Runbook Generation: Ops Memory That Survives Turnover

A runbook written today is 80% accurate next month and 30% accurate next year. The system being run on changed; the steps in the runbook didn't. AI can't write runbooks from nothing — but it CAN turn structured incident data into runbook drafts that capture how the system actually behaves now.

From incident to runbook

1. 1Capture the incident timeline as structured data: alert, action, observation, outcome
2. 2Feed the timeline plus the resolution into the LLM with a runbook template
3. 3Generate a draft that the responder edits — the draft is faster than starting blank
4. 4Cross-link related incidents so patterns emerge
5. 5Version the runbook with the dependency graph it covers

The drift detector

When runbooks are AI-generated from incidents, drift becomes measurable: if last quarter's runbook predicted a different resolution path than this quarter's incident, the system has changed. That delta is itself a signal worth surfacing to the team.

The big idea: runbooks are downstream artifacts of incidents. Generate them from real incident data and they stay alive.