in this document as a verified fact, and do not carry a filled value from this document into a template cell.
[EP-2026-CR-014 - OPERATION GUARDIAN TEMPISQUE, GUANACASTE PROVINCE, COSTA RICA, 16-19 SEP 2026]
This worked example instantiates the complete D-02 planning-and-execution chain for a single synthetic engagement: a four-day site visit and investor engagement in Guanacaste province, Costa Rica, for a low-profile, high-net-worth principal with a real-estate development interest. It shows the warning order, the planning-cycle instantiation (EP-020), the intelligence baseline drawn from the region package (RGN-002) and the country monitoring system (OSINT-065), the advance findings (EP-002/EP-003 method), the complete Detail Operations Order (EP-010), the Emergency Action Plan highlights (EP-012), the Communications PACE card (EP-011), the Crisis Actions drill set (EP-025), and the deployment battle rhythm and after-action hooks (EP-021/EP-017) as one coherent, internally consistent operation. All operational language renders to lawful protective effects only, consistent with the unarmed-foreign-operator posture required in Costa Rica (RGN-002 Annex H) and the lawful-effects rule in DOCTRINE.md.
Operation Snapshot
| Field | Value |
|---|---|
| Operation Codename | GUARDIAN TEMPISQUE |
| Engagement Reference | EP-2026-CR-014 |
| Principal (designator) | GARZA - US-national real-estate investor/developer, family-office client, principal in the Parque Tempisque development |
| Protected Party | GARZA, GARZA-2 (business partner), EA (executive assistant) - party of 3 |
| Area of Operations | Guanacaste province, Costa Rica (RGN-002); Site = Parque Tempisque, Palmira, Carrillo canton |
| AO Rings (OSINT-065) | R1 site (Palmira / HC54+F2) - R2 canton (Carrillo, Filadelfia, Sardinal, Playas del Coco) - R3 province (Guanacaste, Liberia, LIR) |
| Deployment Period | 2026-09-16 to 2026-09-19 (rainy season) |
| Planning Cycle | Standard cycle (EP-020 Section 3), compressed onto a D-10 baseline; not the EP-020 Section 4 72-hour or 24-hour variant - see Section 2.1 |
| Threat Posture | General Moderate (L x I 8); see Section 3 for course-of-action-specific scores |
| Legal / Use-of-Force Posture | Detail is UNARMED (foreign nationals may not carry firearms in Costa Rica, Ley N. 7530); lawful armed cover provided only by a licensed Costa Rican security company (Ley N. 8395, BIZ-006 vendor pipeline) |
| Detail | RF (Team Leader / Detail Leader, dual-hatted); BR (Operations Manager - advance, logistics, vendor); MR, JM (Close Protection Officers / drivers); CS (Detail Intelligence Officer, remote) |
| Local Licensed Vendor | Corporacion de Seguridad Chorotega S.A. (synthetic; DSSP registration pending counsel verification, RFI-RGN-002-05) - armed liaison/driver L-1 |
| Vehicles | 2x SUV, soft-skin low-profile (risk-accepted trade; Section 4.4) |
| Intelligence Feed | OSINT-065 daily brief, 0600 CST, plus SYS-008 threat-alert stream, both to CS |
| Communications | PACE per EP-011 pattern: primary ICE/Kolbi cellular + Telegram (SYS-006); alternate Liberty/Claro; contingency Starlink Mini (BIZ-013 risk R3); emergency local SMS / vendor radio (Section 7) |
| Medical | Primary trauma: Hospital Enrique Baltodano Briceno, Liberia (approx. 25-45 min from AO locations). Definitive / air-evac: Hospital CIMA, San Jose |
Handling and Legal Caveat
Handling: CONFIDENTIAL - CLIENT EYES ONLY (synthetic). Disseminate only to the roles named in this document. This document contains fictional personal data by design; no real person’s data is represented.
Nature of this product: This is a synthetic training and demonstration artifact. It is not a real operational order, assessment, or plan and creates no operational obligation. It does not deliver legal, medical, or security advice. Where it depicts operational language, that language renders to lawful protective effects only, within the jurisdiction and licensing described in RGN-002 Annex H: deny access, increase standoff, evacuate, and hand off to Fuerza Publica or OIJ. No content in this document directs interdiction, pursuit, or any effect beyond lawful defense of the principal.
Sourcing: Real-world grounding is limited to RGN-002 (Costa Rica region package) and OSINT-065 (Costa Rica country monitoring system) as read at authoring time. All venue findings, route timings, personnel, and vendor identities are invented for demonstration and are not derived from physical inspection or reconnaissance.
References and Annexes
| Ref | Product | Role in this worked example |
|---|---|---|
| EP-020 | Advance Planning Cycle | Timeline and gate structure instantiated in Section 2 |
| EP-022 | Advance Mission Playbook | Method followed for the venue and route advance in Section 4 |
| EP-002 | Advance Survey Report | Format followed (condensed) for venue findings in Section 4 |
| EP-003 | Route Analysis | Format followed (condensed) for route findings in Section 4 |
| EP-010 | Detail Operations Order | Five-paragraph structure instantiated in full in Section 5 |
| EP-012 | Emergency Action Plan | Drill structure instantiated (highlights) in Section 6 |
| EP-011 | Communications Plan (PACE) | PACE structure instantiated (card) in Section 7 |
| EP-025 | Crisis Actions Playbook | Drill library referenced (quick-reference) in Section 8 |
| EP-021 | Detail Battle Rhythm | Daily cycle instantiated in Section 9 |
| EP-017 | After-Action Report | Hooks and corrective-action seeds in Section 9 |
| EP-019 | PIR Management (referenced, not separately authored) | Standing PIR-tailoring method referenced in Sections 3 and 5.3.5 |
| RGN-002 | Costa Rica Region Package | Legal, medical, law-enforcement, transport, and vendor baseline throughout |
| OSINT-065 | Country OSINT Monitoring System - Costa Rica | AO rings, watch items (WI-1 water, WI-6 labor/social), and daily-brief cadence |
| DOCTRINE.md | Doctrine and Governing Authorities | Lawful-effects rule applied throughout; ICD 203 likelihood language in Section 3 |
| SYS-003 / SYS-006 / SYS-008 | Comms baseline / Telegram channel / threat-alert stream (referenced) | Comms and intelligence delivery in Sections 3 and 7 |
| SYS-009 / SYS-010 | Individual and vehicle kit checklists (referenced) | Kit checks in Sections 5.4.2 and 9 |
| BIZ-006 / BIZ-009 / BIZ-013 | Vendor roster / transport vendor / Starlink Global Roam risk register (referenced) | Vendor and equipment sourcing in Sections 4 and 5 |
Assumptions and Risk Acceptance Log
Per doctrine, every assumption below is explicit with a stated risk if false. These assumptions are load-bearing for the advance findings and route analysis in Section 4 and are carried forward, not silently resolved.
| # | Assumption | Basis | Risk if False |
|---|---|---|---|
| A-1 | GARZA arrives via scheduled commercial international service, not private aviation/FBO | No charter tasking in the engagement order; family-office client profile does not imply private aviation by default | Venue 1 findings (Section 4.1.1) and Route 1 origin point (Section 4.2.1) are invalid; an FBO-specific advance would be required before D-0 |
| A-2 | The Municipalidad de Carrillo meeting is held at the Municipalidad offices in Filadelfia, not on-site | Standard practice for permitting / SETENA-status meetings | One fewer movement leg than planned if the meeting is actually on-site; the error direction is conservative (over-, not under-, planned exposure) |
| A-3 | The ASADA/SENARA water-concession meeting is held at the ASADA Palmira community water-board office, with a SENARA representative attending in person rather than at a separate SENARA regional office | ASADA offices are local to the service community; joint attendance is standard practice for a concession review | An additional movement leg to a SENARA regional office (assumed Liberia) would be required and is not covered by the Section 4 route analyses; re-advance triggered if the venue changes |
| A-4 | Sardinal hosts a periodic roadside market on Wednesdays and Saturdays that increases center-of-town congestion | Advance-observed (D-5/D-4) during the physical advance window, not cross-checked against a formal municipal market-day registry | Chokepoint timing analysis (Section 4.2) over- or under-states congestion on specific days; revalidate before the next Guanacaste engagement (Section 9.3, item R-open-1) |
| A-5 | CS (Detail Intelligence Officer) operates remotely from the firm’s home operations desk for the duration of this engagement rather than deploying to Guanacaste | Detail scale (5 firm personnel) and 4-day duration do not justify a forward intelligence seat | Alert-to-decision latency during a fast-moving local event (for example, a Sardinal blockade forming) is longer than with a co-located analyst; mitigated by the OSINT-065 T0 flash tripwire (L x I >= 16) pushed directly to RF |
Table of Contents
- Warning Order (WARNORD 01)
- Planning Cycle Instantiation
- Intelligence Baseline
- Advance Findings
- Detail Operations Order (OPORD)
- Emergency Action Plan Highlights
- Communications PACE Card
- Crisis Drills Quick-Reference
- Deployment Battle Rhythm and After-Action Hooks
1. Warning Order (WARNORD 01)
A warning order is issued the moment tasking is validated, on the best information available, so the detail can begin preparing before the advance confirms anything. It uses the same five-paragraph skeleton as the OPORD (Section 5) but every line is provisional unless marked confirmed. Compare this order against the OPORD in Section 5, issued nine days later on confirmed advance findings, to see how the picture firms up across the cycle.
WARNORD Reference: EP-2026-CR-014-WARNORD-01 DTG Issued: 060900L SEP 26 (CST, UTC-6) Issued By: RF (Team Leader) Distribution: BR, MR, JM, CS
1.1 Situation (preliminary)
- Threat (preliminary): Standing RGN-002 Annex A baseline and OSINT-065 seed watch items apply pending a fresh intelligence baseline (tasked this date, LTIOV D-7 / 09 SEP). Provisional posture: General Moderate (L x I 8) per the region package. Opportunistic crime and an express-kidnap vector toward visibly affluent foreign investors are the standing concern for this client profile; the ASADA/SENARA water-concession watch items (WI-1 water, WI-6 labor and social) are noted as an open community-friction indicator given the coastal-development context. No confirmed principal-directed surveillance. Full assessment due at Gate G2 (Section 2).
- Principal and party (confirmed): GARZA (US national, real-estate investor/developer, principal in the Parque Tempisque development); party of three - GARZA, GARZA-2 (business partner), EA (executive assistant). Low public profile, visibly affluent, not a public figure.
- Supporting/adjacent elements (preliminary): Municipalidad de Carrillo (permitting liaison); ASADA Palmira / SENARA (water-concession liaison); local licensed security vendor to be selected via the BIZ-006 pipeline, vetting floor per RGN-002 Annex G.
- Attachments/detachments (preliminary): A licensed local armed liaison/driver attaches once vendor contracting closes, targeted no later than G4 (Section 2). No detachments anticipated.
- Operating environment (preliminary): Guanacaste province; rings R1 (Palmira/Parque Tempisque site), R2 (Carrillo canton), R3 (Guanacaste province, Liberia, LIR) per RGN-002/OSINT-065. Rainy-season road and flood hazard applies (RGN-002 Annex F). Common operating picture: OSINT-065 daily brief and SYS-008 alert stream to CS; ATAK not currently provisioned for this engagement.
1.2 Mission (tentative)
The GUARDIAN TEMPISQUE detail will protect GARZA and party during a four-day site visit and investor engagement in Guanacaste province, Costa Rica, 16-19 SEP 2026, in order to enable project, permitting, water-concession, and investor meetings while deterring and defending against opportunistic and express-kidnap threats under an unarmed, lawful posture.
1.3 Execution (concept, preliminary)
- Intent (preliminary): Advance and ground-truth every venue and route before first movement; maintain an unarmed, lawful, defensive posture with armed cover only from the licensed local vendor; avoid predictable chokepoints through timing variance and pre-cleared alternates; hold a go/no-go checkpoint ahead of the ASADA/SENARA meeting given the live watch item.
- Concept by phase (tentative): Residence/RON at a coastal lodging property (TBD, target Playa Hermosa/Papagayo corridor - subsequently confirmed as Resort ALFA, Section 4.1.2); site-day movements to Parque Tempisque and municipal/water-authority liaison points; a coastal-parcel and investor day; return to LIR. Confirmed at Gate G3.
- Tasks (preliminary): BR runs the physical advance and vendor contracting; CS opens OSINT-065/SYS-008 tasking now; MR/JM prepare kit and stand by for movement and rehearsal tasking; RF retains overall command and gate approval authority.
- Coordinating instructions (preliminary): Target timeline - advance window D-5 to D-4 on site; G3 D-3; G4 D-2; G5 D-1; execution D-0 (16 SEP). Rules of engagement are fixed now, independent of advance findings, because they are a legal fact of the jurisdiction: the detail is unarmed; armed cover, where lawful, comes only from the licensed local vendor; force is graduated and defensive; effects render to denying access, increasing standoff, evacuating, and handing off to Fuerza Publica/OIJ. No-go floor: if the EP-020 compressed-cycle mandatory minimum cannot be met before D-0, the visit is postponed or rescoped; this is a client-communicated policy, not negotiated per movement.
- PIRs (preliminary, tasked for G2 answer): hostile surveillance indicators; route status on the LIR-lodging and lodging-site corridors; status of the ASADA/SENARA watch item; vendor/vehicle availability and armor rating.
1.4 Administration and Logistics (preliminary)
- Vendor sourcing: target two SUVs, CEN B4 armor preferred if available inside the compressed lead time, from the BIZ-006 vetted-vendor roster; trade study to close at G4 if armor is unavailable (Section 4.4).
- Billeting: coastal lodging in the Playa Hermosa/Papagayo corridor, to be confirmed by the physical advance.
- Medical (preliminary): primary trauma and definitive-care facilities per the RGN-002 medical annex (Hospital Enrique Baltodano Briceno, Liberia; Hospital CIMA, San Jose), to be confirmed with drive times at the advance.
- Legal (preliminary): unarmed foreign-operator basis and licensed local armed cover per RGN-002 Annex H (Ley N. 7530 / Ley N. 8395). The Annex H counsel-verification gate (RFI-RGN-002-05) is open at the firm level; this is flagged now as a standing risk for Team Leader tracking, not assumed closed by D-0.
1.5 Command and Signal (preliminary)
- RF is Team Leader and Detail Leader for this engagement (dual-hatted; detail size does not support separate roles). BR is Operations Manager. Succession and full net architecture are set at the OPORD (Section 5.1/5.2) once the advance confirms the operating environment.
- Comms baseline: standing EP-011 PACE pattern applies (cellular primary, second-carrier alternate, satellite contingency, local/radio emergency); engagement-specific channel names and call signs are issued at the OPORD.
2. Planning Cycle Instantiation
This section instantiates EP-020 for GUARDIAN TEMPISQUE: the actual dates, the gate outcomes, and the deviation log.
2.1 Cycle Classification
GUARDIAN TEMPISQUE runs the EP-020 Section 3 standard cycle, compressed onto a D-10 baseline rather than the D-14 baseline shown in the EP-020 template. This is not the EP-020 Section 4 72-hour or 24-hour compressed variant: those variants merge and drop content under a stated risk acceptance. Here, every standard-cycle milestone and every mandatory input is retained; only the calendar spacing between milestones is compressed, because the client’s ten-day notice exceeds the 72-hour threshold that triggers a true compressed variant. This classification is a scoping decision by the Team Leader (RF), recorded here rather than silently reconciled, per the standing reasoning protocol on stating conflicts and choices explicitly.
2.2 Cycle Timeline and Gate Outcomes
| Day | Date | Milestone | Product / Action | Responsible | Gate | Outcome |
|---|---|---|---|---|---|---|
| D-10 | 2026-09-06 (Sun) | Tasking validated; Advance Lead designated; itinerary draft received | Cycle instance opened; RFIs issued to CS; WARNORD 01 issued (Section 1) | RF / BR | G1 | PASS - scope, dates, venues (LIR, coastal lodging TBD, Parque Tempisque), and party of 3 fixed; BR designated Advance Lead |
| D-9 | 2026-09-07 (Mon) | Intelligence tasking confirmed; region package pulled | OSINT-065 daily-brief and SYS-008 alert-stream tasked to CS with LTIOV D-7; RGN-002 pulled in full | CS | - | On schedule |
| D-7 | 2026-09-09 (Wed) | Intelligence baseline on hand | OSINT-065 baseline and RGN-002 Annexes A/D/F/H read onto BR/CS; threat posture set; PIRs tailored (Section 3) | CS / RF | G2 | PASS - posture set at General Moderate (L x I 8); MLCOA/MDCOA identified (Section 3.2); 5 PIRs tailored; gap logged: RGN-002 RFI-RGN-002-07/08 local contact rows remain open, accepted as residual risk by RF |
| D-6 | 2026-09-10 (Thu) | Route desk study complete | Candidate primary/alternate/emergency legs drafted for LIR-lodging and lodging-site corridors from imagery and mapping | BR | - | On schedule |
| D-5 to D-4 | 2026-09-11 to 2026-09-12 (Fri-Sat) | Physical advance on site | Venue surveys (LIR arrival, Resort ALFA lodging, Parque Tempisque site) and route ground-truth conducted per the EP-022 method (Section 4); liaison opened with Municipalidad de Carrillo, ASADA Palmira, Resort ALFA security, and the candidate local vendor | BR | - | Complete; findings in Section 4 |
| D-3 | 2026-09-13 (Sun) | Advance survey reports drafted; brief-back | Three venue findings and two route analyses finalized and briefed back to RF | BR | G3 | PASS - no unsurveyed venue on the itinerary; minor open item logged: the Liberia investor-meeting venue was not yet confirmed at brief-back, mitigated by a same-day BR walkthrough scheduled for the morning of D-2 |
| D-2 | 2026-09-14 (Mon) | Plan approved | Vehicle trade study closed (Section 4.4: soft-skin low-profile selected, risk accepted by RF); movement plan, comms plan, and EAP annexes assembled into the travel security package | BR / RF | G4 | PASS - package internally consistent; cold-start test passed (JM, who did not run the advance, executed a read-back brief from the assembled package alone) |
| D-1 | 2026-09-15 (Tue) | OPORD issued; confirmation brief and rehearsals | EP-010-pattern OPORD issued 1500L (Section 5); rehearsals held: vehicle-contact/cross-load drill, medical/casualty drill, embus/debus walk-through at Resort ALFA and Parque Tempisque | RF | G5 | PASS - every operator briefed on mission, actions-on, and comms; SYS-009/SYS-010 kit checks complete; one drill (residence/RON intrusion) rehearsed tabletop only, not walked at the site - flagged per EP-025 Section 9 realism-floor rule (Section 8) |
| D-0 | 2026-09-16 (Wed) | Execution handoff | Cycle closes at 1500L on GARZA’s arrival at LIR; execution proceeds under the battle rhythm (Section 9) | RF | - | Handoff complete |
2.3 Deviation Log
| # | Deviation | Reason | Approver | Disposition |
|---|---|---|---|---|
| 1 | D-12/D-10/D-9 milestone spacing from the EP-020 D-14 baseline compressed into D-9/D-7/D-6 | Ten-day client notice vs. the fourteen-day baseline; no mandatory content dropped | RF | Accepted, logged per Section 2.1 |
| 2 | Liberia investor-meeting venue not confirmed at G3 brief-back | Client-side scheduling of the investor meeting finalized later than the advance window | RF | Mitigated by a same-day BR walkthrough on the morning of D-2 before the meeting; not a re-advance trigger |
| 3 | Residence/RON intrusion drill rehearsed tabletop only at G5, not walked at Resort ALFA | Detail size and schedule did not permit a full walked rehearsal of a low-relevance drill before first movement | RF | Carried forward as an open item to the after-action hooks (Section 9.3) |
3. Intelligence Baseline
Threat basis drawn from RGN-002 Annex A and the OSINT-065 watch-item set, tailored to this engagement at Gate G2 (09 SEP). Likelihood language follows the ICD 203 estimative-vocabulary scale per DOCTRINE.md; likelihood and confidence are stated separately and are not upgraded from the standing region-package baseline.
3.1 Threat Actors and Vectors
- General posture: Moderate (L x I 8) per RGN-002 Annex A, provisional pending the still-unauthored OSINT-031 Costa Rica country risk assessment (RFI-RGN-002-03); this engagement inherits that provisional grading rather than asserting a computed one.
- Opportunistic and express-kidnap vector: visibly affluent foreign investors are a recognized target profile for opportunistic robbery and, at lower likelihood, express kidnapping, per the region package’s primary threat-vector statement and the client’s own visible profile in this engagement (real-estate investor/developer, non-public figure).
- Vehicle crime and road hazard: Ruta 21 and the Guanacaste coastal road network carry both an opportunistic vehicle-crime vector and a rainy-season environmental hazard (flooding, landslide, road closure) per RGN-002 Annex F.
- Coastal narco activity: present in the Guanacaste/Pacific corridor as an ambient periphery risk (OSINT-065 Section 2.2 Military-variable remapping); not assessed as principal-directed for this engagement.
- Community/labor friction (WI-1, WI-6): OSINT-065 watch item 1 (water: ASADA capacity and concession changes in Palmira/Sardinal/Carrillo; SENARA aquifer studies) and watch item 6 (labor and social: community opposition organizing against coastal development) are both open and directly relevant, since the itinerary includes the live ASADA/SENARA water-concession meeting for the Parque Tempisque project. Escalation could surface as a protest or road blockade at or near the site.
- No rifle threat assessed for this engagement or AO.
3.2 Courses of Action
| COA | Description | Likelihood (ICD 203) | Impact | L x I | Confidence | Indicators |
|---|---|---|---|---|---|---|
| Most Likely (MLCOA) | Opportunistic vehicle-borne robbery at a predictable chokepoint, or a road blockade (community/labor action) delaying a movement leg | Roughly even chance | 3 (Moderate - property loss, delay, low physical-harm probability) | 3 x 3 = 9 (Moderate) | MODERATE | Loitering at known chokepoints (Sardinal market corner, Palmira access-road junction); social-media or local-news mobilization language tied to WI-6; sudden change in ASADA/SENARA meeting profile |
| Most Dangerous (MDCOA) | Express kidnapping during an unhardened movement leg | Unlikely | 5 (Critical - life-safety and ransom exposure) | 2 x 5 = 10 (Moderate, consequence-weighted) | MODERATE | Repeated presence of the same vehicle/individual across two or more movement legs; direct approach or photography of the principal outside a controlled venue; a demand for pattern-of-life detail from an unverified source |
| Ambient (reference) | Coastal narco activity as periphery, not principal-directed | Very unlikely (as principal-directed) | 2 | 2 x 2 = 4 (Low) | MODERATE | None specific to this engagement; monitored via OSINT-065 R2/R3 security watch item 5 |
| Environmental (reference) | Rainy-season flooding, landslide, or road closure affecting movement | Roughly even chance (September is peak rainy season) | 3 | 3 x 3 = 9 (Moderate) | HIGH | Rainfall advisories; Ruta 21/coastal-road condition reports in the OSINT-065 daily brief |
Note on COA convention: the most-likely course of action carries the higher probability and lower per-event consequence; the most-dangerous course carries lower probability and higher consequence. Both round to the same Moderate band at this AO’s baseline; the OPORD (Section 5.3.4) treats them with different actions-on because their end states differ (property/delay vs. life-safety).
3.3 Priority Intelligence Requirements (as of G2, 09 SEP 2026)
| PIR | Answer (as of 09 SEP) | Confidence | Key Gap |
|---|---|---|---|
| PIR-1: Has hostile surveillance of GARZA or the candidate venues been detected? | No hostile-surveillance indicators observed in the OSINT-065 feed or the desk-study pass as of this date | MODERATE | No dedicated surveillance-detection element is tasked for this engagement (EP-022 boundary); ground-truth not yet available |
| PIR-2: Are the LIR-lodging and lodging-site movement routes open and free of blocking events? | Desk study shows no reported closures on Ruta 21 or the coastal corridor; ground-truth pending the D-5/D-4 advance | MODERATE | Rainy-season conditions change quickly; desk study cannot confirm real-time surface or flood state |
| PIR-3: Is there indication of an organized community/labor action (WI-6) that could surface as a protest or blockade near Parque Tempisque during the visit window? | No active mobilization identified in the OSINT-065 daily brief as of this date; WI-6 remains open at its standing Moderate rating | LOW-MODERATE | Guanacaste-local vendor and community contact rows in RGN-002 config/contacts.yaml remain open RFIs (RFI-RGN-002-07); local sentiment monitoring is limited without them |
| PIR-4: Has the ASADA/SENARA water-concession meeting agenda changed in a way that elevates the visit’s profile (for example, becomes public or contested)? | No indication as of this date; the meeting is scheduled as a routine technical session | LOW | Meeting sensitivity could change day-of; monitored via the OSINT-065 T0 flash tripwire (L x I >= 16) |
| PIR-5: Is a licensed local vendor available within the compressed lead time to provide lawful armed cover and vehicle support? | Candidate vendor (Corporacion de Seguridad Chorotega S.A.) identified via BIZ-006; contracting in progress | MODERATE | DSSP registration and the Annex H counsel-verification gate (RFI-RGN-002-05) not yet closed at the firm level |
4. Advance Findings
Findings from the physical advance conducted D-5 to D-4 (11-12 SEP 2026) by BR, following the EP-022 Advance Mission Playbook method. Venue findings are presented in condensed EP-002 form; route findings in condensed EP-003 form. This section supports Section 5 Paragraph 3 (Execution) and Paragraph 4 (Logistics) of the OPORD.
4.1 Venue Findings
4.1.1 Venue 1: Daniel Oduber Quiros International Airport (LIR), Liberia - Arrival Point
BLUF: Arrival environment assessed Low-Moderate. Standard commercial international arrivals hall with a predictable curbside pickup queue; the primary exposure is dwell time during curbside embus at peak international arrival banking, which coincides with GARZA’s planned 1500L arrival. Mitigated by LIR’s meet-and-greet/fast-track arrivals service and pre-staged vendor vehicles.
- Access and arrival: Under Assumption A-1 (commercial arrival, not private aviation), GARZA and party clear immigration and customs through the standard international arrivals hall. BR has arranged LIR’s meet-and-greet/fast-track service so BR meets the party immediately post-customs rather than in the public arrivals hall.
- Embus/debus point: Curbside Arrivals (Terminal), designated pickup lane. Standoff is limited (public curb, shared with taxi and rideshare queue); no dedicated VIP curb lane confirmed at this airport. Alternate: the ground-transportation supervisor’s office area, usable as a short-dwell holding point if the curb is congested.
- Medical: LIR maintains an airport medical post (first-aid level); nearest trauma-capable facility is Hospital Enrique Baltodano Briceno, Liberia, approximately 15 km / 20 minutes from the terminal under normal traffic.
- Comms: Cellular coverage (ICE/Kolbi and Liberty/Claro) is strong throughout the terminal and curbside; no dead spots identified.
- Red flags: Curbside congestion during the 1400-1600L international arrival bank coincides with the planned 1500L arrival - Medium severity, Mitigated (fast-track service and vendor vehicle staged curbside no later than 1445L).
- Recommendation: Use the LIR fast-track arrivals service; stage Vehicle 1 and Vehicle 2 curbside by 1445L; BR meets the party post-customs. Owner: BR.
4.1.2 Venue 2: Resort ALFA, Playa Hermosa / Papagayo Corridor, Sardinal District, Carrillo Canton - Lodging (D-0 through D-2 RON)
BLUF: Lodging assessed Moderate. Resort ALFA is a standard commercial beachfront property, not a hardened residence; the open watch item is community/labor sentiment in the immediate corridor (WI-6), not the property’s physical security, which is adequate for a short low-profile stay with the mitigations below.
- Access control: Single main vehicle gate with a guard post; a public beach walkway provides unrestricted pedestrian access to the rear of the guest-room blocks, bypassing the main gate. This is standard resort configuration, not a property-specific deficiency.
- Room placement: BR requested an upper-floor room block away from the beach walkway; confirmed available for this stay. GARZA, GARZA-2, and EA are co-located in the same wing to allow a rapid accountability muster.
- Safe haven: The hotel management/security office serves as the designated rally point. The property does not have a hardened safe room to residential-grade standard; accepted as a low-severity gap given the short lodging duration (three nights) and the assessed threat (opportunistic/community, not a dedicated forced-entry actor).
- Medical: First-aid station on property, no physician on staff. Nearest trauma facility: Hospital Enrique Baltodano Briceno, approximately 30-40 minutes depending on time of day and rainfall.
- Comms: ICE/Kolbi and Liberty/Claro both functional on property; occasional degradation observed during heavy rain, consistent with the RGN-002 Annex E coastal coverage caveat. Starlink Mini staged as the property-level contingency.
- Red flags: (1) Beach-walkway pedestrian access bypassing the main vehicle gate and reaching the guest-room block exterior - Medium, Mitigated (vendor liaison L-1 spot-checks the walkway access point during RON hours). (2) Limited CCTV coverage of the beach-facing wing exterior - Low, Open (hotel-owned system, outside the firm’s control; noted to the Operations Manager for any future stay at this property).
- Recommendation: Confirm upper-floor room block for any repeat stay; brief the hotel’s security liaison on the visit dates and the party’s room numbers on a need-to-know basis; stage a vehicle overnight in the guest lot nearest the room block. Owner: BR.
4.1.3 Venue 3: Parque Tempisque, Palmira, Carrillo Canton - Project Site
BLUF: Site assessed Moderate, driven primarily by the live ASADA/SENARA watch item rather than the physical site itself. The site office and immediate compound are adequate for a controlled meeting and walkthrough; the access road and rural surroundings carry the AO’s most significant single-point-of-failure exposure (Section 4.2.2).
- Access: Site office and gated construction entrance off the Palmira access road (see Section 4.2.2 for the road itself). Parking area is unpaved gravel; rainy-season traction is a minor vehicle-handling consideration, not a security finding.
- Arrival box: Site office forecourt, capacity for two vehicles, no overhead cover. Alternate debus point: the rear service gate, usable if the forecourt is occupied by project-team or municipal vehicles on meeting day.
- Surrounding terrain: Adjacent parcels are undeveloped agricultural/scrub land with no perimeter fencing beyond the immediate site-office compound. This gives natural standoff but poor lighting and no sightline control after dark - mitigated by a daylight-only visit policy (Section 5.3.4).
- Meetings on site: The project-team meeting is held in the site office (controlled room, low exposure). The Municipalidad de Carrillo meeting (Assumption A-2) and the ASADA/SENARA meeting (Assumption A-3) are held off-site; see Section 4.3 for those short local legs.
- Medical: No on-site medical capability. Nearest trauma facility: Hospital Enrique Baltodano Briceno, estimated 35-45 minutes from Palmira depending on route and rainfall. IFAK carried by MR and JM per SYS-009.
- Comms: Cellular signal at the site office is marginal (2-3 bars on ICE/Kolbi), degrading further near the rear construction lot. This is the AO’s principal comms finding and feeds directly into the Section 7 PACE card.
- Red flags: (1) Unfenced, unlit adjacent parcels - Medium, Open (no economic case for fencing an undeveloped site; mitigated by a daylight-only visit policy). (2) Marginal cellular signal at the site office - Medium, Mitigated (Starlink Mini staged at the site office for the duration of the D-1 visit). (3) The live ASADA/SENARA watch item could draw an unplanned community turnout at or near the meeting - High, Open pending day-of liaison confirmation; this is the specific driver of the go/no-go checkpoint in Section 5.3.4 and Section 9.
- Recommendation: Daylight-only site activity; vendor liaison L-1 pre-positions at the site 30 minutes ahead of arrival to confirm no unplanned gathering; stage Starlink Mini at the site office for the D-1 duration; hold the go/no-go checkpoint 60 minutes before the ASADA/SENARA meeting. Owner: BR / RF.
4.2 Route Findings
4.2.1 Route 1: LIR to Resort ALFA (D-0 arrival movement)
| Leg | Segment | Distance / ETT | Selection Rationale |
|---|---|---|---|
| Primary | LIR terminal exit, local connector to Ruta 21, coastal road (local Sardinal/Coco corridor road) to the Playa Hermosa/Papagayo access road, to Resort ALFA | 38 km / 40 min (add 10-15 min in heavy rain) | Most direct corridor between the airport and the lodging property |
| Alternate | Ruta 21 to the Filadelfia junction, then the Sardinal secondary road, rejoining the coastal corridor before the Papagayo turn | 42 km / 50 min | Diverges at Filadelfia, well before the Sardinal market-corner chokepoint; used if that chokepoint is congested or blocked |
| Emergency | Reverse toward Liberia to Hospital Enrique Baltodano Briceno from any point on the corridor | 15-30 km / 20-35 min depending on position | Direct link to the primary trauma facility for a medical exfiltration |
- Chokepoints: (1) The Ruta 21/coastal-road junction near Comunidad, a merge/roundabout with a single-lane bridge over a seasonal river crossing prone to flooding in the rainy season. (2) The Sardinal market corner, a narrow two-lane section with roadside vendor congestion on market days (Assumption A-4: Wednesdays and Saturdays) - directly relevant, since D-0 (16 SEP) is a Wednesday.
- Predictive attack-site analysis: Highest-likelihood location is the Sardinal market corner (forced slow speed, roadside congestion, opportunistic-robbery profile matching the MLCOA). Highest-consequence location is the single-lane bridge crossing (channelized, no bypass, flood risk that could trap a vehicle - matching the environmental COA in Section 3.2).
- Safe havens: Delegacion Policial de Sardinal (staffed, vehicle-accessible); Hospital Enrique Baltodano Briceno; LIR itself functions as a fallback safe haven for the first kilometers of the route (staffed, secure, already cleared).
- Timing: Rush-hour effect is minor on this corridor outside Liberia itself; the dominant timing variable is the Sardinal market-day congestion window, assessed as roughly 1400-1700L on market days, which overlaps the planned 1500L arrival.
4.2.2 Route 2: Resort ALFA to Parque Tempisque, Palmira (D-1 site-day movement)
| Leg | Segment | Distance / ETT | Selection Rationale |
|---|---|---|---|
| Primary | Resort ALFA access road, coastal road to Sardinal, Palmira local road to the site | 20 km / 28 min | Shortest corridor between the lodging property and the site |
| Alternate | Resort ALFA access road via Filadelfia, rejoining the Palmira local road before the site | 24 km / 35 min | Avoids the Sardinal town center; used if Sardinal is congested or if a community action (WI-6) is reported there |
| Emergency | Site to Hospital Enrique Baltodano Briceno via Filadelfia-Liberia road | approx. 30 km / 35-40 min | Direct link to the primary trauma facility |
- Chokepoints: (1) The final approximately 1.5 km of the Palmira access road is a single unpaved lane with no bypass - a genuine single point of failure, made worse in the rainy season by rutting and, per the venue finding (Section 4.1.3), a cellular dead spot. (2) The Sardinal center junction carries the same market-day congestion noted in Route 1, but D-1 (17 SEP) is a Thursday under Assumption A-4, so this leg is not expected to carry the market-day congestion penalty that day.
- Predictive attack/blockade-site analysis: Highest-likelihood location for a blockade is the junction of the Palmira access road with the main coastal road - the natural staging point for a community/labor action tied to WI-6, and a single point of failure for reaching the site at all. Highest-consequence location, if a blockade or attack occurs, is the unpaved final approach itself: channelized, no room for a two-vehicle motorcade to turn or pass, and without reliable cellular signal.
- Safe havens: Municipalidad de Carrillo, Filadelfia (populated, official); Delegacion Policial de Sardinal; Hospital Enrique Baltodano Briceno.
- Timing: No significant rush-hour effect on this rural corridor; the dominant variable is rainfall (surface condition on the unpaved final approach) and any WI-6-linked activity at the access-road junction.
4.3 Local Movement Summary (short legs, D-1 and D-2)
These are short hops within the same corridors already surveyed in Section 4.2; they are not separately re-analyzed at full EP-003 depth.
| Leg | Day | Distance / ETT | Corridor Reused | Note |
|---|---|---|---|---|
| Parque Tempisque to Municipalidad de Carrillo, Filadelfia | D-1 | 12 km / 15 min | Route 2 alternate corridor (partial) | Municipal permitting/SETENA-status meeting (Assumption A-2) |
| Municipalidad de Carrillo to ASADA Palmira office | D-1 | approx. 15 km / 20 min (return leg via Palmira) | Route 2 primary corridor (partial, reverse direction) | Water-concession meeting (Assumption A-3); go/no-go checkpoint precedes this leg (Section 5.3.4) |
| ASADA Palmira office to Resort ALFA | D-1 | 20 km / 28-35 min | Route 2 primary/alternate | Return to lodging |
| Resort ALFA to Sardinal/Coco coastal corridor | D-2 | 10 km / 15 min | Route 1 primary corridor (partial) | Coastal-parcel viewing |
| Sardinal/Coco corridor to Liberia | D-2 | approx. 25 km / 35-40 min | Route 1 primary corridor (extended toward Liberia) | Investor meeting |
| Liberia to Resort ALFA | D-2 | approx. 30 km / 40 min | Route 1 primary corridor (reverse) | Return to lodging |
| Resort ALFA to LIR | D-3 | 38 km / 40 min (rainy-season buffer to 50 min) | Route 1 primary corridor (reverse) | Departure movement |
4.4 Transport Trade Study
Per RGN-002 Annex F, vetted transport suppliers are drawn from the BIZ-006 roster and vehicles should be armored to CEN Level B4 minimum where available. The advance closed this trade study at Gate G4 (14 SEP).
| Option | Description | Criteria: Availability in Lead Time | Criteria: Profile Fit | Criteria: Cost/Positioning | Criteria: Protection Level | Recommendation |
|---|---|---|---|---|---|---|
| A | CEN B4 armored SUV pair sourced from the San Jose vendor pool, transported to Guanacaste | Not available inside the compressed ten-day lead time without a premium repositioning charge and a schedule risk to G4 | Poor - an armored vehicle is visually distinct in this rural/coastal setting and works against the low-profile posture the client’s visibility already requires | High - repositioning cost and lead time both adverse | High (ballistic/blast per B4) | Not selected |
| B | Soft-skin, low-profile, late-model full-size SUVs sourced locally in Liberia/Guanacaste from Corporacion de Seguridad Chorotega S.A. | Available within the lead time | Good - matches the low-profile posture and the assessed threat, which is opportunistic/express-kidnap rather than a deliberate armed ambush | Low - local sourcing, no repositioning | None (no ballistic/blast protection) | Selected |
Decision and risk acceptance: Option B is selected. Rationale: (1) armored B4 vehicles are not obtainable within the compressed lead time in Guanacaste; (2) the assessed threat basis (Section 3) is opportunistic and express-kidnap risk, not a deliberate armed assault, so ballistic protection is not the controlling mitigation for the assessed vectors; (3) a visibly armored vehicle works against the low-profile posture that is itself a key mitigation for a visibly affluent, non-public-figure principal. Risk accepted: the detail forgoes ballistic and blast protection against any escalation beyond the assessed threat level (for example, a deliberate armed ambush, which is not currently assessed but cannot be excluded with certainty). Mitigation: route discipline and chokepoint avoidance (Section 4.2), low-profile vehicle selection, and the licensed armed liaison in the follow vehicle (Section 5.4.2). Accepted by: RF (Team Leader), 2026-09-14, at Gate G4.
5. Detail Operations Order (OPORD)
This is the controlling order for the deployment, issued on confirmed advance findings. It follows the EP-010 five-paragraph structure in full.
Order Control
| Field | Value |
|---|---|
| OPORD Reference | EP-2026-CR-014-OPORD-01 |
| Date-Time Group Issued | 151500L SEP 26 (CST, UTC-6) |
| Detail Identifier | GUARDIAN TEMPISQUE |
| Principal | GARZA |
| Deployment Period | 2026-09-16 to 2026-09-19 |
| Area of Operations | Guanacaste province, Costa Rica (RGN-002); rings R1 Palmira/Parque Tempisque, R2 Carrillo canton, R3 Guanacaste province/Liberia/LIR |
| Classification / Handling | CONFIDENTIAL - CLIENT EYES ONLY (synthetic) |
| Ordered By (Team Leader) | RF |
| Approved By (Detail Leader) | RF (dual-hatted; see Section 5.5.1) |
| Distribution | BR, MR, JM, CS, vendor liaison (extract only, need-to-know) |
Handling: CONFIDENTIAL - CLIENT EYES ONLY (synthetic). Disseminate only to assigned personnel. Contains fictional personal data on the principal and staff for demonstration purposes only.
Nature of this product: This is an operational order rendered for a synthetic worked example. It does not deliver legal advice or guarantee prevention of incidents. Operational language renders to lawful protective effects only, within the jurisdiction and licensing of Costa Rica per RGN-002 Annex H.
Reference Products and Annexes
| Ref | Product | Role in this order |
|---|---|---|
| A | Section 3 of this document (Intelligence Baseline) | Threat basis (Paragraph 1) |
| B | Section 5.1.2 of this document (principal/party summary; no standalone EP-001 authored for this engagement - see note) | Principal and party (Paragraph 1) |
| C | Section 4.1 of this document (Advance Findings - Venues) | Venue and site scheme (Paragraph 3) |
| D | Section 4.2/4.3 of this document (Advance Findings - Routes) | Movement scheme (Paragraph 3) |
| E | None - no standalone EP-009 Post Orders authored for this engagement (see Section 5.3.7 scoping note) | Static post tasks (Paragraph 3) |
| F | Section 7 of this document (Communications PACE Card) | Signal (Paragraph 5) |
| G | Section 6 of this document (Emergency Action Plan Highlights) | Actions on emergency (Paragraph 3) |
Scoping note: this engagement does not instantiate standalone EP-001 (Principal Profile) or EP-009 (Post Orders) cells. Their essential content is folded directly into this order - the principal/party summary in Section 5.1.2 and the static-coverage decision in Section 5.3.3/5.3.7 - because a four-day, two-lodging, no-fixed-residence engagement of this scale does not warrant separate standing products. This is a scoping decision, stated here rather than left implicit.
5.1 Situation
5.1.1 Threat
- Assessed threat actors and intent: Opportunistic criminal elements targeting visibly affluent foreign nationals (financially motivated, non-ideological); ambient coastal narco activity as periphery, not principal-directed; community/labor friction tied to the ASADA/SENARA water-concession watch items (WI-1, WI-6), capable of manifesting as a protest or road blockade near the site. Full detail in Section 3.
- Most likely course of action: Opportunistic vehicle-borne robbery at a predictable chokepoint (Sardinal market corner or the Palmira access-road junction), or a road blockade delaying a movement leg. Likelihood: roughly even chance. Confidence: MODERATE.
- Most dangerous course of action: Express kidnapping during an unhardened movement leg. Likelihood: unlikely. Confidence: MODERATE. Consequence: critical.
- Current posture: Moderate (L x I 8 general baseline; MLCOA scores 9, MDCOA scores 10 on a consequence-weighted basis - Section 3.2). No rifle threat assessed.
5.1.2 Principal and Party
- Principal: GARZA - US-national real-estate investor/developer, family-office client, principal in the Parque Tempisque development. Low public profile, visibly affluent, not a public figure.
- Party under protection: GARZA, GARZA-2 (business partner), EA (executive assistant).
- Pattern-of-life sensitivities: A fixed four-day itinerary with two overnight locations (Resort ALFA only, for three nights) and repeated transits of the same two short corridors (Resort-Site, Resort-Sardinal/Coco) is the principal exposure driver this order manages through chokepoint avoidance and timing variance (Section 5.3.4).
5.1.3 Supporting and Adjacent Elements
- Local law enforcement liaison: Fuerza Publica, Sardinal delegation (route safe haven, Section 4.2); OIJ, Liberia regional desk (criminal-response primacy per RGN-002 Annex D). Per RGN-002 Annex D, the detail’s operational dates and principal identity are registered with the appropriate authority in advance through the designated local liaison channel.
- Venue/liaison contacts: Municipalidad de Carrillo (Filadelfia, permitting liaison); ASADA Palmira and a SENARA representative (water-concession liaison); Resort ALFA in-house security (venue liaison, Section 4.1.2).
- Other elements: None; this is a single-detail engagement with no adjacent firm details in the AO.
5.1.4 Attachments and Detachments
- Attached: Corporacion de Seguridad Chorotega S.A., licensed armed liaison/driver (L-1), sourced via the BIZ-006 vetted-vendor roster; vetting-floor check completed by BR per RGN-002 Annex G. The Annex H counsel-verification gate (RFI-RGN-002-05) remains open at the firm level; this is a standing residual risk accepted by RF for this engagement and tracked to closure before the next Costa Rica engagement.
- Detached: None.
5.1.5 Operating Environment
- Area of operations and jurisdiction: Guanacaste province, Costa Rica; rings R1 (Palmira/Parque Tempisque site), R2 (Carrillo canton: Filadelfia, Sardinal, Playas del Coco), R3 (Guanacaste province, Liberia, LIR) per RGN-002/OSINT-065.
- Common operating picture: OSINT-065 daily brief (0600 CST) and SYS-008 threat-alert stream, both delivered to CS via the SYS-006 Telegram channel. ATAK is not provisioned for this engagement - a stated gap; the detail relies on the OSINT-065 feed and the Section 7 PACE plan in place of a live mapping common operating picture.
5.2 Mission
The GUARDIAN TEMPISQUE detail protects GARZA and party (GARZA-2, EA) during the 16-19 SEP 2026 Guanacaste site visit and investor engagement within the Parque Tempisque / Resort ALFA / Liberia area of operations in order to enable the project, permitting, water-concession, and investor meetings while deterring and defending against opportunistic and express-kidnap threats under an unarmed, lawful posture.
5.3 Execution
5.3.1 Detail Leader’s Intent
- Purpose: Protect a low-profile, high-net-worth client group through a compressed multi-stop site visit in an area with no confirmed direct targeting but real opportunistic and community-friction exposure.
- Key tasks: (1) Execute the ground scheme exactly as advanced (Section 4); no unbriefed route or venue substitution. (2) Maintain an unarmed, lawful, defensive posture at all times; armed cover only from the licensed local vendor. (3) Avoid the identified predictable chokepoints through the timing and alternate-route discipline in Section 4.2. (4) Hold the go/no-go checkpoint ahead of the ASADA/SENARA meeting without exception. (5) Sustain communications and medical readiness across the rural/coastal AO given the comms and drive-time findings in Section 4.
- End state: GARZA and party depart LIR on 19 SEP with all itinerary objectives met, no incidents, and the standing intelligence and vendor-verification gaps (Section 5.1.4, Section 3.3) logged for closure before the next engagement.
5.3.2 Concept of Protection by Phase
| Phase | Description | Governing Product | Posture / Formation |
|---|---|---|---|
| 1 Residence / RON | Resort ALFA, D-0 through D-2 nights | Section 4.1.2 findings (no standalone EP-009) | No dedicated firm static post overnight (Section 5.3.7); hotel security plus periodic vendor liaison spot-checks of the beach-walkway access point |
| 2 Movement | All motorcade legs per Section 4.2/4.3 | Section 4.2/4.3 route findings | Two-vehicle motorcade: Vehicle 1 (principal) leads, Vehicle 2 (vendor/security) follows at standoff distance; formation detailed in Section 5.3.3 |
| 3 Venue / Advance | Parque Tempisque, Municipalidad de Carrillo, ASADA Palmira, Liberia investor venue, coastal parcel | Section 4.1 venue findings | Advance-held arrival points, close cover on debus, go/no-go checkpoint before the ASADA/SENARA meeting |
| 4 Return / Recovery | Return to LIR, D-3 departure | Section 4.2.1 (reverse) | Standard movement posture; accountability and kit recovery at LIR before check-in |
5.3.3 Tasks to Subordinate Elements
- Detail Leader (RF): Overall command; sole authority for no-go/abort decisions and route deviation; primary liaison point for Municipalidad de Carrillo, ASADA Palmira, and law enforcement; travels with the principal in Vehicle 1 at all times.
- Shift Lead (MR, designated): Executes day-to-day post rotation and drives or rides front in Vehicle 1 as assigned; conducts shift-standard checks per Section 9.
- Close Protection Officers (MR, JM): Close cover, embus/debus, and evacuation of the principal party; alternate between driving Vehicle 1 and riding as the principal-vehicle PPO.
- Vendor Driver/Liaison (L-1): Drives Vehicle 2 (follow/security vehicle); provides lawful armed cover, standoff, and blocking per Costa Rican licensing (RGN-002 Annex H); does not lead movement or make protective decisions - those remain with RF/MR per this order.
- Operations Manager (BR): Day-of liaison confirmation at Municipalidad de Carrillo, ASADA Palmira, and the Liberia investor venue; go/no-go ground checks (Section 5.3.4); logistics and vendor management; travels in a separate, non-detail logistics vehicle when conducting liaison tasks ahead of the principal’s movement.
- Detail Intelligence Officer (CS, remote): Delivers the OSINT-065 daily brief (0600 CST) and monitors the SYS-008 alert stream for the duration of the engagement; tracks PIR status (Section 5.3.5); immediately pushes any T0 flash tripwire event (L x I >= 16) to RF.
- Residence / Static Posts: None separately staffed for this engagement (Section 5.3.7).
5.3.4 Coordinating Instructions
- Timeline and key timings: D-0: 1500L LIR arrival, approximately 1610L Resort ALFA arrival. D-1: 0600L daily brief, 0800L depart for site, 0830-1000L project walkthrough, 1000-1130L project-team meeting, 1145-1300L Municipalidad de Carrillo meeting, 1330L go/no-go checkpoint, 1400-1530L ASADA/SENARA meeting, approximately 1605L return to Resort ALFA. D-2: 0900L depart for coastal-parcel viewing, 0915-1030L viewing, 1300-1500L Liberia investor meeting, approximately 1600L return to Resort ALFA, remainder of afternoon held as contingency buffer. D-3: 0900L depart Resort ALFA, approximately 0945-1000L arrive LIR, mid-morning departure flight.
- Rules of engagement and use of force: The detail is unarmed. Lawful armed cover, where used, is provided solely by the licensed local vendor liaison (L-1) under Costa Rican law (Ley N. 7530 / Ley N. 8395, RGN-002 Annex H). Force is graduated and strictly defensive; all action renders to lawful effect: deny access, increase standoff, evacuate, and hand off to Fuerza Publica or OIJ. No firearm is carried by RF, BR, MR, JM, or CS at any time in-country.
- Actions on contact and emergency: Execute Section 6 (Emergency Action Plan Highlights). Any operator may declare an emergency.
- Surveillance detection posture: No dedicated surveillance-detection element is deployed, consistent with the EP-022 advance boundary and detail size. All operators maintain passive hostile-surveillance awareness; any indicator is reported to CS and RF immediately.
- Rehearsals: Held at Gate G5 (15 SEP): vehicle-contact/cross-load drill, medical/casualty drill, and an embus/debus walk-through at Resort ALFA and Parque Tempisque. The residence/RON intrusion drill was rehearsed tabletop only, not walked at the site - logged as an open item (Section 9.3).
- No-go / abort criteria (RF decides): (1) A confirmed hostile-surveillance indicator halts the affected activity pending RF’s continue/relocate/abort decision. (2) An observed protest or organized turnout at or approaching the ASADA/SENARA meeting, or at the Palmira access-road junction, holds the meeting or movement pending RF’s decision; this is the specific go/no-go checkpoint at 1330L on D-1. (3) A Ruta 21 or coastal-road closure with no viable alternate inside 30 minutes postpones the remaining day’s itinerary, with the client consulted. (4) Any rainy-season flood or landslide advisory for the AO triggers a reassessment of the day’s movement against the Section 4.2 emergency-route set.
5.3.5 Priority Intelligence Requirements (as of OPORD issue, 15 SEP 2026)
Compare against the Section 3.3 baseline (as of G2, 09 SEP). Confidence on route and vendor status rises here because the physical advance (Section 4) has since ground-truthed both.
| PIR | Answer (as of 15 SEP) | Confidence | Key Gap |
|---|---|---|---|
| PIR-1: Has hostile surveillance of GARZA or the residence/venues been detected? | No hostile-surveillance indicators observed through the advance window or in the OSINT-065 feed | MODERATE | Still no dedicated surveillance-detection element; ground-based awareness only |
| PIR-2: Are all planned movement routes open and free of blocking events? | Yes - both primary routes and the local legs were driven during the D-5/D-4 advance with no closures observed; current OSINT-065 daily brief shows no new closures | HIGH | Rainy-season conditions can still change day-of; the morning-of daily brief is the standing check |
| PIR-3: Is there indication of an organized community/labor action (WI-6) near Parque Tempisque? | No active mobilization identified as of this date; WI-6 remains open at Moderate | LOW-MODERATE | Local contact-row gaps (RFI-RGN-002-07) persist; day-of BR ground check is the primary mitigant |
| PIR-4: Has the ASADA/SENARA meeting profile changed? | No; still scheduled as a routine technical session | LOW | Day-of sensitivity could still change; T0 flash tripwire is the standing check |
| PIR-5: Have all advance surveys and route analyses been completed and approved? | Yes - three venue findings and two route analyses completed, briefed back, and accepted at Gate G3; the one open item (Liberia investor-venue confirmation) resolves with BR’s morning-of walkthrough on D-2 | HIGH | None outstanding at OPORD issue |
5.4 Administration and Logistics
5.4.1 Personnel
- Roster: RF (Team Leader/Detail Leader), BR (Operations Manager), MR and JM (Close Protection Officers/drivers), CS (Detail Intelligence Officer, remote), L-1 (vendor armed liaison/driver).
- Shift structure: Given the small roster, MR and JM alternate the lead-driver/PPO role across each day rather than running a formal shift-relief cycle; RF is present at every principal-in-public movement. No operator exceeds 12 hours of active duty without relief.
- Redundancy risk: With only two firm Close Protection Officers, the detail has minimal redundancy; if either MR or JM is degraded (illness, injury), there is no immediate firm backfill. Mitigation: the vendor contract with Corporacion de Seguridad Chorotega S.A. includes a surge clause for an additional licensed operator on short notice.
- Accountability reporting: Headcount of the full party at every venue arrival/departure and at the evening sync (Section 9).
5.4.2 Logistics
- Vehicles: 2x SUV, soft-skin, low-profile, full-size (7-8 passenger capacity), sourced locally from Corporacion de Seguridad Chorotega S.A. via the BIZ-006 pipeline. Vehicle 1 (principal): driver JM or MR (alternating), PPO MR or JM (alternating), RF, GARZA, GARZA-2, EA. Vehicle 2 (follow/security): driver L-1 (armed per license), passenger BR when not conducting separate liaison tasks. Trade study and risk acceptance at Section 4.4.
- Equipment and loadout: Individual kit per SYS-009; vehicle kit per SYS-010; communications per SYS-003 baseline and the Section 7 PACE card; Starlink Mini staged per Section 4.1.3 and Section 4.1.2 for comms-degraded locations.
- Weapons: None carried by firm personnel (unarmed per RGN-002 Annex H). L-1 carries a firearm under Corporacion de Seguridad Chorotega S.A.’s own Costa Rican private-security license, not the firm’s.
- Billeting and sustenance: Resort ALFA, D-0 through D-2 nights; meals via resort dining and site-day catering as arranged by BR.
5.4.3 Medical (Casualty Evacuation)
- Detail medic: None dedicated for this short engagement. MR and JM are IFAK-trained and carry individual kits per SYS-009. This is a stated scoping decision and risk, not an oversight, given the rural site and the 35-45 minute drive-time finding at Parque Tempisque (Section 4.1.3).
- Nearest trauma facility per phase: LIR/arrival - Hospital Enrique Baltodano Briceno, approximately 20 minutes. Resort ALFA - same facility, approximately 30-40 minutes. Parque Tempisque - same facility, approximately 35-45 minutes. Liberia investor venue - same facility, approximately 10-15 minutes (in Liberia itself).
- Definitive / specialty care: Hospital CIMA, San Jose (RGN-002 Annex C, A1 grade, Joint Commission International accredited). Air-evacuation landing permissions at CIMA remain an open RFI at the region-package level (RFI-RGN-002-02); this order does not assume air-evac is available and defaults to ground transfer.
- Casualty evacuation sequence: Execute Section 6 (this document).
5.4.4 Legal and Administrative
- Jurisdiction and licensing: Costa Rica. The firm’s own personnel are unarmed by law (Ley N. 7530); lawful armed cover is provided only by the licensed vendor (Ley N. 8395) per RGN-002 Annex H. The Annex H counsel-verification gate (RFI-RGN-002-05) is open at the firm level and is accepted as a standing residual risk for this engagement by RF, tracked to closure before the next Costa Rica engagement.
- Documentation: After-action reporting per Section 9; any use-of-force or detention event is documented per the notification matrix referenced in Section 8.
5.5 Command and Signal
5.5.1 Command
- Chain of command: RF (Team Leader and Detail Leader, dual-hatted for this engagement given detail size) → MR (designated Shift Lead) → JM / L-1.
- Succession: If RF is unreachable or is the casualty, command passes to BR for administrative and logistics decisions and to MR for on-scene tactical decisions, pending RF’s return or a Team Leader-level replacement. This is a named single-point risk given the firm does not field a bench Detail Leader for this engagement; mitigated by BR’s standing authority to request immediate vendor-surge command support if both RF and MR are unavailable (Section 9.3).
- Detail Leader location: With the principal during all venue and movement phases; functions as the command post at Resort ALFA during RON.
- Decision authority: MR may decide post rotation, minor timing shifts, and any immediate life-safety action without reference to RF. RF decides route changes, no-go calls, and any deviation from this order.
5.5.2 Signal
From Section 7. Today’s active settings only; the full PACE plan governs.
- Nets: A single Detail Net serves this engagement (RF, BR, MR, JM, CS remote, L-1 patched in via cellular), an adaptation of the standard EP-011 multi-net architecture appropriate to detail size; this is a stated PARTIAL-coverage adaptation of EP-011 per the DOCTRINE.md coverage-band rule.
- Call signs: RF “SENTRY ONE”; MR “SENTRY TWO”; JM “SENTRY THREE”; BR “BASE”; CS “ANCHOR”; L-1 “LOCAL ONE”; GARZA “TEMPISQUE ONE”; GARZA-2 “TEMPISQUE TWO”; EA “TEMPISQUE THREE”.
- Communications checks: Hourly during RON/routine; every 15 minutes during movement or site activity; continuous monitor during the ASADA/SENARA meeting window (Section 9).
- Duress and lost communications: Per Section 7 duress procedure and lost-comms rally plan.
- Common operating picture: OSINT-065 Telegram feed (no ATAK provisioned this engagement - stated gap, Section 5.1.5).
- Reporting timeline: Routine SITREP at midday and at the evening sync (Section 9); immediate reports on any Section 6/8 event trigger.
6. Emergency Action Plan Highlights
Highlights only, drawn from the EP-012 pattern and tailored to this engagement’s four most relevant scenarios. Full drill behavior is in Section 8.
| Emergency | Trigger | Immediate Actions | Destination / Rally | Notification |
|---|---|---|---|---|
| Medical / MEDEVAC | Injury or acute illness to any party member | (1) Scene safety; (2) life-saving intervention within training scope (IFAK, MR/JM); (3) call 911 and notify RF/CS; (4) transport decision: self-transport by detail vehicle if EMS exceeds 20 minutes and the casualty is stable-movable, otherwise await EMS | Stabilization at Hospital Enrique Baltodano Briceno, Liberia; transfer to Hospital CIMA, San Jose for definitive/specialty care (ground transfer assumed; air-evac permissions unconfirmed, RFI-RGN-002-02) | RF immediately; client emergency contact by RF, not from the scene; one operator escorts, protective coverage of the remaining party never drops below one CPO plus the vendor liaison |
| Vehicle Contact | Collision, mechanical disablement, or deliberate blocking of the motorcade | (1) Unblocked vehicle creates standoff and covers the principal vehicle; (2) assess drive-through / reverse / cross-load in seconds; (3) cross-load the principal under body cover if required; (4) move to the alternate route (Section 4.2) or nearest safe haven | Delegacion Policial de Sardinal or Municipalidad de Carrillo, whichever is nearer; if immobilized, defend in place under the unarmed/lawful posture (vendor liaison provides lawful defensive cover only) and call Fuerza Publica/OIJ | RF and CS immediately; Fuerza Publica/OIJ per the liaison protocol if any criminal act is involved |
| Road Blockade (WI-6-linked) | Visual confirmation of a blockade or demonstration near the Palmira access road or the Sardinal center | (1) Do not attempt to push through a populated blockade; (2) execute the pre-briefed U-turn/reverse and divert to the alternate leg (Section 4.2.2) before committing to the chokepoint; (3) if the blockade is at the meeting venue itself, invoke the OPORD no-go criterion (Section 5.3.4) | Nearest safe haven per Section 4.2 route table; meeting postponed or relocated via the established liaison channel (Municipalidad/ASADA) | RF decides continue/relocate/abort; Municipalidad or ASADA liaison notified of any change; client notified same day |
| Lost Communications | Net or member unreachable past two failed checks | (1) Execute the PACE fallback in order (Section 7); (2) the unreachable mobile element proceeds to the briefed rally point (Resort ALFA command post, or the nearest Section 4 safe haven) and holds; (3) detail elevates posture until the picture is restored | Resort ALFA command post, or the nearest route safe haven | BR initiates the welfare/search sequence at 30 minutes overdue; RF notified immediately on any failed check |
7. Communications PACE Card
Card only; full PACE method is EP-11’s pattern, adapted here to a single-Detail-Net architecture appropriate to this engagement’s size (Section 5.5.2).
| Step | Channel / Means | Configuration | Failover Trigger |
|---|---|---|---|
| Primary | ICE (Kolbi) cellular voice/data + Telegram (SYS-006) | “GUARDIAN TEMPISQUE” encrypted group channel; all detail personnel and L-1 included | No response to 2 calls over 5 minutes |
| Alternate | Second-carrier cellular (Liberty or Claro) voice/data | Same Telegram group, alternate SIM/data path on each handset | Primary carrier signal lost or degraded (per the Section 4.1.3 site dead-spot finding) |
| Contingency | Starlink Mini (Global Roam plan for Costa Rica, BIZ-013 risk R3) | Data uplink for Telegram/voice-over-data; staged at Parque Tempisque for the D-1 duration and available on request elsewhere | Both cellular carriers unavailable (rural dead spot or outage) |
| Emergency | Local SMS (store-and-forward) plus vendor UHF/VHF radio net (L-1’s equipment) | Non-digital fallback; hand signals/runner within a venue as the last resort | All data and voice channels down |
- Duress: Verbal duress phrase, “the shipment is delayed,” used in any normal-sounding transmission; treated as a confirmed emergency until proven otherwise. Digital duress: a designated keyword typed in the Telegram channel triggers a silent alert to CS and RF.
- Challenge/response: Challenge “TEMPISQUE,” response “PALMIRA,” for verifying identity during an active incident.
- Comms check schedule: Hourly during RON/routine posture; every 15 minutes during movement or site activity; continuous monitor during the 1330-1530L ASADA/SENARA meeting window on D-1.
- Brevity codes: “WHEELS UP” (movement start); “SET” (arrived/secured); “HOLD” (pause movement); “BLOCKED” (route obstruction); “MEDICAL” (injury, location follows).
- Radio/net discipline: No principal name, itinerary detail, or coordinates in plain voice or text where avoidable; use call signs and brevity codes per this card.
8. Crisis Drills Quick-Reference
Selected from the EP-025 drill library and tailored to this engagement’s assessed COAs (Section 3.2). Per EP-025 Section 9, every new area of operations triggers the Attack on Principal, Medical, and Vehicle drills before first movement regardless of assessed likelihood; that rule is honored below even where relevance is low.
| Drill | Trigger (GUARDIAN TEMPISQUE-specific) | End State | Rehearsed |
|---|---|---|---|
| Attack on Principal / Active Assailant | Weapon displayed or direct assault on the principal | Principal evacuated to Vehicle 1 or the nearest safe haven; low assessed likelihood (no rifle threat, Section 3.1) but mandatory per the EP-025 new-AO rule | Walked, 15 SEP (G5) |
| Medical Emergency | Injury or acute illness (Section 6) | Casualty in care at Hospital Enrique Baltodano Briceno with protective coverage maintained on the remaining party | Walked, 15 SEP (G5) |
| Vehicle Contact / Blocked Route | Collision, mechanical disablement, or deliberate block (MLCOA-relevant, Section 6) | Principal mobile on the alternate route, or secured awaiting Fuerza Publica/OIJ response | Walked, 15 SEP (G5) |
| Hostile Surveillance / Abduction Attempt | Confirmed surveillance or a seizure attempt (MDCOA-relevant) | Contact broken; principal moved to a public, populated, or hardened location; OIJ notified if any team member is taken | Walked, 15 SEP (G5) |
| Lost Communications | Two failed net checks (Section 6/7) | Comms restored, or the overdue/welfare procedure running under BR | Walked, 15 SEP (G5) |
| Residence / RON Intrusion | Breach or attempted breach at Resort ALFA (low relevance - no dedicated firm static post, Section 5.3.3) | Principal accounted for at the hotel management/security office rally point; hotel security and Fuerza Publica engaged | Tabletop only - not walked at the site; flagged per EP-025 Section 9 realism-floor rule (Section 9.3 open item) |
| Arrest / Detention by Authorities | Any team member detained by police or officials | Legal process running with counsel engaged (per the open Annex H counsel-verification gate, Section 5.4.4); remaining operators re-form coverage on the principal | Tabletop only (included for library completeness; low assessed relevance) |
9. Deployment Battle Rhythm and After-Action Hooks
9.1 Daily Cycle Pattern (EP-021 pattern, adapted)
| Offset | Event | Participants | Output |
|---|---|---|---|
| M-2:00 | OSINT-065 daily brief (0600 CST) and SYS-008 overnight review | CS to RF/BR | Threat-change summary; PIR status update |
| M-1:30 | Daily detail brief | RF, BR, MR, JM | Itinerary confirmation, comms settings, go/no-go items for the day |
| M-1:00 | Vehicle and kit checks | MR, JM | SYS-009/SYS-010 checklists; any deficiency to RF |
| M-0:30 | Comms check, all nets | All | Per Section 7; failures worked before movement |
| M-hour | First movement of the day | Full detail | Execution per Section 5.3 |
| Midday | Situation check | BR to RF (in person, given continuous co-location with the principal) | Routine status; immediate reports are event-driven per Section 7 |
| E+0:30 | Evening sync | RF, BR, CS (remote) | Next-day timing confirmed; PIR review (Section 5.3.5 pattern); logistics needs to BR |
| E+1:00 | Daily log closed | RF | Day’s occurrences and any deviation filed |
9.2 Per-Day Schedule (actual clock times)
| Day | Date | M-hour / Key Events |
|---|---|---|
| D-0 | 16 SEP (Wed) | 1500L LIR arrival; approx. 1610L Resort ALFA arrival; RON |
| D-1 | 17 SEP (Thu) | 0600L brief; 0800L depart for site; 0830-1000L walkthrough; 1000-1130L project-team meeting; 1145-1300L Municipalidad de Carrillo; 1330L go/no-go checkpoint; 1400-1530L ASADA/SENARA meeting; approx. 1605L return to Resort ALFA; 1730L evening sync; RON |
| D-2 | 18 SEP (Fri) | 0600L brief; 0900L depart for coastal-parcel viewing; 0915-1030L viewing; 1030L depart for Liberia; 1300-1500L investor meeting; approx. 1600L return to Resort ALFA; remainder of afternoon held as contingency buffer; RON |
| D-3 | 19 SEP (Sat) | 0600L final brief; 0900L depart Resort ALFA; approx. 0945-1000L arrive LIR; mid-morning departure; execution handoff/stand-down at wheels-up |
Per EP-021 Section 5, a four-day single-site engagement of this scale collapses the standing weekly cycle into the single window covered by the daily cycles above; only the “engagement end” per-engagement event (the after-action report, Section 9.3) applies as a standalone item.
9.3 After-Action Hooks and Consolidated Risk Register
The operation has not yet executed as of this document’s issue; this subsection states the after-action process and carries forward the risks and gaps this planning cycle already knows about. It does not assert fabricated outcomes.
- AAR mandate: Per the EP-017 pattern, an after-action report is due within 72 hours of stand-down (19 SEP), so no later than 22 SEP 2026. RF drafts within 24 hours of stand-down (by 20 SEP); BR convenes any review needed within the same window given the engagement’s short duration.
- Metrics to capture (not yet available): medical-response latency (if any activation occurs); comms failures/dropouts count; advance-accuracy discrepancies (actual site/route conditions vs. Section 4 findings); near-miss count.
- Corrective-action seeds already known from planning (to be dispositioned in the AAR):
| # | Item | Source | Proposed Corrective Action | Owner |
|---|---|---|---|---|
| 1 | Residence/RON intrusion drill rehearsed tabletop only, not walked at Resort ALFA | Section 2.3 deviation log; Section 8 | Walk the drill at the site on the next Guanacaste engagement, or resource a dedicated overnight static post if lodging risk profile changes | RF |
| 2 | Sardinal market-day assumption (Wed/Sat) not confirmed against a formal registry | Assumption A-4 | Confirm the actual municipal market calendar before the next engagement; revise Section 4.2 chokepoint timing if wrong | BR |
| 3 | RGN-002 local contact-row gaps (RFI-RGN-002-07/08) still open | Section 3.3, PIR-3/PIR-5 | Populate Guanacaste-local medical, vendor, and law-enforcement contact rows in RGN-002 before the next engagement | Operations Manager (BR) / CS |
| 4 | Annex H counsel-verification gate (RFI-RGN-002-05) still open | Section 5.1.4, Section 5.4.4 | Retain and record local counsel to close the gate at the firm level | Operations Manager (BR) |
| 5 | No air-evac landing-permission confirmation at Hospital CIMA (RFI-RGN-002-02) | Section 5.4.3 | Confirm helicopter evacuation flight paths and landing permissions before relying on air-evac in any future medical plan | Detail Leader |
- Consolidated risk register (planning and execution risk, distinct from the threat-actor analysis in Section 3):
| # | Risk | Likelihood | Impact | L x I | Mitigation |
|---|---|---|---|---|---|
| R-1 | Soft-skin vehicle trade leaves no ballistic/blast protection (Section 4.4) | 2 | 4 | 8 (Moderate) | Route discipline, chokepoint avoidance, low-profile selection, licensed armed liaison in the follow vehicle |
| R-2 | No dedicated detail medic | 2 | 4 | 8 (Moderate) | IFAK-trained CPOs; established MEDEVAC sequence (Section 6) |
| R-3 | No ATAK / live common operating picture | 2 | 2 | 4 (Low) | OSINT-065 Telegram feed cadence; T0 flash tripwire |
| R-4 | Single-point command succession (RF dual-hatted, no bench Detail Leader) | 2 | 4 | 8 (Moderate) | BR/MR succession chain (Section 5.5.1); vendor-surge clause for emergency augmentation |
| R-5 | Annex H counsel-verification gate open (RFI-RGN-002-05) | 2 | 3 | 6 (Moderate) | Accepted by RF for this engagement; tracked to closure (item 4 above) |
| R-6 | Residence intrusion drill not walked at Resort ALFA | 2 | 3 | 6 (Moderate) | Hotel security liaison, vendor overnight spot-checks; corrective action (item 1 above) |
| R-7 | Palmira access-road single point of failure (unpaved, no bypass, cellular dead spot) | 3 | 3 | 9 (Moderate) | Starlink Mini staged; daylight-only site policy; go/no-go checkpoint before the ASADA/SENARA meeting |
Risk scoring key: Likelihood (1-5) x Impact (1-5) = 1-25; 1-5 Low, 6-10 Moderate, 11-15 Elevated, 16-20 High, 21-25 Critical.
END OF WORKED EXAMPLE