Appendix B: Templates and Tools

This appendix is the directory of reusable templates and tools for the transformed blue team, in the repository that accompanies AI Blue. Each artefact is designed to be copied into an organisation's own repositories, adapted to its contracts, works agreements and national law, and maintained under version control. The chapter that introduces each artefact is listed so that readers can find the rationale behind the design. None of the templates is legal advice, and none serves attack tooling.

The governance templates of AI Governance, Appendix C, the platform and security templates of AI Platform and Security, Appendix B, the detection, guardrail and chaos-experiment artefacts of AI Red Team, Appendix A, and the role, control and mandate artefacts of The Transformed Security Architect remain the reference for those subjects and are not repeated here.

Templates by activity

No.	Activity	Artefact	Where to find it	Introduced in
B.1	Definition	Blue team function inventory	Chapter 2	Chapter 2
B.2	Definition	Team charter and delegation profile (`DLG-*`)	Chapter 4	Chapter 4
B.3	Records	Delegation register for the blue team	Chapter 4	Chapter 4
B.4	Detection	Detection record (`DET-*`)	Chapter 6	Chapter 6
B.5	Triage	Closure policy	Chapter 7	Chapter 7
B.6	Investigation	Case record (`CASE-*`)	Chapter 8	Chapter 8
B.7	Hunting	Hunt record (`HNT-*`)	Chapter 9	Chapter 9
B.8	Response	Playbook manifest (`PBK-*`)	Chapter 10	Chapter 10
B.9	Learning	Post-incident review (`PIR-*`)	Chapter 11	Chapter 11
B.10	AI use	Analyst AI-use policy	Chapter 12	Chapter 12
B.11	Agents	Mandate manifest for a SOC agent (`MND-*`)	Chapter 13	Chapter 13
B.12	Oversight	Review protocol and oversight report	Chapter 14	Chapter 14
B.13	Security	Pre-production checklist for SOC AI	Chapter 15	Chapter 15
B.14	Sourcing	Provider annex for AI visibility	Chapter 16	Chapter 16
B.15	Roles	Role charter for blue team roles (`ROLE-*`)	Chapter 17	Chapter 17
B.16	Decisions	Decision-rights table	Chapter 18	Chapter 18
B.17	Regulation	Incident clock	Chapter 19	Chapter 19
B.18	Measurement	Board page for the blue team	Chapter 20	Chapter 20
B.19	People	Fatigue and on-call review	Chapter 21	Chapter 21
B.20	People	Competence record (`CMP-*`)	Chapter 22	Chapter 22
B.21	People	Craft programme	Chapter 23	Chapter 23
B.22	Outlook	Horizon register	Chapter 24	Chapter 24
B.23	Review	Anti-pattern checklist	Chapter 25	Chapter 25
B.24	Planning	Two-year plan	Chapter 27	Chapter 27

Template descriptions

B.1 Blue team function inventory

Purpose: Maps who performs each of B1 to B5 today, with which tools, and which parts already sit in automation.
When to use: At the start of the work, and each year.
Inputs: Job descriptions, tool inventory, rota, provider contracts.
Outputs: team/function-map.yaml, the starting point for a delegation profile.
Chapter: Chapter 2

B.2 Team charter and delegation profile (`DLG-*`)

Purpose: States the mandate, decision rights and the autonomy level per function and action class.
When to use: When a capability is procured, built, changed or reviewed; never with Level 4 for irreversible containment.
Inputs: Function inventory, reversibility of each action class, contracts.
Outputs: team/charter.yaml and a versioned profile in the delegation register.
Chapter: Chapter 4

B.3 Delegation register for the blue team

Purpose: Holds every delegation profile in one register, with reversibility tests, extending AI Threat, Chapter 26.
When to use: Continuously; reviewed at least annually.
Inputs: Delegation profiles, AIDRs, playbooks.
Outputs: A register with a pipeline check for ceilings and review dates.
Chapter: Chapter 4

B.4 Detection record (`DET-*`)

Purpose: Defines a detection with logic, sources, ATT&CK mapping, tests, owner and review date.
When to use: For every detection in production.
Inputs: Requirement, telemetry, test data.
Outputs: A versioned record with a passing test.
Chapter: Chapter 6

B.5 Closure policy

Purpose: Sets which alert classes AI may close, on what evidence, with what sampling.
When to use: Before any closure delegation.
Inputs: Alert classes, escape history, seeded incidents.
Outputs: triage/closure-policy.yaml.
Chapter: Chapter 7

B.6 Case record (`CASE-*`)

Purpose: Records the evidence, queries, reasoning and who or what reached each conclusion.
When to use: For every case that is closed.
Inputs: Evidence manifest, query log, AI-use log.
Outputs: A reproducible case record.
Chapter: Chapter 8

B.7 Hunt record (`HNT-*`)

Purpose: Records a hunt's hypothesis, data, queries, result and coverage statement.
When to use: For every hunt.
Inputs: Hypothesis, data sources.
Outputs: A record and a conversion target.
Chapter: Chapter 9

B.8 Playbook manifest (`PBK-*`)

Purpose: Codifies a response with trigger, corroboration, action class, approvals, rollback and stop path.
When to use: Before any action runs at Level 3.
Inputs: Action classes, policy points, stop path.
Outputs: A reviewed manifest enforced outside the model.
Chapter: Chapter 10

B.9 Post-incident review (`PIR-*`)

Purpose: Records findings, owners, changes and the re-test that closes each finding.
When to use: After every significant incident or exercise.
Inputs: Timeline, evidence pack.
Outputs: A review with findings linked to code changes.
Chapter: Chapter 11

B.10 Analyst AI-use policy

Purpose: Routes data classes to models and fixes what is logged.
When to use: When assistants are introduced.
Inputs: Classification scheme, model inventory.
Outputs: team/ai-use-policy.yaml.
Chapter: Chapter 12

B.11 Mandate manifest for a SOC agent (`MND-*`)

Purpose: Sets tasks, tools, data, levels, approvals, budget and expiry for an agent.
When to use: Before an agent runs and at each review.
Inputs: Permission manifest, policy point.
Outputs: A manifest with an expiry date.
Chapter: Chapter 13

B.12 Review protocol and oversight report

Purpose: Sets review tiers, seeded-incident rates and proposal caps, and reports oversight quality.
When to use: When AI output is reviewed at volume.
Inputs: Approval logs, seeded-incident results.
Outputs: reviews/protocol/soc-tiers.yaml and a quarterly report.
Chapter: Chapter 14

B.13 Pre-production checklist for SOC AI

Purpose: Ten questions on inputs, permissions, stop and exit for a new SOC AI capability.
When to use: Before go-live.
Inputs: Architecture, permissions, supplier evidence.
Outputs: A signed checklist.
Chapter: Chapter 15

B.14 Provider annex for AI visibility

Purpose: Makes a provider's AI visible: levels, actions, evidence, sampling, audit and notice of change.
When to use: When contracting or renewing managed detection and response.
Inputs: Contract, provider documentation.
Outputs: An annex to the contract.
Chapter: Chapter 16

B.15 Role charter for blue team roles (`ROLE-*`)

Purpose: States mandate, decision rights and ceilings for a role.
When to use: When a role is created or changed.
Inputs: Role map, incidents.
Outputs: roles/*.yaml.
Chapter: Chapter 17

B.16 Decision-rights table

Purpose: Names who may take each containment, disclosure and stop decision, within what time.
When to use: Before an incident, and after each tabletop.
Inputs: Incident scenarios.
Outputs: team/decision-rights.yaml.
Chapter: Chapter 18

B.17 Incident clock

Purpose: Lists reporting deadlines and owners from the moment of awareness.
When to use: In every incident and rehearsal.
Inputs: Obligations map.
Outputs: A generated timeline.
Chapter: Chapter 19

B.18 Board page for the blue team

Purpose: One page of speed, coverage, judgement and learning, with at most three decisions.
When to use: Each quarter.
Inputs: Records and measures.
Outputs: reporting/blue-team-page.yaml.
Chapter: Chapter 20

B.19 Fatigue and on-call review

Purpose: Five questions on load, on-call and review volume, with agreed responses.
When to use: Each quarter.
Inputs: Rota data, aggregate metrics.
Outputs: A recorded review.
Chapter: Chapter 21

B.20 Competence record (`CMP-*`)

Purpose: Records judgement exercised and the exercise that showed it.
When to use: After assessments.
Inputs: Exercise results.
Outputs: A competence record and learning path.
Chapter: Chapter 22

B.21 Craft programme

Purpose: Sets unassisted share, seeded incidents, rotation and degraded-mode drills.
When to use: Yearly.
Inputs: Skills data.
Outputs: A twelve-month plan.
Chapter: Chapter 23

B.22 Horizon register

Purpose: Lists trends labelled observable, expected or speculation with triggers.
When to use: Yearly.
Inputs: Trend evidence.
Outputs: HZN-* register.
Chapter: Chapter 24

B.23 Anti-pattern checklist

Purpose: Tests a team against the book's seven anti-patterns.
When to use: Yearly.
Inputs: Records.
Outputs: A checklist with remedies.
Chapter: Chapter 25

B.24 Two-year plan

Purpose: Turns the book's conclusions into six measures with owners and a review date.
When to use: When starting, and each year.
Inputs: Chapters 4 to 26.
Outputs: PLAN-* and an AIDR.
Chapter: Chapter 27

Repository tools

Tool	Purpose
`scripts/toc_definition.py`	Holds the table of contents and regenerates `book_index.json`, the MkDocs navigation and the chapter list in `BOOK_REQUIREMENTS.md`
`scripts/generate_outlines.py`	Regenerates the chapter briefs in `BOOK_BLUEPRINT.md` and outline files for chapters not yet written
`scripts/format_citations.py`	Derives citation labels from the bibliography
`scripts/renumber_sources.py`	Keeps the bibliography numbered 1..N without gaps or uncited entries
`scripts/check_mermaid_diagrams.py`	Renders and validates the diagrams