Project Manager
Risk, status, stakeholders.
The Project Manager is the persona accountable for predictable delivery across teams and for honest stakeholder communication. In an AI-native SDLC, the Project Manager operates a risk and status loop, not a status-meeting calendar.
Executive summary
The Project Manager converts a portfolio of commitments into a single, honest picture of progress, risk, and stakeholder expectations. In an AI-native SDLC, the Project Manager works inside the Delivery phase with a fixed set of primitives: one risk-scout agent, four slash prompts, scoped instructions, schema-validated hooks, and a curated list of validated MCPs. The primary outputs are status reports, a live risk register in Azure DevOps, stakeholder maps, and RAID logs that drive decisions instead of decorating meetings.
Role and responsibilities
Think of the Project Manager like the air-traffic controller at a busy airport. Planes take off and land under their own power, but every takeoff and landing is sequenced, spaced, and reported to the tower. The Project Manager is that tower. In an AI-native SDLC the code and architecture are owned by other personas; the Project Manager owns the sequencing, the slot, and the radio discipline.
Primary responsibilities:
- Maintain the risk register in Azure DevOps with every risk scored, owned, and dated
- Produce weekly status reports that reconcile GitHub Projects, Azure Boards, and incident data
- Run the stakeholder communication cadence through Microsoft Teams and the M365 Agents SDK
- Keep the RAID log current (Risks, Assumptions, Issues, Dependencies) and link every item to a work item
- Facilitate cross-team dependency management with explicit hand-off criteria
- Escalate material risk to the Engineering Manager and Program leadership with proposed mitigations, never with surprises
- Operate the Risk Scout agent and the
/status,/risk-log,/raid,/stakeholder-mapprompts
Jobs to be done
- As a Project Manager, I want a weekly status report auto-synthesized from GitHub Projects and Azure Boards, so that I spend time on mitigation, not formatting.
- As a Project Manager, I want every risk in the register with a probability, impact, owner, and review date, so that risk conversations are concrete.
- As a Project Manager, I want stakeholders to know what changed and what it means for them, so that trust compounds across quarters.
- As a Project Manager, I want dependencies tracked across teams with explicit acceptance criteria, so that hand-offs do not slip silently.
- As a Project Manager, I want the RAID log to be the single source of truth, so that nobody re-litigates decisions in hallway conversations.
- As a Project Manager, I want an audit trail of every stakeholder commitment, so that scope changes are negotiated with facts.
Pain points before AI-native
- Status theatre. Leadership asks for a one-page update; the Project Manager spends half a day reformatting the same data from three tools.
- Risk registers that are inventories, not instruments. Every risk is logged; none have owners, review dates, or mitigations. The register is audited, not used.
- Stakeholder silence. Bad news is delayed because there is no safe cadence for delivering it. When it finally lands, it lands with surprise and blame.
- Dependency slippage discovered too late. A downstream team learns on Friday that the upstream team slipped two weeks ago.
- RAID logs scattered across documents. Risks in one place, assumptions in another, dependencies in a third spreadsheet. The same item gets three different IDs.
AI-native daily workflow
The Project Manager operates a daily and weekly loop. The loop uses GitHub Copilot primitives inside Visual Studio Code, Claude Code at the terminal for long-form synthesis, and Microsoft Teams via the M365 Agents SDK for stakeholder cadence.
Morning setup
- Open Visual Studio Code on the
program-opsrepository. GitHub Copilot Chat loads the scoped.github/instructions/pm.instructions.md. - Invoke
/risk-log. The Risk Scout agent reviews the register, flags risks overdue for review, and drafts updates where new evidence is available. - Scan the Teams overnight digest from the M365 Agents SDK for any stakeholder message that requires a same-day reply.
Midday execution
- Run
/statusfor the active project. The agent pulls GitHub Projects status, Azure Boards iteration burn-up, Application Insights incident count via the Azure MCP, and composes a draft status report. - Reconcile cross-team dependencies by running
/raid. The agent updates the RAID log with new items detected from PR labels and work-item state transitions. - Hold dependency sync meetings where needed. Each agreement is written back to the RAID log immediately, with an owner and a target date.
Afternoon review
- Publish the status report. The M365 Agents SDK posts it into the appropriate Teams channels, with links back to the repository.
- Invoke
/stakeholder-mapweekly. The agent refreshes the stakeholder inventory, flags stakeholders who have not received an update in over two weeks, and proposes outreach drafts. - Close the day by committing the RAID log and the risk register updates to the
program-opsrepository. GitHub Actions publishes them to the Azure Static Web App that hosts the program dashboard.
Recommended primitives
Agent
| Agent | File | Purpose |
|---|---|---|
risk-scout | .github/agents/risk-scout.agent.md | Maintain the risk register, draft status reports, update the RAID log, refresh the stakeholder map |
The Risk Scout agent uses claude-sonnet-4-6 by default, with tools read, search, grep, bash. It pulls context from GitHub, Azure DevOps, Azure, and Microsoft 365 Agents SDK MCPs. Extended thinking is enabled for dependency analyses that cross multiple teams.
Slash prompts
| Command | File | Purpose |
|---|---|---|
/status | .github/prompts/status.prompt.md | Compose the weekly status report from reconciled sources |
/risk-log | .github/prompts/risk-log.prompt.md | Review and refresh the risk register, flag aging risks |
/raid | .github/prompts/raid.prompt.md | Update the RAID log from recent work-item and PR activity |
/stakeholder-map | .github/prompts/stakeholder-map.prompt.md | Refresh the stakeholder inventory and propose outreach |
Instructions scoped
Scoped applyTo keeps program artifacts distinct from team-level content.
Scope (applyTo) | File | Purpose |
|---|---|---|
program-ops/status/** | .github/instructions/status.instructions.md | Status report tone, one-page ceiling, citation discipline |
program-ops/risks/** | .github/instructions/risks.instructions.md | Risk scoring rubric, owner discipline, mitigation phrasing |
program-ops/stakeholders/** | .github/instructions/stakeholders.instructions.md | Stakeholder map format, outreach cadence, escalation rules |
Hooks
Hooks are zero-token governance for program artifacts.
pre-commit: reject a risk without a scored probability, impact, owner, and review datepost-commit: regenerate the program dashboard JSON on any RAID changepre-push: validate that every status report cites specific work items and Application Insights incidents
Validated MCPs
Every MCP below is registered in the MCP catalog. Do not reference any MCP that is not in the catalog.
| MCP | Status | Use in this persona |
|---|---|---|
| Azure DevOps MCP Server | Official (Microsoft) | Read and update Azure Boards work items, risk register entries, and iteration data |
| GitHub MCP Server | Official | Read GitHub Projects state, PR status, and Actions runs for status composition |
| Azure MCP Server | Official (Microsoft) | Query Azure Monitor and Application Insights for incident evidence behind risks |
| Microsoft Learn Docs MCP | Official | Ground program guidance in Microsoft Learn and GitHub Docs |
| Microsoft 365 Agents SDK MCP | Official (Microsoft) | Post status reports and stakeholder outreach drafts into Microsoft Teams |
Real examples
Example 1: weekly status report for a regulated program
Input: A payments program with three squads, one active production incident, and an auditor review next month.
Invocation: /status.
Expected output:
- A one-page status report in
program-ops/status/2026-W17.mdwith sections: commitments, progress, risks in motion, decisions needed, upcoming milestones. - Every claim cites a work item ID from Azure Boards or a PR from GitHub Projects.
- The active incident is linked to its Application Insights timeline.
- A Teams post via the M365 Agents SDK to the executive sponsor channel with the one-page summary.
Example 2: cross-team dependency at risk
Input: The checkout squad depends on the identity squad delivering a new token endpoint by week 18. Evidence shows the identity squad is behind.
Invocation: /raid.
Expected output:
- A new RAID entry
program-ops/raid/identity-token-endpoint.mdwith type Dependency, owner set to the identity squad lead, impact described in checkout-squad terms, mitigation proposals (temporary stub, feature flag). - An Azure Boards dependency work item created and linked to both squad boards.
- A Teams message to both squad leads with the facts, not a meeting invite.
- A follow-up on the stakeholder map: the checkout squad product owner is flagged for a targeted update.
Anti-patterns
- Status reports that rephrase the plan. Paraphrasing the plan is not progress. Mitigation: the
status.instructions.mdrequires evidence citations for every claim. - Risks without owners. A risk without an owner is a wish. Mitigation: the pre-commit hook rejects unowned risks.
- Stakeholder maps that only list names. A map without cadence and interests is a phonebook. Mitigation:
/stakeholder-maprequires cadence, interests, and preferred channel for each stakeholder. - RAID logs duplicated across tools. Multiple sources of truth create disputes. Mitigation: the RAID log lives in the
program-opsrepository; everything else is a view. - Escalation by surprise. Bad news that lands without proposed mitigations loses trust. Mitigation: the Risk Scout agent always accompanies an escalation with at least two mitigation options.
KPIs and impact metrics
| Metric | Baseline (manual) | Target (agentic) | Measurement |
|---|---|---|---|
| Status report preparation time | 8 hours per week | Under 90 minutes | Time-to-publish log |
| Risk median review age | 21 days | Under 7 days | Risk register audit |
| Dependency slippage lead time | 3 days warning | Over 10 days warning | RAID detection history |
| Stakeholder satisfaction (NPS) | Plus 10 | Plus 40 | Quarterly program survey |
| Escalation-with-mitigation rate | 35 percent | Over 90 percent | Escalation audit |
| Token efficiency | N/A | Under 200k tokens per week | Copilot usage report |
Maturity in four levels
| Level | Name | Markers |
|---|---|---|
| L1 | Manual | Status reports assembled by hand, risks in a spreadsheet, RAID scattered |
| L2 | Assisted | GitHub Copilot Chat for drafting, no agent, some Azure DevOps dashboards |
| L3 | Augmented | Risk Scout agent, four slash prompts, scoped instructions, RAID log in program-ops |
| L4 | Agentic | Full primitives kit, hooks enforced, stakeholder cadence automated in Teams via M365 Agents SDK, risks always scored, maturity scorecard above 80 percent |
Integration with other personas
- With Engineering Manager: shared delivery-health view, risk-to-capacity translation
- With Scrum Master: sprint flow informs program pacing
- With Product Owner: scope negotiation backed by RAID evidence
- With Technical Lead: architectural risks land in the program register with owners
- With Release Manager: release-window coordination across squads
- With InfoSec Officer and Compliance Auditor: program-level controls, audit evidence, regulated-industry cadence
- With SRE: incident-derived risks recorded and tracked
Glossary
- RAID log: the consolidated register of Risks, Assumptions, Issues, Dependencies used as the program’s single source of truth.
- Risk register: the risk subset of the RAID log, kept in Azure DevOps with probability, impact, owner, and review date.
- Stakeholder map: a living inventory of stakeholders, their interests, their cadence, and their preferred channel.
- Status report: a weekly, one-page artifact that reconciles commitments, progress, risks in motion, decisions needed, and upcoming milestones.
- Escalation with mitigation: the discipline of never delivering bad news without at least two proposed options.
- Dependency hand-off: the documented hand-off between two teams, with explicit acceptance criteria.
References
- Azure Boards documentation — authoritative guidance for risk registers and work-item tracking
- GitHub Projects documentation — program-level views across multiple repositories
- Microsoft 365 Agents SDK — post status reports and stakeholder outreach into Teams
- Azure Monitor documentation — incident evidence for risk scoring
- GitHub Actions documentation — schedule program dashboards and reconciliation jobs