project-agency-operations

name	project-agency-operations
description	Coordinates generic project Agency CLI, MCP authorization, M365 consent boundaries, Azure tooling, and Microsoft internal plugin adoption. Use when setting up or auditing Agency profiles, MCP servers, WorkIQ/M365 access, or curated plugins for a project.
lastReviewed	2026-07-01T00:00:00.000Z

Project Agency Operations

Use this skill when a project depends on Agency CLI, MCP servers, Microsoft 365 context, Azure tooling, or curated marketplace plugins.

Route The Request

Request	Default route
Docs, release signals, Azure safety, ADO, or routine project work	project-ops
Documentation or TSG lookup only	project-docs
ServiceTree lifecycle, ownership, identity, or subscription binding	project-servicetree with project-servicetree-planner
Meeting metadata, transcripts, or notes	meeting-note-taker with explicit named-meeting consent
People/org context	m365-people-context with explicit scope
Mail review	m365-mail-review with explicit thread or mailbox scope
File or document review	m365-doc-review with explicit file/site scope
Planner task review	m365-planner-review with explicit plan/task scope
Cross-surface M365 work	project-context break-glass profile with explicit consent
S360/SFI read-only KPI or action-item lookup	project-s360-read
Solution-owner reports or posture rollups	project-reports
Azure or SFI remediation	azure-remediate
Service360 KPI work	service360-breeze
Weekly Microsoft Connect goal tracking	project-connect-tracker
Requirement/Implementation Spec generation from an ADO work item	project-ado-spec
Incident investigation, on-call/DRI lookup	project-incidents; see the project-incident-response skill
Microsoft Fabric work (Lakehouse, notebooks, semantic models, data security)	project-fabric* templates; see the project-fabric-operations skill
Pull one capability on need from the catalog	project-capability-adoption skill + agency-mcp-capabilities.md
Adopt a Microsoft Foundry capability (IQ family, Toolboxes, Tool Search, Routines, autopilot agents, Claude)	project-foundry-operations skill — different runtime than Agency profiles
Plugin adoption	Run the plugin checklist before install

Safety Rules

• Do not read M365 content without a specific request naming the source.
• Do not invoke write-capable remediation plugins without approval.
• Prefer repo profiles to global plugin installs.
• Prefer specialized M365 profiles to project-context; do not launch every M365 MCP for a single-domain task.
• Keep workspace MCP config focused on tools that are safe for routine project operations.
• Prefer agency copilot --profile-only <profile> for narrow tasks. It ignores ambient workspace MCP sources, including repo .mcp.json, and prevents Agency from loading every configured MCP server.
• Escalate profiles in this order: project-docs, project-servicetree, or a narrow M365 profile -> project-ops -> project-context or remediation profiles.

Verification

Run:

./agency/scripts/verify-tooling.ps1
agency copilot --profile-only project-ops --prompt "List MCP servers and exit. Do not call tools."
agency copilot --profile-only meeting-note-taker --prompt "List meeting MCP servers and exit. Do not read content."

Verify Access Safely

Before relying on a specific MCP, run a harmless read-only capability check instead of assuming auth or wiring is correct:

agency copilot --mcp enghub --prompt "Search Engineering Hub for the top result only. Do not edit files."
agency copilot --mcp workiq --prompt "Call only a non-content capability check such as list_agents. Do not read mailbox, calendar, Teams, documents, files, or people data."

Record successful checks in project docs so the next session does not have to re-discover auth state. If a check prompts for auth, complete it in a native terminal or browser when the embedded terminal hides the flow.

Would Revise If

Revisit by 2026-09-15. Rewrite or delete this skill if it fails to prevent an unapproved M365 content read, or if two projects using the starter need a substantially different routing model.