A platform team is introducing Copilot cloud agent for production-adjacent repositories. They need an operating process that preserves traceability, avoids unreviewed execution paths, and gives reviewers enough evidence before a Copilot-created pull request is marked ready. Which four actions should you perform in order? 1. Require reviewers to inspect the session log and PR diff 2. Enable automatic workflow execution for every Copilot PR 3. Start work from an issue or tracked agent session 4. Correlate commits with audit and session identifiers 5. Merge after Copilot opens the draft pull request 6. Approve workflow runs only after reviewing changes

The correct order prioritizes traceability, review, and controlled execution. Starting work from an issue or tracked agent session (3) establishes the initial context and traceability for Copilot's actions. Requiring reviewers to inspect the session log and PR diff (1) ensures they understand the agent's thought process and the proposed changes, addressing the need for sufficient evidence. Approving workflow runs only after reviewing changes (6) prevents unreviewed execution paths and maintains control over the deployment process. Finally, correlating commits with audit and session identifiers (4) ensures end-to-end traceability for compliance and debugging. Option 1 is incorrect because starting with review before establishing context is inefficient. Option 3 is incorrect because enabling automatic workflow execution (2) before review violates the requirement to avoid unreviewed execution paths, and merging immediately (5) bypasses critical review steps. Option 4 is incorrect because it starts with correlation before any work is done, and the sequence of review and approval is out of order.