Mobile Task Forces: Structure, Protocols, and What Actually Happens in the Field
If you've been digging through the Foundation's internal documentation or trying to build a realistic MTF scenario for your own project, you've probably noticed that the public-facing wiki and the deeper internal docs describe the same units differently. That's by design. The Foundation maintains compartmentalized documentation layers for a reason, and understanding how those layers connect is where most people get stuck. Let me cut to the practical part. MTF units are organized by Greek letter prefixes followed by a number and an Omega--Level Clearance designation. The common ones you'll encounter—Euclid, Keter, Thaumiel—are well documented. What's less obvious is the classification hierarchy that determines which units get deployed against which threats, and the protocol tiering system that dictates response speed. The standard deployment protocol operates on a four-tier system: Immediate Response (within 30 minutes for confirmed breaches), Standard Deployment (2-4 hours for suspected anomalous activity), Extended Overwatch (active monitoring with no immediate engagement), and Static Containment (long-term facility-based operations). Each tier has different resource allocation, authorization requirements, and communication privileges.
I spent considerable time cross-referencing field reports with official protocol documents, and one thing became clear pretty quickly. The documented procedures rarely match what actually happens once a team crosses a facility threshold. Protocol 7-Gamma, for example, specifies a controlled perimeter establishment procedure that requires two separate authorization codes from distinct command nodes. In practice, when an MTF Prime unit enters a live containment breach, they establish perimeter control using a simplified single-keycode override that's been silently approved for emergency use since the late nineties. The official documents were never updated to reflect this because it creates a liability gap if anyone outside clearance level five reads them. Here's a specific case where I hit a wall. I was reconstructing the deployment chain for an Epsilon-11 field operation and found a discrepancy between the stated protocol requirements and the actual authorization chain in the mission logs. The protocol document required three separate clearance confirmations before deploy status could be activated. The mission logs showed only two. When I tracked down the actual field manual supplement—a document that wasn't indexed in the main database—I found a footnote referencing a revised protocol addendum that permitted two-confirm deployment under "Category-4 environmental risk." The footnote itself was annotated with a classification marker that had been partially redacted, making it nearly impossible to verify through normal search. The workaround I ended up using was to cross-reference the redacted annotation text with known classification patterns from other leaked documents. Once I identified the classification tier as Level-3-Sigma, I knew exactly which supplementary index to pull from, and the full protocol addendum became readable. This isn't a technique you'd find in any general guide. It requires familiarity with the Foundation's own internal indexing system, which operates on a completely different taxonomy than the public wiki.
Let's talk about containment protocol mechanics themselves. The specialized protocols assigned to MTF units cover far more than simple lock-and-key security. You're looking at reality anchors, memetic inhibitors, cognitohazard filters, and various forms of localized spacetime stabilization depending on the threat profile. Most people focus on the flashy stuff—the Euclid-class containment rigs and the Keter-grade suppression fields. What actually matters more in the field is the administrative protocol layer. Paperwork, communication encryption, evidence chain documentation, and post-incident reporting procedures determine whether an operation succeeds legally within Foundation oversight or triggers an internal audit that can shut down an entire unit's funding for months. The documentation you'll find on the general wiki is accurate for a surface-level understanding. It describes what the units do, their general mission profiles, and the broad categories of threats they handle. It does not describe the operational friction—how coordination between multiple MTF units gets handled when they respond to the same incident, what happens when protocol conflicts arise between different command chains, or how containment procedures adapt when a breach involves multiple entity classes simultaneously. One counter-intuitive point that many newcomers miss: Keter-class designation doesn't automatically mean higher deployment priority. In practice, Euclid-class entities often trigger faster MTF mobilization because their containment procedures are more predictable and the Foundation can allocate resources with greater confidence. Keter-class breaches tend to involve slower, more methodical responses because the unknown variables require additional authorization layers and wider command consultation before deployment is approved. The urgency you'd expect from a Keter threat is frequently offset by the procedural caution required when facing something whose behavior patterns are poorly understood.
Get the Full Details
Another nuance worth noting involves the relationship between MTF units and facility-based security. The Foundation maintains a clear theoretical separation between mobile deployment teams and stationary containment personnel, but field operations routinely require coordination between the two. When an MTF unit arrives at a facility for a breach response, they operate under a joint command structure that isn't well documented. The Mobile Task Force commander takes operational authority, but facility personnel retain control over internal systems, lockdown procedures, and entity-specific containment mechanisms. This division of authority has caused at least three documented incidents where miscommunication between mobile and facility command led to compromised containment sequences. The incidents were internally resolved and removed from public documentation, but the procedural gaps remain largely unaddressed. For anyone building scenario content or trying to understand the practical mechanics of these protocols, I'd recommend starting with the documented MTF unit profiles and then working outward into the protocol tier system. Don't treat the wiki as a complete reference. The gaps in the documentation are where the actual operational complexity lives, and filling those gaps requires examining how different protocol layers interact rather than just memorizing individual unit descriptions. The specialized containment protocols also vary significantly between thematic branches. An MTF focused on antimemetic threats operates under a completely different procedural framework than one handling physical containment breaches. The overlap between these frameworks is minimal, and units that specialize in crossover scenarios are rare enough that their existence is mostly discussed in internal briefings rather than formal documentation. If you're working on a project that involves multiple threat types in a single scenario, make sure your protocol assignments reflect that specialization gap rather than assuming all MTF units operate under the same procedural standards.
There's also the question of post-containment protocol, which receives almost no attention in public discussions. Once an MTF unit secures an anomalous entity or stabilizes a breach, the follow-up procedures are where most operational failures occur. Evidence documentation, entity transfer protocols, witness amnesticization, and facility damage assessment all require coordinated execution across multiple command levels. Rushing through any of these steps can compromise the containment chain or create exposure risks that trigger secondary breaches. The Foundation has internal checklists for this, but the checklists are lengthy and deliberately redundant, which means field teams often develop shortcuts that aren't officially recognized. I encountered this directly while mapping out a multi-phase containment scenario. The official procedure called for a thirty-minute observation period before entity transfer could begin. In my reconstruction, I found that several documented field operations completed this observation window in under eight minutes without compromising containment integrity. The discrepancy came down to environmental stability indicators that weren't included in the base protocol but were referenced in supplemental field guides. Without access to those supplemental documents, anyone following the public protocol would build in unnecessary delays that could complicate time-sensitive operations. The lesson here isn't that the protocols are wrong. It's that the publicly available documentation represents a baseline that assumes worst-case resource conditions and maximum procedural caution. Real field operations often operate under different constraints, and understanding how to bridge the gap between documented procedure and practical execution requires a level of familiarity that goes beyond what any single reference source provides.
If you're approaching this from a creative or analytical perspective, the most useful path is to treat the Foundation's documentation as an incomplete record rather than a complete system. The omissions, the redactions, the procedural gaps—they're not accidents. They're features of an organization that operates across multiple clearance levels with competing institutional interests. The truth about specialized containment protocols isn't hidden in a single document. It's distributed across layers of documentation that were never intended to be read as a complete whole.
