Not at all. The "an authorized S3 team member using an established playbook..." is to establish that: 1. They were authorized to be doing it. 2. They were foll

Not at all. The "an authorized S3 team member using an established playbook..." is to establish that: 1. They were authorized to be doing it. 2. They were following an established process, and not winging it. The reason for that wording is to illustrate that operational changes are made in accordance with established CM. Mistakes happen. The system didn't catch the error. That's why the mitigation is "fix the system", and not "fire the team member". =)