Risk and Dependency Identification
Methodology
1. ANALYZE → For each task, identify risks AND dependencies
2. SCORE → Rate each risk by likelihood × impact
3. MITIGATE → Assign mitigations for all Medium+ risks
4. FLAG → Mark High/Critical risks for human review
5. MAP CHAIN → Map dependency chains and find the critical path
Step 1: Risk Identification
For every task, check each risk category:
| Category |
What to Look For |
| Technical |
Architecture, performance, security, compatibility |
| Schedule |
Estimates, sequencing, bottlenecks, deadlines |
| Resource |
People, tooling, access, knowledge gaps |
| External |
Third-party APIs, vendors, dependencies, regulatory |
| Integration |
Contract mismatches, data format changes, versioning |
| Operational |
Deployment, monitoring, rollback, incident response |
| Hidden/Implicit |
Unvalidated assumptions, single points of failure |
Prompting questions per task:
- Is this something the team has done before, or new territory?
- Does this task touch shared code, data, or infrastructure?
- Does this task need something outside the team's control?
- If this task fails or is delayed, what's the blast radius?
- Does someone need to learn something new to complete this?
Step 2: Dependency Identification
| Type |
Description |
| Internal |
Other tasks within this plan |
| External |
Teams, services, or systems outside the plan |
| Implicit |
Shared resources or timing conflicts |
| Transitive |
Dependencies of dependencies (A→B→C means A depends on C) |
| Informational |
A decision or spec that must exist first |
| Environmental |
Infrastructure, access, or tooling needed |
Critical Path
For plans with 3+ tasks, map the dependency chain and find the longest path:
Task A ──→ Task B ──→ Task D ──→ Task E (critical path = A → B → D → E)
└──→ Task C ──┘
Any delay on the critical path delays the entire plan. Flag it explicitly.
Implicit dependency check — ask for each pair of tasks:
- Do they modify the same files, schemas, or configs?
- Do they share a resource (database, environment, API key)?
- Do they have contradictory requirements?
Step 3: Risk Scoring (Likelihood × Impact)
Likelihood
| Level |
Chance |
| Rare |
<10% |
| Unlikely |
10-30% |
| Possible |
30-60% |
| Likely |
60-90% |
| Almost Certain |
>90% |
Impact
| Level |
Definition |
| Negligible |
Cosmetic, fixable in minutes |
| Minor |
1-2 day delay, workaround exists |
| Moderate |
~1 week delay, partial rework |
| Major |
Multi-week delay, architecture change |
| Critical |
Blocks completion, data loss, security incident |
Score Matrix
| Likelihood ↓ Impact → |
Negligible |
Minor |
Moderate |
Major |
Critical |
| Almost Certain |
Medium |
High |
Critical |
Critical |
Critical |
| Likely |
Low |
Medium |
High |
Critical |
Critical |
| Possible |
Low |
Medium |
High |
High |
Critical |
| Unlikely |
Low |
Low |
Medium |
Medium |
High |
| Rare |
Low |
Low |
Low |
Medium |
High |
Required actions by score:
- Critical → Must flag for human review. Blocking if unmitigated.
- High → Must have a mitigation plan. Flag for human review.
- Medium → Should have a mitigation or explicit acceptance.
- Low → Note and move on.
Step 4: Mitigation Strategies
| Strategy |
When |
Example |
| AVOID |
Can eliminate the risk entirely |
Use proven tech instead of experimental |
| MITIGATE |
Reduce likelihood or impact |
Add retry logic, implement monitoring |
| TRANSFER |
Someone else handles it better |
Use managed service instead of self-hosting |
| ACCEPT |
Mitigation cost exceeds risk |
Document and move on (Low risks) |
| CONTINGENCY |
Need a plan B on trigger |
"If API X is down >10 min, switch to batch processing" |
A good mitigation answers: What exactly, when, and who?
"Hope it works" is not a mitigation.
Output Format: Risk Register
## Risks & Blockers
| Risk/Dependency | Type | Score (L×I) | Impact | Mitigation |
|----------------|------|-------------|--------|------------|
| Third-party API rate limits | external | Likely × Moderate = High | API calls fail under load | Queue + retry with exponential backoff |
| Tasks 1 and 2 modify same DB schema | implicit | Possible × Major = High | Merge conflicts | Sequence: Task 1 completes schema before Task 2 starts |
CRITICAL PATH: Task 1 → Task 3 → Task 4
⚠ Any delay on this chain pushes the plan. Task 2 is off the critical path — safe to de-prioritize.
Human Review Triggers
Flag for human review when ANY of these are true:
- Critical risks exist (unmitigated)
- High risks without a concrete mitigation
- Circular dependencies (impossible to schedule)
- Unknown likelihood or impact on a significant risk
- Critical path exceeds 80% of total schedule
- Plan depends on an unconfirmed external commitment
1---2name: risk-and-dependency-identification3description: Skill for the planner agent. Identify risks, blockers, and dependencies in a plan before finalizing it. Use after task-decomposition, before plan-output-template. Do NOT skip this before finalizing any non-trivial plan.4---56# Risk and Dependency Identification78## Methodology910```111. ANALYZE → For each task, identify risks AND dependencies122. SCORE → Rate each risk by likelihood × impact133. MITIGATE → Assign mitigations for all Medium+ risks144. FLAG → Mark High/Critical risks for human review155. MAP CHAIN → Map dependency chains and find the critical path16```1718---1920## Step 1: Risk Identification2122For every task, check each risk category:2324| Category | What to Look For |25|----------|-----------------|26| **Technical** | Architecture, performance, security, compatibility |27| **Schedule** | Estimates, sequencing, bottlenecks, deadlines |28| **Resource** | People, tooling, access, knowledge gaps |29| **External** | Third-party APIs, vendors, dependencies, regulatory |30| **Integration** | Contract mismatches, data format changes, versioning |31| **Operational** | Deployment, monitoring, rollback, incident response |32| **Hidden/Implicit** | Unvalidated assumptions, single points of failure |3334Prompting questions per task:35- Is this something the team has done before, or new territory?36- Does this task touch shared code, data, or infrastructure?37- Does this task need something outside the team's control?38- If this task fails or is delayed, what's the blast radius?39- Does someone need to learn something new to complete this?4041---4243## Step 2: Dependency Identification4445| Type | Description |46|------|-------------|47| **Internal** | Other tasks within this plan |48| **External** | Teams, services, or systems outside the plan |49| **Implicit** | Shared resources or timing conflicts |50| **Transitive** | Dependencies of dependencies (A→B→C means A depends on C) |51| **Informational** | A decision or spec that must exist first |52| **Environmental** | Infrastructure, access, or tooling needed |5354### Critical Path5556For plans with 3+ tasks, map the dependency chain and find the longest path:5758```59Task A ──→ Task B ──→ Task D ──→ Task E (critical path = A → B → D → E)60 └──→ Task C ──┘61```6263Any delay on the critical path delays the entire plan. Flag it explicitly.6465**Implicit dependency check** — ask for each pair of tasks:66- Do they modify the same files, schemas, or configs?67- Do they share a resource (database, environment, API key)?68- Do they have contradictory requirements?6970---7172## Step 3: Risk Scoring (Likelihood × Impact)7374### Likelihood7576| Level | Chance |77|-------|--------|78| Rare | <10% |79| Unlikely | 10-30% |80| Possible | 30-60% |81| Likely | 60-90% |82| Almost Certain | >90% |8384### Impact8586| Level | Definition |87|-------|-----------|88| Negligible | Cosmetic, fixable in minutes |89| Minor | 1-2 day delay, workaround exists |90| Moderate | ~1 week delay, partial rework |91| Major | Multi-week delay, architecture change |92| Critical | Blocks completion, data loss, security incident |9394### Score Matrix9596| Likelihood ↓ Impact → | Negligible | Minor | Moderate | Major | Critical |97|----------------------|-----------|-------|----------|-------|----------|98| Almost Certain | Medium | High | **Critical** | **Critical** | **Critical** |99| Likely | Low | Medium | High | **Critical** | **Critical** |100| Possible | Low | Medium | High | High | **Critical** |101| Unlikely | Low | Low | Medium | Medium | High |102| Rare | Low | Low | Low | Medium | High |103104**Required actions by score:**105- **Critical** → Must flag for human review. Blocking if unmitigated.106- **High** → Must have a mitigation plan. Flag for human review.107- **Medium** → Should have a mitigation or explicit acceptance.108- **Low** → Note and move on.109110---111112## Step 4: Mitigation Strategies113114| Strategy | When | Example |115|----------|------|---------|116| **AVOID** | Can eliminate the risk entirely | Use proven tech instead of experimental |117| **MITIGATE** | Reduce likelihood or impact | Add retry logic, implement monitoring |118| **TRANSFER** | Someone else handles it better | Use managed service instead of self-hosting |119| **ACCEPT** | Mitigation cost exceeds risk | Document and move on (Low risks) |120| **CONTINGENCY** | Need a plan B on trigger | "If API X is down >10 min, switch to batch processing" |121122A good mitigation answers: **What exactly, when, and who?**123"Hope it works" is not a mitigation.124125---126127## Output Format: Risk Register128129```markdown130## Risks & Blockers131132| Risk/Dependency | Type | Score (L×I) | Impact | Mitigation |133|----------------|------|-------------|--------|------------|134| Third-party API rate limits | external | Likely × Moderate = High | API calls fail under load | Queue + retry with exponential backoff |135| Tasks 1 and 2 modify same DB schema | implicit | Possible × Major = High | Merge conflicts | Sequence: Task 1 completes schema before Task 2 starts |136137CRITICAL PATH: Task 1 → Task 3 → Task 4138⚠ Any delay on this chain pushes the plan. Task 2 is off the critical path — safe to de-prioritize.139```140141---142143## Human Review Triggers144145Flag for human review when ANY of these are true:146- Critical risks exist (unmitigated)147- High risks without a concrete mitigation148- Circular dependencies (impossible to schedule)149- Unknown likelihood or impact on a significant risk150- Critical path exceeds 80% of total schedule151- Plan depends on an unconfirmed external commitment
las-pinter