RAI Planner with HVE Core

MICROSOFT / HVE CORE / RESPONSIBLE AI

RAI Planner
with HVE Core

Plan an AI feature, then make the workflow fit your team.

OCTOBER 1, 2026 / SOURCE: 7e2de1a

Use the planner
Assess a support chatbot and see what needs follow-up.
Add your team's policy
Use hve-builder to create a lending-team extension.

microsoft/hve-coreBoth examples are scripted

USE RAI PLANNER

What I'd use it for

The conversation

Get specific about the system

Who uses it, what data it sees and where a bad answer could cause harm. NIST AI RMF 1.0 gives the assessment its structure.

The output

Make the remaining work visible

A plan that connects risks to controls and evidence, plus backlog drafts for the gaps.

Already have code, a diff or a plan to assess? RAI Reviewer is the separate evidence-review workflow.

GET STARTED

Start with what you already have

A conversation

capture

"I want to assess our support chatbot. Start a new assessment."

A PRD

from-prd

"Use the attached PRD and ask me about the missing AI context."

A security plan

IF YOU HAVE ONE

from-security-plan

"Start from our Security Planner session and reuse its AI component inventory."

The security-plan mode reads that plan without changing it.

HOW THE SESSION WORKS

Six phases, with three approval points

AI system scoping
SUMMARY
What are we assessing?
Risk classification
CONFIRM
How deep should we go?
Standards mapping
CONFIRM
What needs to be covered?
Security model analysis
SUMMARY
Which threats matter here?
Impact assessment
SUMMARY
Do the controls have evidence?
Review and handoff
CONFIRM
What work should we create?

CONFIRMWaits for your answer.

SUMMARYContinues unless you object.

Prohibited uses are screened before the risk indicators. A match pauses the session.

WORKED EXAMPLE / SCRIPTED

Assess a support chatbot

KEEP THE WORK

Pick it up again in a new chat

Assessment folder

.copilot-tracking/rai-plans/
└── support-assistant/
    ├── state.json
    ├── rai-plan.md
    └── github-backlog-handoff.md

Keep these files with the project

state.json tracks progress. rai-plan.md holds the assessment and its evidence.

The handoff file holds draft issues. Creating them still needs your confirmation.

ADAPT IT FOR YOUR TEAM

Use your policy before you build an extension

For one assessment, supply the references

A skill holds reusable policy

Package your references, including published guidance the planner doesn't include, and say when to load them.

An instruction adds conventions

Use applyTo to target plan files, with checks and backlog preferences your team repeats.

I'd start with the references. Once the setup repeats, I'd ask hve-builder to package it.

RAI Planner already asks for reference content in Phase 1, so I wouldn't start by changing the agent. Supply a policy as a standard and a prohibited-use list as a prohibited-use-framework. The planner uses rpi-research to analyze them, writes shared summaries and records them in state.json. Verify those summaries against the originals. It also accepts risk indicators, output formats and provider codes of conduct. Published guidance that RAI Planner doesn't include works the same way, and the next example adds some. Be explicit about layering a policy on NIST; replacing the framework is a different decision. For reuse across assessments or repositories, hve-builder can create a skill and a scoped instruction alongside HVE Core. The skill's description makes it discoverable; naming it explicitly makes the intended use clear.

WORKED EXAMPLE / SCRIPTED

Use hve-builder for the repeatable parts

Contoso and its policies are fictional, but SR 26-2 is real. The Federal Reserve, FDIC and OCC issued this revised model risk guidance on April 17, 2026, replacing SR 11-7, and RAI Planner doesn't include it. That makes it a good test of the extension path. Read the scope before you add guidance like this. It isn't an enforceable standard, it's expected to matter most for banking organizations with more than $30 billion in assets, and it excludes generative and agentic AI. It fits Contoso's loan eligibility model, but it wouldn't cover the chatbot from the first example. Run the request in an authoring agent that can edit .github; RAI Planner itself only writes assessment artifacts. hve-builder reads the planner's extension points, summarizes the official text in its own words and links back to it. I'd still have someone from the model-risk team check that summary before the planner relies on it. The review catches a draft that replaces NIST even though the request says to layer the policies. The fix keeps NIST as the baseline, which is the extension pattern rai-standards describes. In the plan, SR 26-2 adds model risk checks under the NIST characteristics, and Phase 5 records the evidence for each gap. The agent running HVE Builder verifies findings and owns the fixes. A source review and lint pass aren't evidence that the extension works in a real session, so test it with representative assessments before you adopt it. Plugin installations may prefix the command, for example /hve-core:hve-builder. The file contents, finding, state and plan excerpt are illustrations, not executed results.

TRY IT

Start with one AI feature

Select RAI Planner and attach the context you already have.

Review the open questions and evidence gaps with your team before turning the drafts into work.

RAI Planning documentation

RAI agent source at 7e2de1a

microsoft/hve-coreScripted examples / fictional Contoso

RAI Planner with HVE Core