Tenant-specific playbooks the orchestrator tries before the built-in registry. A custom playbook describes match rules (title / category / framework / MITRE / resource attributes), the evidence gatherers to run, and a prompt addendum the LLM gets when this playbook fires. Author a starter spec below.
Server-validated by Zod. Invalid specs are rejected with a clear error. The built-in registry is always tried after yours, so the worst case is "no custom rule matched."
Ordered by priority asc. 0 enabled · 0 disabled.
Author one above. Until you do, the orchestrator uses only the built-in registry.