A platform team is defining autonomy levels for Copilot cloud agent in a regulated payments repository. Low-risk actions may run automatically if they only inspect code and produce comments. Medium-risk actions may create draft pull requests but must wait for reviewer inspection before workflow approval. High-risk actions include secret access, production deployment changes, and compliance-impacting payment logic. A proposed policy allows Copilot-created draft pull requests that modify PCI-scoped payment validation to run workflows with secrets automatically. Which change should the team make first? Select one answer.

The correct answer is "Require human approval before privileged workflows." The scenario states that high-risk actions, including secret access and production deployment changes, are involved. Allowing Copilot-created draft pull requests that modify PCI-scoped payment validation to automatically run workflows with secrets is a critical security vulnerability. PCI compliance requires stringent controls over changes to payment logic. Therefore, requiring human approval before any privileged workflow execution, especially those involving secrets or production changes, is the most immediate and crucial step to prevent unauthorized or erroneous modifications in a regulated environment. "Allow automatic runs only for dependency updates" is too restrictive and doesn't directly address the high-risk PCI change scenario. "Require two reviewers after workflows finish" is reactive; the privileged workflow would have already run, potentially causing harm. "Move PCI changes to scheduled workflows" doesn't inherently add a necessary approval gate for the high-risk actions themselves.