skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

rai-planner

Guides responsible AI assessments through phased capture, risk classification, impact analysis, and backlog handoff.

1.4k|284|Updated Nov 2, 2025
Search Tags:#Threat Modeling#backlog generation#responsible ai#Governance#Risk Assessment#Compliance#rai planner
One-click install
npx skills add https://github.com/microsoft/hve-core --skill rai-planner
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: rai-planner
Source: https://github.com/microsoft/hve-core/tree/main/.github/skills/project-planning/rai-planner
Command: npx skills add https://github.com/microsoft/hve-core --skill rai-planner

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Conducting a Responsible AI (RAI) assessment requires structured guidance across many phases, and teams often lack a consistent method for scoping systems, classifying risks, documenting controls, and producing actionable backlog items.

Core Features & Use Cases

  • Phased Reference Pack: Loads phase-specific guidance on demand for capture and scoping (Phase 1), risk classification (Phase 2), security modeling (Phase 4), impact assessment (Phase 5), and review and backlog handoff (Phase 6).
  • Risk Classification Logic: Applies a prohibited-uses gate, indicator assessment, and depth-tier assignment (basic, standard, comprehensive) to size the assessment.
  • Evidence and Backlog Generation: Builds evidence registers, tradeoff logs, control surface catalogs, and dual-format ADO/GitHub backlog handoff files with optional artifact signing via SHA-256 manifests.
  • Use Case: A team launching a new AI feature uses this skill to interview stakeholders, classify risk indicators, document controls and threats with dual threat-ID conventions, and produce a consolidated rai-plan.md plus ready-to-review backlog items.

Quick Start

Ask the agent to start a new RAI assessment for your AI system and follow the phased capture, risk classification, and impact assessment workflow.

Frequently Asked Questions about rai-planner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a responsible AI assessment for a new AI system?▼

Start in capture mode to document the system purpose, data flows, stakeholders, and out-of-scope uses. Then proceed through risk classification, standards mapping, threat analysis, and impact assessment phases, ending with a review rubric and backlog handoff.

How does RAI risk classification determine assessment depth?▼

Risk classification first runs a prohibited-uses gate, then evaluates indicators such as safety reliability, rights and fairness, and security explainability. The activated indicator count sets the depth tier: zero is basic, one is standard, and two or more is comprehensive.

What artifacts does a RAI assessment produce?▼

The assessment produces a consolidated rai-plan.md with sections for system definition, stakeholder impact, standards mapping, threat addendum, control surface catalog, evidence register, tradeoffs, and review summary. It can also generate ADO and GitHub backlog handoff files plus a signed artifact manifest.

Can I generate Azure DevOps or GitHub backlog items from a RAI assessment?▼

Yes, Phase 6 generates backlog items in both ADO and GitHub formats from the evidence register and maturity observations. It delegates template details to a shared backlog-templates skill and supports artifact signing with npm run rai:sign.

When should the AI STRIDE overlay be used in threat modeling?▼

Apply the AI STRIDE overlay during Phase 4 as an extension of standard security threat modeling, covering training, inference, monitoring, and feedback paths. If the rai-standards skill is unavailable, continue with standard software threat modeling instead.

Related Skills

Explore More Legal & Compliance Skills→
BaGyun0107BaGyun0107

plan-eng-review

Evaluate system architecture, data flow, and edge cases before coding.

Community
Advanced
mkrlabsmkrlabs

backlog

Manage Specflow backlog on GitHub Project #4 via CLI scripts.

Official
Intermediate
NorkzYTNorkzYT
2

stride-analysis-patterns

Categorize threats using the STRIDE framework and generate mitigation recommendations.

Community
Basic
pauljbernardpauljbernard
5

Regulatory and Compliance Fluency

Cite specific regulatory frameworks, accounting standards, and legal codes.

Community
Advanced