A transit authority defines policy-as-code as preventive guardrails, not as IR playbooks. What terminology clarity is that?

A transit authority that defines policy-as-code as preventive guardrails, not as IR playbooks, is clarifying terminology so preventive automation and response automation stay distinct. Policy-as-code encodes deployment and configuration constraints—what may be built or changed—before incidents. IR playbooks and response automation encode what to do after detection. Mixing the labels causes grant writers, engineers, and SOC staff to buy or build the wrong controls for the wrong moment in the civic risk lifecycle.

Why the other options fail by concept: Clarifying that policy-as-code sets preventive guardrails while threat intelligence handles IR playbooks misattributes execution; threat intelligence supplies indicators and context for detection, while response automation handles IR playbooks. Clarifying that policy-as-code sets preventive guardrails while vulnerability scanning handles IR playbooks confuses assessment with response; vulnerability scanning finds weaknesses before exploitation, while response automation handles IR playbooks after detection. Clarifying that policy-as-code sets preventive guardrails while audit logging handles IR playbooks confuses record-keeping with response; audit logging preserves events for review, while response automation handles IR playbooks.

Exam caveat: Some platforms blur policy evaluation and response hooks; civic documentation should still separate intent—prevent bad states versus react to incidents—even when one vendor console hosts both. Operational check: update the transit automation glossary with explicit definitions, label existing controls as preventive policy-as-code or IR response automation, and reject designs that hide containment inside unlabeled "policy" jobs.