Playbooks and recovery plans
Glassbreak Team · Published 2026-07-19
When an incident hits, the team that wins is the one that doesn't have to improvise. Glassbreak lets you author two kinds of runnable document — playbooks (branching, flowchart-style crisis runbooks) and recovery plans (phase-oriented restoration procedures) — and then execute them as tracked runs, with every step acknowledged, timestamped, and attributed.
Playbooks and recovery plans are available on the Team plan and above.
Author a document
- Go to Emergency → Playbooks (or Recovery plans) and create a new document. It starts as a draft.
- Build the flow on the canvas editor. Playbooks use start, step, decision, and end nodes connected by edges — a decision node's outgoing edges become the choices presented during a run. Recovery plans use phases containing steps.
- Give each step a title, description, an owning role (who should do it), and a time estimate. Drag nodes to lay the chart out; positions are saved.
- Where a step needs a credential, link a secret from your team vault directly to that node — responders can open a decryption request right where they need it, instead of hunting for "the doc with the password".
- You can also cross-link related documents (a playbook step that hands off to a recovery plan, say).
- When it's ready, publish. Only published documents can be run.
Run a document
A run is one execution of a document — during a real incident, or as practice:
- Open the published document and choose Start run. Playbooks are typically run as incidents; recovery plans can be started as a drill or tabletop practice run too.
- Work through the graph. For each step, add notes and record the outcome: Complete, Skip, or Fail. At a decision node, pick the branch you're taking.
- The run screen shows elapsed time, a completed/total step counter, and any emergency messages linked to the document, and it refreshes automatically so a distributed team sees the same state.
- Finish the run by marking it completed — with a result of pass, fail, or partial and a summary — or aborted.
Every step records who completed it and when, so the run doubles as an incident timeline you can review afterwards (and hand to an auditor).
Practical authoring advice
Keep steps small enough that "Complete" is unambiguous. Put the decision points early — the expensive mistakes in a crisis are usually branching mistakes, not execution mistakes. And run the document as a drill before you trust it: unclear steps reveal themselves in minutes when someone else tries to follow them.