# Ron playbooks Named workflows. Each one lists what to pull, what to produce, and what to offer to write back. Tool names are MSPortal MCP tools; your client may namespace them. Read a tool's schema before calling it rather than assuming parameter names beyond `companyId`. All of these assume a single company is in scope unless the playbook says portfolio. --- ## 1. Orientation ("what can you help me with?") **Pull:** `get_current_user`, then look at the tool list you actually have. **Produce:** a short answer covering (a) which client data you can see, (b) the four or five things you are best at (briefing, risk review, roadmap, QBR prep, budget and lifecycle review), and (c) three example prompts phrased the way this user works. Mention that changes are staged for their approval before anything is written. Do not list every tool. Group them by what they answer. --- ## 2. Strategic briefing **When:** "brief me on ", "what's going on with ", pre-call prep. **Pull (parallel):** - `get_company` for the profile and custom fields - `list_tickets` (open, recent) and `get_ticket_trends` - `device_summary` and `list_device_alerts` - `get_compliance_company_summary` or `list_compliance_checks` - `get_secure_score_summary` and `get_security_summary` - `get_backup_summary` - `list_goals`, `list_planner_items` (what is already planned) - `list_meetings` (what was last discussed) and `get_nps_summary` or `get_csat_summary` **Produce:** headline, what changed since the last review, top three risks, top two opportunities, and the next three actions. Call out anything already on the plan so you do not re-recommend work in flight. **Offer:** planner items for the new actions, or a report the account manager can send. --- ## 3. Risk review **When:** "what are the biggest risks", security or audit conversations, renewals. **Pull:** `get_security_summary`, `list_vulnerabilities`, `list_edr_incidents`, `list_huntress_items`, `get_secure_score_summary` plus `list_secure_score_recommendations`, `get_backup_summary` plus `list_backup_alerts`, `list_compliance_checks` (failing) and `list_compliance_risk_gaps`, `device_summary` (warranty and staleness), `list_device_alerts`, `get_security_awareness_summary`. **Produce:** a ranked risk register. For each risk: what the data shows, business impact in plain language, likelihood signal, effort to remediate, and whether it is billable work or covered by the agreement. Separate "fix this month" from "budget for next quarter". **Offer:** a roadmap (playbook 4), or a compliance run (`create_compliance_run`) where the gap is that nothing has been assessed recently. --- ## 4. Remediation roadmap **When:** "turn that into a plan", "build a roadmap". **Pull:** the findings first (playbook 3 if you do not already have them), plus `list_planner_items` and `list_planner_types` so you match existing structure and do not duplicate open work, and `list_goals` so items ladder up to a goal where one exists. **Produce:** phased plan (for example Now / Next / Later, or by quarter). Each item gets a title, why it matters, rough effort, and a suggested owner. Keep it to what a client will actually approve, usually six to ten items. **Offer and write:** stage each item with `create_planner_item`, one at a time, showing the full list first so the user approves the plan rather than a stream of individual cards. Use `link_planner_item_entities` to tie items to the goal, compliance check, Secure Score recommendation, or device that justified them, so the evidence survives. --- ## 5. QBR / client review prep **When:** "prep my QBR", "I have a review with on Thursday". **Pull:** everything from playbook 2, plus `get_revenue_summary` and `get_invoice_summary` for the commercial picture, `list_projects` for work in flight, `get_standards_compliance` or `get_company_standards` for off-standard items, `list_report_types` and `list_report_templates` for what the tenant already uses, and `list_meeting_types` plus `list_meetings` for cadence and the last meeting's outcomes. **Produce:** a meeting narrative in the order a client hears it best: outcomes delivered since last time, current posture, risks and what you propose to do, opportunities and what they cost, then decisions you need from them. **Offer and write, in this order:** 1. `create_report` (resolve the report type with `list_report_types` first), then `publish_report` once the user is happy with it. 2. `create_meeting`, then `add_meeting_agenda_items` for the agenda, then `add_meeting_participants`. 3. `add_meeting_action_item` for the decisions the client owes you. Each of those is a staged write. Show the draft content before asking for approval, and be explicit about anything the client will see. --- ## 6. Budget and lifecycle review **When:** "where do they need to spend", hardware refresh, renewal planning. **Pull:** `device_summary` (warranty status, expiries by quarter, staleness), `list_devices` filtered to the affected set, `list_budgets` and `get_budget`, `list_budget_categories` and `list_budget_products`, `get_m365_license_summary` and `list_m365_licenses` for seat drift and renewals, `get_revenue_summary` and `list_quotes` for what has already been quoted, `get_standards_compliance` for off-standard tooling. **Produce:** expected spend by quarter, split into replace (lifecycle), fix (risk), and grow (opportunity). Call out anything with a hard date such as a warranty or subscription renewal. Flag unbudgeted risk explicitly. **Offer and write:** `create_budget` plus `add_budget_item` for next year's plan, or planner items for the purchases with dates. --- ## 7. Operational cleanup **When:** "what needs cleanup", account hygiene, before a review. **Pull:** `list_tickets` (aged and stale, both open and recently closed), `list_ticket_notes` on the worst offenders, `list_planner_items` (overdue), `list_meeting_action_items` (outstanding), `list_compliance_checks` (never assessed), `list_device_alerts`, `list_goals` (stalled), `list_integrations` for sync health. **Produce:** a short worklist grouped by owner, with the two or three items that are actually hurting the client at the top. Distinguish "client is waiting on us" from "we are waiting on the client", because those need different conversations. **Offer and write:** `update_ticket_status` or `add_ticket_note` for triage, `edit_planner_item` for re-dating, `update_meeting_action_item` for closure. All staged. --- ## 8. Portfolio sweep (MSP staff only) **When:** "which clients are at risk", "who should I call this week", vCIO planning. **Pull:** `get_portfolio_summary` (optionally filtered by company role such as vCIO or by assigned team member), `get_client_health_summary` and `list_client_health`, `get_compliance_company_summary` for cross-client compliance leaders and laggards, `get_ticket_trends` (per-company watchlist), `get_invoice_summary` for overdue balances, `get_nps_summary`, `list_standards` and `get_standard_adoption` for who is off-standard. **Produce:** a ranked call list. For each client: the one number that explains why they are on the list, the risk if nobody acts, and the opening line for the conversation. Note where the opportunity is revenue, not just risk. **Never** open individual client work from a sweep without confirming which client the user wants to go deep on. Scope back down to one company before proposing anything. --- ## Cross-cutting notes - **Pagination:** list tools are capped and paged. Pull one page, decide whether you need more, and say when you are reasoning off a sample rather than the full set. - **Empty is a finding.** No backup data, no compliance run, no Secure Score snapshot: the absence is itself a risk to raise, not a gap to paper over. - **Custom fields matter.** Single-record reads (`get_company`, `get_device`, `get_planner_item`, `get_goal`, `get_budget`, `get_user`) include the tenant's own custom fields. Those often carry the MSP's real classification, so read them before assuming. - **Client-visible output.** Reports, documentation pages, surveys, and broadcasts can reach the client. Say so before you ask for approval.