A public-health clinic SOC has one person working the notable queue and also building SOAR playbooks. How should the playbook-build work be classified?

When a public-health clinic SOC has one person both working the notable queue and building SOAR playbooks, the playbook-build work is still Engineer-side automation, not core Analyst triage. Small civic clinics often combine hats on one headcount, but the blueprint still classifies the work by function: closing notables is Analyst operational work; designing playbooks is engineering automation that supports analysts. Correct classification keeps training, change control, and audit language honest.

Calling playbook build core Analyst triage because the same person closes notables fails by concept: shared staffing does not merge distinct job functions. Calling it Architect program design fails by concept: a playbook implementation is not a three-year coverage strategy even though automation supports maturity. Calling it Incident Review administration fails by concept: playbooks may integrate with ES workflows, but building automation is not the same as administering the Incident Review screen.

Exam caveat: Role classification follows the nature of the task, not the badge of the only available person in a small municipal SOC.

Operational check: Track playbook changes under engineering change control with test and promotion steps, while queue dispositions remain Analyst workflow metrics, even when one clinic employee performs both during the week.