OIA Engagement Playbook

Purpose

This recipe executes a full Organizational Immune System Audit engagement from initial scoping through monitoring retainer setup. It produces a composite health score report covering network topology, autoimmune patterns, and resilience gaps — plus a deployed monitoring architecture (WBC agents) that provides ongoing organizational health signals. [src1, src4]

Prerequisites

• Executive sponsor identified with authority across all in-scope departments
• IT system inventory — list of communication platforms (Slack, email, Jira, Git, calendar, HRIS)
• Org chart available from HR with reporting lines and department boundaries
• Legal/privacy sign-off — data processing agreement drafted for metadata access
• Slack Admin or Microsoft Graph credentials — admin-level API access confirmed

Constraints

• GDPR: use communication metadata only (timestamps, sender/receiver pairs, channel names) — never message content without explicit consent. [src4]
• Data access requires legal sign-off before any system integration begins.
• Client must designate a single executive sponsor with cross-departmental authority.
• Minimum engagement duration: 3 weeks. Shorter timelines produce unreliable health scores. [src1]
• Monitoring retainer requires ambient data feed (Slack or email integration).

Tool Selection Decision

Which path?
├── Client has Microsoft 365 enterprise
│   └── PATH A: Viva Insights — automated ONA, built-in dashboards
├── Client has Slack Enterprise + any email
│   └── PATH B: Slack Export + Custom Python — full control, lower cost
├── Client has mixed/smaller platforms
│   └── PATH C: API Integration + NetworkX — flexible, requires developer
└── Client has no API access (privacy-restricted)
    └── PATH D: Survey-Only — limited but compliant

Execution Flow

Step 1: Scoping Call

Duration: 1 hour · Tool: Video call + structured intake form

Conduct initial scoping call with executive sponsor and key stakeholders. Define engagement scope, specific concerns, timeline, and success criteria.

Verify: Signed scope document with departments, timeline, and budget confirmed. · If failed: Reschedule within 3 business days.

Step 2: Data Access Negotiation

Duration: 2-5 days · Tool: Legal/IT coordination

Negotiate access to communication metadata across all platforms. Draft data processing agreement specifying metadata-only scope, anonymization protocol, and data retention period.

Verify: All data feeds confirmed — admin credentials or export schedules in place. · If failed: Escalate to executive sponsor.

Step 3: Network Mapping

Duration: 3-5 days · Tool: Microsoft Viva Insights or Python NetworkX

Execute organizational network analysis from communication metadata. Build directed weighted graph, calculate centrality measures, overlay formal org chart. [src2, src4]

Verify: Network topology validated with client — top 10 bottlenecks identified. · If failed: Expand data sources or extend collection period.

Step 4: Autoimmune Scan

Duration: 3-5 days · Tool: Log analysis + survey + structured interviews

Detect compliance bypass patterns, shadow workarounds, and security fatigue indicators. Classify each friction point as protective or paralyzing. [src1]

Verify: Pattern severity scored — each autoimmune pattern classified. · If failed: Extend survey window, add interview slots.

Step 5: Resilience Assessment

Duration: 2-3 days · Tool: Network centrality analysis + stress test scenarios

Identify SPOFs, hero dependencies, and recovery capacity gaps. Design and execute tabletop stress test scenarios. [src2]

Verify: Stress test scenarios completed, resilience score calculated. · If failed: Run async scenario assessment.

Step 6: WBC Architecture Design

Duration: 3-5 days · Tool: Architecture specification document

Design White Blood Cell monitoring architecture: monitoring signals, alert thresholds, escalation paths, integration points.

Verify: Client reviews and approves monitoring scope. · If failed: Narrow to top 5 signals initially.

Step 7: Report Delivery

Duration: 1-2 days · Tool: Presentation + structured report

Produce and present OIA Health Score Report: composite health score, network topology visualization, autoimmune pattern inventory, resilience gap analysis, prioritized remediation roadmap.

Verify: Client acceptance of findings. · If failed: Offer to re-run specific analyses.

Step 8: Monitoring Retainer Setup

Duration: 2-3 days · Tool: Slack/email integration + monitoring dashboard

Deploy initial WBC monitoring agents. Configure baseline metrics, set alert thresholds, establish monthly reporting cadence. [src3]

Verify: Agents operational — first test alerts triggered and verified. · If failed: Fall back to manual monthly check-in.

Output Schema

{
  "output_type": "oia_health_report",
  "format": "PDF + JSON",
  "sections": [
    {"name": "health_score", "type": "number", "description": "Composite 0-100 organizational health score"},
    {"name": "network_topology", "type": "object", "description": "Graph data with centrality scores per node"},
    {"name": "autoimmune_patterns", "type": "array", "description": "Bypass/workaround patterns with severity"},
    {"name": "resilience_gaps", "type": "array", "description": "SPOFs, hero dependencies, recovery gaps"},
    {"name": "remediation_roadmap", "type": "array", "description": "Prioritized actions"},
    {"name": "wbc_architecture", "type": "object", "description": "Monitoring agent specification"}
  ]
}

Quality Benchmarks

If below minimum: Extend engagement by 1 week, add additional data sources, or narrow scope.

Error Handling

Cost Breakdown

Anti-Patterns

Wrong: Skipping data access negotiation

Jumping straight into network mapping without proper legal sign-off. Result: engagement halted when legal discovers unauthorized data access. [src1]

Correct: Front-load legal and data access

Spend 2-5 days upfront negotiating data access with legal and IT. This prevents mid-engagement stalls.

Wrong: Presenting findings without validation

Delivering the OIA report without first validating key findings. Result: false positives destroy client confidence. [src2]

Correct: Validate findings before formal delivery

Share preliminary findings with 2-3 client stakeholders before the formal report.

Wrong: Over-scoping the monitoring retainer

Setting up WBC monitoring for every possible signal. Result: alert fatigue within 30 days. [src3]

Correct: Start narrow, expand based on value

Begin with top 5 signals only. Calibrate thresholds during first 30 days. Expand after demonstrating value.

When This Matters

Use when an agent needs to plan or execute a full OIA consulting engagement. This is the master recipe — it orchestrates sub-recipes for data collection, network analysis, autoimmune scanning, and stress testing into a cohesive engagement lifecycle.