Software & SaaSYour engineering policies, enforced on every run.
The default software pack gives you reusable, governed workflows for backlog quality, code review, pipelines, testing, releases, documentation, security, reliability and engineering management in Azure DevOps. No regulated-industry logic you do not need. Agents do the checking and the drafting. Your engineers sign off.
No card required. Your data stays in your Azure DevOps tenant.
- OWASP
- WCAG 2.2 AA
- GDPR
- SOC 2
- SRE
- DORA delivery metrics
Clear policies, not a standards-heavy persona.
Most software teams do not need a compliance persona on every task. They need their own engineering policies applied consistently: Definition of Ready and Done, repository instructions, security and privacy requirements, accessibility, service-level objectives, release controls and observable operations. Those policies usually exist in a wiki. They are enforced when someone remembers. The software pack turns them into workflows that run on the events your team already produces: a story moving to Ready, a PR opening, a pipeline failing, a release being cut.
- 01
Stories reach sprint half-ready.
Acceptance criteria are vague, dependencies are missing and non-functional needs are left for the developer to guess.
- 02
PR review misses the context.
Reviewers see the diff but not the linked story, the repository rules or the security context, so the same findings come back release after release.
- 03
Red pipelines wait for a person.
A nightly build fails at 2 a.m. and the diagnosis starts when the first engineer logs in.
- 04
Release readiness is a meeting.
Builds, tests, defects, approvals, rollback plans and docs are checked by hand in a release call instead of by the gate.
Your delivery policy in every run.
The default software pack sets the classification, traceability, practices and gates the agents follow. Add your own rules on top.
- 01 Classification
Risk that matters to a service
Data sensitivity, customer impact, service tier and SLO, change risk, security and privacy relevance, accessibility impact, and release criticality.
- 02 Traceability model
From business need to production
Business need to epic, feature and story, design or ADR, commit and PR, build, test, release, and operational evidence.
- 03 Standards & frameworks
The practices you already follow
OWASP and secure-development practices, WCAG 2.2 AA for applicable experiences, GDPR and privacy requirements where applicable, SOC 2 control context where configured, SRE and well-architected practices, and DORA delivery metrics as engineering signals.
- 04 Lifecycle gates & evidence
Gates that run themselves
Backlog readiness, design review, protected PR, build and test policy, deployment readiness, release decision, and post-deployment verification.
The Software / SaaS chain, kept intact.
A PR opens without a linked story. The agent flags the missing link, asks the author, and confirms the trace before review.
- Business need
- Epic / story
- Design / ADR
- Commit / PR
- Build
- Test
- Release
- Ops evidence
Where the agents do the work.
Eight workflows the software pack is configured for. Each runs on an event, a schedule or a manual call, and leaves its output where the team works.
Backlog readiness
Check user stories, acceptance criteria, dependencies, links and non-functional requirements before development starts.
Business Analyst Agent
Contextual PR review
Review changed code against the linked work, repository rules, architecture, security, tests and release impact.
DevOps Engineer AgentPipeline recovery
Diagnose a failure, prepare the allowed remediation, request approval, rerun and verify the result.
DevOps Engineer Agent
Test operations
Generate tests, find coverage gaps, triage failures, create defects and analyze flaky tests.
QA Engineer Agent
Release readiness
Check builds, tests, defects, security, approvals, rollback, documentation and unresolved risk before the release decision.
Release Manager AgentReliability and incident follow-up
Connect incidents and operational signals to changes, runbooks, defects and engineering work.
DevOps Engineer Agent
Documentation maintenance
Update wiki pages, runbooks, API and developer docs, onboarding and support content from approved changes.
Product Owner AgentEngineering reporting
Generate evidence-linked status, flow, risk, quality and delivery summaries for the people who need them.
Product Owner Agent
Twelve roles, configured for delivery teams.
The supplied catalog includes these role configurations for Software and SaaS. Use them as shipped, or fork one and edit its instructions in plain English.
Business Analyst Agent
Enforces your Definition of Ready when a story moves to Ready and asks the owner for what is missing.
ShipDevOps Engineer Agent
Reviews PRs against linked work and repository rules, and diagnoses failed pipelines before anyone logs in.
TestQA Engineer Agent
Generates tests from acceptance criteria, finds coverage gaps and separates flaky tests from real failures.
ReleaseRelease Manager Agent
Checks builds, tests, defects, approvals and rollback before a release goes to its decision.
Software / SaaS roles in the catalog
- Business Analyst
- DevOps Engineer
- Engineering Manager
- Product Owner
- Project Manager
- QA Engineer
- Release Manager
- Scrum Master
- Software Architect
- Team Assistant
- Technical Writer
- UX Designer
A pull request opens.
A developer opens PR !412 against the checkout service. The agent's trigger fires and the run starts. It retrieves the diff, the linked story and its acceptance criteria, the repository instructions, code owners, build and test status, and the security context. It posts review findings on the PR, flags that one changed file has no test covering the new branch, and notes that a payments change needs a code owner who is not yet on the review. It routes the right reviewer, creates follow-up work where your configuration allows, and checks the required branch policies. Only then is the PR marked ready for human sign-off.
run started · PR !412 opened
reading diff · STORY 4821 · repo rules
build green · 1 new branch untested
code owner missing · @payments added
checkpoint · ready for human sign-off
record · findings and policies logged
- ✓ Linked to work item
- ✓ Build and tests green
- ! New code covered by tests
- ! Required code owners
- ✓ Security findings
People own the decisions.
Developers, architects, product owners, QA, security, release owners and engineering managers stay responsible for their decisions. Agents do the workflow work they are permitted to do and show the evidence. Rule-shaped checks can write directly. Anything generated or material follows your review policy, and with Required Approval on, the run waits for the named person before it writes.
[ Trusted by Microsoft and industry leaders ]
Software & SaaS questions.
Use the default software pack unless a regulated customer, product, data type or jurisdiction needs extra domain controls. All plans include every industry pack, so you can add one later.
Yes, that is how the pack is meant to be used. Edit an agent's instructions in plain English, attach your rules and templates as knowledge, or turn on Bring Your Own Data so it retrieves from your documents, queries and wiki pages. Every change is versioned with rollback.
It supports security, privacy, accessibility, traceability and evidence workflows. Organization-specific compliance requirements still need configuration and qualified review.
Only where you want it to. Trigger conditions use fields, operators and values, for example State changes to Ready on a User Story, so agents run only on matching items. Manual agents can also run on a schedule.
It diagnoses the failure and prepares the remediation your configuration allows. Where approval is required, it asks first, then reruns and verifies the result. Every step lands in the Job Explorer.
No. Agents run inside your Azure DevOps environment on the Copilot4DevOps security and trust model, and your project data is not used to train models.
Credits are $0.01 each, pooled across your organization, with no per-user fees. A rule-shaped check, such as a required work-item link on every PR, can run as an Execution Agent at a flat 4 credits. Agents pause cleanly at zero.
Enforce one policy this week.
Start a free trial with 2,000 credits, no card required. Or book a 30-minute demo with a failed pipeline, an open PR or a backlog-quality problem from your own project, and watch the run live.
