Gamebook

Expanded Definition

A Gamebook is a governed investigation procedure that gives an AI agent bounded discretion: the agent can adapt questions, evidence gathering, and branching actions while still preserving a fixed security objective, approval threshold, and audit trail. In NHI security, that makes Gamebooks different from static playbooks, which prescribe a single sequence, and from ad hoc agent prompts, which often lack reviewability and control.

Definitions vary across vendors, but the practical meaning in security operations is consistent: a Gamebook specifies intent, required evidence, decision points, and allowed escalation paths so an autonomous workflow can respond to context without drifting outside policy. This aligns with the intent of the NIST Cybersecurity Framework 2.0, where repeatable governance and risk handling matter as much as detection itself. NHIMG treats Gamebooks as a control layer for agentic execution, not just a documentation format. The most common misapplication is using a Gamebook as a loose prompt template, which occurs when teams omit evidence requirements and escalation limits.

Examples and Use Cases

Implementing Gamebooks rigorously often introduces coordination overhead, requiring organisations to balance agent flexibility against stricter review and evidence collection.

• An NHI incident Gamebook lets an agent investigate a suspicious API key leak, collect logs, identify blast radius, and pause for human approval before revocation.
• A secrets exposure Gamebook can guide an AI agent to confirm whether a token is in source control, CI/CD logs, or a vault misconfiguration, then route the case to the right owner.
• A service account anomaly Gamebook can permit the agent to compare current usage against baseline behavior, but only within preapproved data sources and alert thresholds.
• An onboarding Gamebook can help an agent validate that a new machine identity has the required ownership, rotation policy, and least-privilege scope before deployment.

These workflows become more effective when grounded in NHI-specific evidence patterns documented by NHI Management Group, including the Ultimate Guide to NHIs. For broader incident structure and response logic, teams can also map the procedure to the NIST Cybersecurity Framework 2.0. Gamebooks are especially useful where the same category of investigation repeats, but the evidence path changes based on environment, owner, or identity type.

Why It Matters in NHI Security

Gamebooks matter because NHI incidents rarely resolve cleanly with one fixed sequence. A service account may be overprivileged, a secret may be leaked in code, or an API key may still be active long after notification. In those situations, the value is not only faster response, but consistent decision-making across many possible branches. NHIMG research shows that 79% of organisations have experienced secrets leaks, while 91.6% of secrets remain valid five days after notification, which is a strong indicator that investigation procedures must be both adaptive and governed. The Ultimate Guide to NHIs also shows that 97% of NHIs carry excessive privileges, which means a Gamebook often has to account for privilege reduction, evidence preservation, and owner notification in one sequence.

Used well, a Gamebook keeps agentic actions explainable without forcing every response into a rigid script. It supports auditability, reduces improvisation risk, and makes escalation conditions explicit enough for security review and compliance checks. Organisations typically encounter the need for a Gamebook only after a leak, privilege abuse, or failed revocation attempt, at which point controlled investigation becomes operationally unavoidable to address.