A transit authority splits SOAR playbooks into enrichment-only and containment modules for reuse. What design approach is that?

A transit authority that splits SOAR playbooks into enrichment-only and containment modules for reuse is applying modular playbook design. Enrichment modules gather host, user, intel, and ticket context; containment modules isolate, block, or reset. Separating them lets many alert types share tested enrichment while invoking containment only when policy and confidence allow. Modularity reduces copy-paste drift across bus, rail, and corporate alert paths and makes partial runs possible when containment is not yet authorized. Why the other options fail by concept: Using modular SOAR playbook design so enrichment and containment use one shared block merges both functions into a single block rather than splitting them into independently reusable modules, so enrichment cannot run alone and containment cannot be gated separately for policy or confidence. Using modular SOAR playbook design so enrichment feeds containment via static mapping describes a fixed data handoff into containment instead of separate enrichment-only and containment modules that can be reused independently across alert types. Using modular SOAR playbook design so enrichment and containment link via ticket tags makes ticket tags the coupling mechanism rather than keeping enrichment-only and containment as independently reusable automated modules. Exam caveat: Modules still need clear interfaces, versioning, and contract tests; poor module boundaries can recreate monoliths as tangled dependency graphs. Operational check: publish enrichment and containment modules with owners, reuse them from alert-specific wrappers, and test enrichment alone before enabling containment calls in production transit playbooks.