A platform team wants to introduce Copilot cloud agent for medium-risk service maintenance. They need a practical rollout sequence that assigns autonomy gradually, verifies guardrails, and keeps ownership clear for audit and review. Which four actions should you perform in order? 1. Enable issue assignment for selected low-risk repositories. 2. Define task labels, allowed repositories, and prohibited change types. 3. Require checks, reviews, and CODEOWNERS on protected branches. 4. Allow Copilot to merge after its own checks pass. 5. Review initial draft PRs and tune instructions or constraints. 6. Disable the agent firewall for all repositories.

The correct sequence prioritizes safety and gradual rollout. First, 2. Define task labels, allowed repositories, and prohibited change types establishes the foundational guardrails and scope for the agent. Next, 3. Require checks, reviews, and CODEOWNERS on protected branches ensures human oversight and established processes are in place even before the agent is active. Then, 1. Enable issue assignment for selected low-risk repositories introduces the agent to a controlled environment. Finally, 5. Review initial draft PRs and tune instructions or constraints allows for iterative refinement based on real-world performance, ensuring the agent operates as intended before increasing its autonomy. Option 1 → 2 → 5 → 3 is incorrect because enabling issue assignment before defining guardrails is risky. Option 3 → 1 → 4 → 5 is incorrect because allowing Copilot to merge (4) before reviewing its drafts (5) or even defining its scope (2) is premature and unsafe. Option 2 → 6 → 3 → 1 is incorrect because disabling the agent firewall (6) is highly insecure and goes against the principle of gradual, safe rollout.