Runbooks are step-by-step recipes for common IT tasks. THEO ships with 176 pre-built runbooks covering the most frequent helpdesk and operations work. When a request comes in — through chat, voice, SMS, email, or a web form — THEO matches it to the right runbook and executes the steps for you. This article explains what runbooks are, how to find them, and how to request that THEO run one.
What a Runbook Is
A runbook is a deterministic, traceable sequence of steps. Unlike a freeform chat response, a runbook has a defined start state, defined steps, and a defined end state. Every step is logged, every decision is recorded, and every external action — ticket creation, email send, device action — gets a tamper-evident audit entry.
Runbooks are organized into eight categories: identity and access, endpoints, email, backups, network, security, onboarding/offboarding, and PSA/RMM ops. Examples include password resets, phishing investigations, backup verification, device provisioning, and ticket stitching.
Browsing the Runbook Catalog
The full runbook catalog is available in the platform. To browse it:
- In the Hub, go to RMM → Automation → Agentic Automation → Runbooks (
/rmm/automation-hub/runbooks). This is not the same page as RMM's own Runbooks builder at/rmm/runbooks. - Use the category filters on the left to narrow by type
- Search by keyword to find a specific runbook
- Click any runbook to see its steps, inputs, outputs, and execution history
Each runbook shows its current mode (Watch, Suggest, Assist, or Autopilot) and the last time it was run.
Requesting Runbook Execution from Chat
You do not need to navigate to the runbook catalog to trigger a runbook. THEO matches your plain-language request to the right runbook automatically.
Examples:
- "Reset the password for jane@acme.com and text her the new temp password."
- "Provision a new hire — Sarah Chen, starts Monday, Contoso, standard M365 license."
- "Investigate the suspicious sign-in for admin@northwind.com from 20 minutes ago."
THEO identifies the best matching runbook, asks any clarifying questions needed, confirms the action if your mode requires approval, and then runs it.
Execution Modes
Every runbook runs in one of four modes. The mode determines whether THEO acts immediately or waits for human approval:
- Watch — THEO logs what it would have done but does nothing
- Suggest — THEO drafts the work and queues it for you to approve
- Assist — THEO runs the runbook if its confidence is at or above your threshold (default 95%)
- Autopilot — THEO runs end-to-end if confidence is sufficient
The mode is set globally and can be tightened per-category, per-runbook, or per-client. It cannot be loosened past the global setting.
Viewing Runbook Execution History
After THEO runs a runbook, you can see the full trace:
- Go to Command Center → Traces
- Find the execution by date, client, or runbook name
- Click the trace to see each step, inputs and outputs, policy checks, tools called, credits spent, and the audit entry
If a step failed or produced a wrong result, you can rate it from the step detail page. An incorrect rating starts the learning pipeline — THEO proposes a fix to the runbook, which goes into a queue for you to approve.
Forking and Customizing Runbooks
You can fork any of the 176 pre-built runbooks to customize them for your org. Forks are saved as your own runbook variants and do not affect the original. You can also A/B test two variants of the same runbook to compare outcomes before committing to one.
FAQ
What happens if THEO picks the wrong runbook?
Before executing in Assist or Autopilot mode, THEO confirms which runbook it intends to run and what inputs it will use. You can redirect it to a different runbook or stop the execution.
Can I roll back a runbook that already ran?
For individual steps, yes — each step records its pre-state and reversal information. For completed external actions (emails sent, tickets created), you will need to undo in the target system, but the full audit trail tells you exactly what was done.
What is a THEO Automation Credit (TAC) and how do runbooks use them?
TAC is how automation usage is metered. Running one runbook step costs 2 credits. Classifying the initial intent costs 1 credit. Credits reset monthly and are visible under Billing → Usage.