A governance team is defining autonomy levels for Copilot cloud agent. Match each proposed agent action to the most appropriate intervention level. Which mapping is correct?

The correct mapping prioritizes security and impact. 1. Create a draft PR that changes README wording maps to D. Allow draft PR creation with standard validation. Changing a README is low-risk and can proceed with typical automated checks. 2. Modify authentication middleware and request secret-backed tests maps to A. Human approval before privileged workflow execution. Modifying authentication is a high-risk action affecting security and requires explicit human oversight before execution, especially with secret-backed tests. 3. Propose Terraform changes for production deployment maps to B. Compliance and infrastructure review before merge. Terraform changes for production are critical infrastructure modifications that demand thorough compliance and infrastructure review to prevent outages or security vulnerabilities. 4. Add a non-sensitive unit test for existing behavior maps to C. Lightweight review with normal checks. Adding a non-sensitive unit test is low-risk and can be handled with standard code review processes. Incorrect options misalign risk with intervention: for example, allowing automatic production deployment (E) for authentication changes (2) or requiring heavy review for a simple README change (1).