Harborline · Runbook Hub connector

Proof of work · Strategic Solutions Engineer, West

Same question. Only the runbook you can open.

Harborline’s outage wiki has no native connector. This TypeScript connector indexes the identity graph and a per-document ACL. The assistant then quotes only documents that person could open in the source. Maya Chen is payments on-call. Luis Ortega is support.

One question, two identities. The index is filtered before anything is quoted.

Maya and Luis received different answers. Each citation is a document that identity can open. Denied documents were not quoted.

Asking as

Maya Chen

Payments on-call SRE

Should quote the operational rollback. She also belongs to the groups that can read the customer playbook. She should not see the credential hold or the board brief.

companypayments-oncallsre via parentengineering via parent

Maya Chen can open 1 document that matches this question.

From “Payments API outage runbook”

Immediate actions

1. Confirm you are the payments primary, or page that primary before changing traffic. 2. On the payments-api golden dashboard, confirm the authorization error rate has stayed above 2% for five minutes. 3. Turn on rollback flag harbor-rollback-77. New authorizations move to the last known-good processor path. 4. If the error rate is still climbing after ten minutes, drain canary cell pay-api-cell-3 and leave cells 1 and 2 serving.

Escalate

Page the payments engineering manager if harbor-rollback-77 has not brought the error rate under 0.5% within fifteen minutes.

Citations

Payments API outage runbook

https://runbookhub.harborline.example/docs/pay-sre-runbook

1. Confirm you are the payments primary, or page that primary before changing traffic. 2. On the payments-api golden dashboard, confirm the authorization error rate has stayed above 2% for five minutes. 3. Turn on rol…

Matched allowedGroups: payments-oncall

Full text of “Payments API outage runbook”

## Immediate actions 1. Confirm you are the payments primary, or page that primary before changing traffic. 2. On the payments-api golden dashboard, confirm the authorization error rate has stayed above 2% for five minutes. 3. Turn on rollback flag harbor-rollback-77. New authorizations move to the last known-good processor path. 4. If the error rate is still climbing after ten minutes, drain canary cell pay-api-cell-3 and leave cells 1 and 2 serving. ## While that runs Do not rotate merchant credentials from this page. Security owns that hold. Do not give merchants an internal cell name or this flag name. ## Escalate Page the payments engineering manager if harbor-rollback-77 has not brought the error rate under 0.5% within fifteen minutes.

Reviewer trace

Denied titles are on this console so you can see the filter. The employee payload below does not include them.

  • Payments API outage runbookQuoted

    Matched allowedGroups: payments-oncall Relevance 4.569.

  • Payments API outage: customer communication playbookVisible, not quoted

    Matched allowedGroups: payments-oncall Relevance 1.779.

  • Payments API outage: credential holdDenied

    not in allowedGroups (security)

  • Payments API outage: board briefDenied

    not in allowedGroups (exec)

  • Status page draft for a payments disruptionVisible, not quoted

    Matched allowedGroups: company

  • Checkout latency runbookVisible, not quoted

    Matched allowedGroups: sre

  • Payments API bridge cutover windowDenied

    intersections failed (engineering + security missing security)

  • Vendor bridge note for the payments API outageDenied

    not in allowedUsers (sam.okonkwo@harborline.example)

  • Engineering incident principlesVisible, not quoted

    Matched allowedGroups: engineering

Employee payload

Produced by the same ask path with the reviewer trace left off. Denied titles are not in this JSON.

{
  "requester": {
    "email": "maya.chen@harborline.example",
    "name": "Maya Chen",
    "title": "Payments on-call SRE",
    "directGroups": [
      "company",
      "payments-oncall"
    ],
    "expandedGroups": [
      "company",
      "payments-oncall",
      "sre",
      "engineering"
    ]
  },
  "query": "What's the outage runbook for the payments API?",
  "answer": "Maya Chen can open 1 document that matches this question.\n\nFrom “Payments API outage runbook”:\nImmediate actions\n1. Confirm you are the payments primary, or page that primary before changing traffic.\n2. On the payments-api golden dashboard, confirm the authorization error rate has stayed above 2% for five minutes.\n3. Turn on rollback flag harbor-rollback-77. New authorizations move to the last known-good processor path.\n4. If the error rate is still climbing after ten minutes, drain canary cell pay-api-cell-3 and leave cells 1 and 2 serving.\n\nEscalate\nPage the payments engineering manager if harbor-rollback-77 has not brought the error rate under 0.5% within fifteen minutes.",
  "blocks": [
    {
      "documentId": "pay-sre-runbook",
      "title": "Payments API outage runbook",
      "viewUrl": "https://runbookhub.harborline.example/docs/pay-sre-runbook",
      "sections": [
        {
          "heading": "Immediate actions",
          "text": "1. Confirm you are the payments primary, or page that primary before changing traffic.\n2. On the payments-api golden dashboard, confirm the authorization error rate has stayed above 2% for five minutes.\n3. Turn on rollback flag harbor-rollback-77. New authorizations move to the last known-good processor path.\n4. If the error rate is still climbing after ten minutes, drain canary cell pay-api-cell-3 and leave cells 1 and 2 serving."
        },
        {
          "heading": "Escalate",
          "text": "Page the payments engineering manager if harbor-rollback-77 has not brought the error rate under 0.5% within fifteen minutes."
        }
      ]
    }
  ],
  "citations": [
    {
      "id": "pay-sre-runbook",
      "title": "Payments API outage runbook",
      "viewUrl": "https://runbookhub.harborline.example/docs/pay-sre-runbook",
      "updatedAt": "2026-10-28T15:04:00.000Z",
      "snippet": "1. Confirm you are the payments primary, or page that primary before changing traffic. 2. On the payments-api golden dashboard, confirm the authorization error rate has stayed above 2% for five minutes. 3. Turn on rol…",
      "grant": "Matched allowedGroups: payments-oncall",
      "score": 4.569
    }
  ],
  "sources": [
    {
      "id": "pay-sre-runbook",
      "title": "Payments API outage runbook",
      "viewUrl": "https://runbookhub.harborline.example/docs/pay-sre-runbook",
      "body": "## Immediate actions\n1. Confirm you are the payments primary, or page that primary before changing traffic.\n2. On the payments-api golden dashboard, confirm the authorization error rate has stayed above 2% for five minutes.\n3. Turn on rollback flag harbor-rollback-77. New authorizations move to the last known-good processor path.\n4. If the error rate is still climbing after ten minutes, drain canary cell pay-api-cell-3 and leave cells 1 and 2 serving.\n\n## While that runs\nDo not rotate merchant credentials from this page. Security owns that hold.\nDo not give merchants an internal cell name or this flag name.\n\n## Escalate\nPage the payments engineering manager if harbor-rollback-77 has not brought the error rate under 0.5% within fifteen minutes."
    }
  ],
  "index": {
    "datasource": "runbookhub",
    "displayName": "Runbook Hub",
    "documentCount": 9,
    "userCount": 7,
    "groupCount": 10,
    "warnings": [],
    "indexedAt": "2026-11-05T06:46:23.987Z"
  }
}

Asking as

Luis Ortega

Customer support

Should quote the customer status line only. The on-call rollback, the credential hold, and the board brief stay closed.

companysupportcustomer-success

Luis Ortega can open 1 document that matches this question.

From “Payments API outage: customer communication playbook”

What to tell customers

Use status line harbor-customer-copy-12: "Card payments are delayed while we restore the payments service. Charges were not duplicated. No action is needed from your customers."

Citations

Payments API outage: customer communication playbook

https://runbookhub.harborline.example/docs/pay-support-playbook

Use status line harbor-customer-copy-12: "Card payments are delayed while we restore the payments service. Charges were not duplicated. No action is needed from your customers."

Matched allowedGroups: support, customer-success

Full text of “Payments API outage: customer communication playbook”

## What to tell customers Use status line harbor-customer-copy-12: "Card payments are delayed while we restore the payments service. Charges were not duplicated. No action is needed from your customers." ## What not to say Do not name a processor, a feature flag, or an internal cell. Do not offer a restoration time unless the public status page already has one. ## Channels 1. Update the public status page with the sentence above. 2. Reply to merchant tickets with the same sentence and a link to the status page. 3. Escalate to the support lead if a merchant reports a duplicate capture.

Reviewer trace

Denied titles are on this console so you can see the filter. The employee payload below does not include them.

  • Payments API outage runbookDenied

    not in allowedGroups (payments-oncall)

  • Payments API outage: customer communication playbookQuoted

    Matched allowedGroups: support, customer-success Relevance 2.985.

  • Payments API outage: credential holdDenied

    not in allowedGroups (security)

  • Payments API outage: board briefDenied

    not in allowedGroups (exec)

  • Status page draft for a payments disruptionVisible, not quoted

    Matched allowedGroups: company

  • Checkout latency runbookDenied

    not in allowedGroups (sre)

  • Payments API bridge cutover windowDenied

    intersections failed (engineering + security missing engineering, security)

  • Vendor bridge note for the payments API outageDenied

    not in allowedUsers (sam.okonkwo@harborline.example)

  • Engineering incident principlesDenied

    not in allowedGroups (engineering)

Employee payload

Produced by the same ask path with the reviewer trace left off. Denied titles are not in this JSON.

{
  "requester": {
    "email": "luis.ortega@harborline.example",
    "name": "Luis Ortega",
    "title": "Customer support",
    "directGroups": [
      "company",
      "support",
      "customer-success"
    ],
    "expandedGroups": [
      "company",
      "support",
      "customer-success"
    ]
  },
  "query": "What's the outage runbook for the payments API?",
  "answer": "Luis Ortega can open 1 document that matches this question.\n\nFrom “Payments API outage: customer communication playbook”:\nWhat to tell customers\nUse status line harbor-customer-copy-12: \"Card payments are delayed while we restore the payments service. Charges were not duplicated. No action is needed from your customers.\"",
  "blocks": [
    {
      "documentId": "pay-support-playbook",
      "title": "Payments API outage: customer communication playbook",
      "viewUrl": "https://runbookhub.harborline.example/docs/pay-support-playbook",
      "sections": [
        {
          "heading": "What to tell customers",
          "text": "Use status line harbor-customer-copy-12: \"Card payments are delayed while we restore the payments service. Charges were not duplicated. No action is needed from your customers.\""
        }
      ]
    }
  ],
  "citations": [
    {
      "id": "pay-support-playbook",
      "title": "Payments API outage: customer communication playbook",
      "viewUrl": "https://runbookhub.harborline.example/docs/pay-support-playbook",
      "updatedAt": "2026-10-28T15:04:00.000Z",
      "snippet": "Use status line harbor-customer-copy-12: \"Card payments are delayed while we restore the payments service. Charges were not duplicated. No action is needed from your customers.\"",
      "grant": "Matched allowedGroups: support, customer-success",
      "score": 2.985
    }
  ],
  "sources": [
    {
      "id": "pay-support-playbook",
      "title": "Payments API outage: customer communication playbook",
      "viewUrl": "https://runbookhub.harborline.example/docs/pay-support-playbook",
      "body": "## What to tell customers\nUse status line harbor-customer-copy-12: \"Card payments are delayed while we restore the payments service. Charges were not duplicated. No action is needed from your customers.\"\n\n## What not to say\nDo not name a processor, a feature flag, or an internal cell.\nDo not offer a restoration time unless the public status page already has one.\n\n## Channels\n1. Update the public status page with the sentence above.\n2. Reply to merchant tickets with the same sentence and a link to the status page.\n3. Escalate to the support lead if a merchant reports a duplicate capture."
    }
  ],
  "index": {
    "datasource": "runbookhub",
    "displayName": "Runbook Hub",
    "documentCount": 9,
    "userCount": 7,
    "groupCount": 10,
    "warnings": [],
    "indexedAt": "2026-11-05T06:46:23.987Z"
  }
}

Ask as someone else

Security, the executive team, a contractor, and a named vendor liaison are indexed too. The cutover note requires engineering and security together. The vendor note names one email and does not grant the vendors group.

What the connector indexed

Identities are pushed before documents. Bodies stay on the server until a query is allowed to quote them. This list is the reviewer view of titles and ACLs, not the employee payload.

full crawl9 documents7 users10 groups18 memberships0 ACL warnings

payments-oncall is a member of sre, and sre is a member of engineering. Membership is not copied onto each document.

Payments API outage runbook

pay-sre-runbook

runbook · groups: payments-oncall

Payments API outage: customer communication playbook

pay-support-playbook

playbook · groups: support, customer-success, payments-oncall

Payments API outage: credential hold

pay-security-hold

hold · groups: security

Payments API outage: board brief

pay-exec-brief

brief · groups: exec

Status page draft for a payments disruption

pay-status-draft

status · groups: company

Checkout latency runbook

checkout-latency

runbook · groups: sre

Payments API bridge cutover window

pay-cutover-window

change · intersection: engineering + security

Vendor bridge note for the payments API outage

pay-vendor-note

note · users: sam.okonkwo@harborline.example

Engineering incident principles

eng-incident-principles

standard · groups: engineering