A platform team wants to revise its Copilot PR governance model. The current model requires manual approval for every agent-created PR, including typo fixes and test-only updates. The team wants to keep high-risk changes accountable without slowing low-risk work. Which four actions should you perform in order? 1. Identify file paths and change types that materially increase risk 2. Remove all human review from Copilot-created pull requests 3. Map high-risk paths to owners or required reviewers 4. Keep automated checks required for low-risk pull requests 5. Require manual approval for every dependency update 6. Monitor blocked PRs and tune the risk rules over time

The correct order prioritizes identifying risk, assigning accountability, maintaining automated checks, and continuous improvement. 1. Identify file paths and change types that materially increase risk: This is the crucial first step to differentiate between high- and low-risk changes, forming the basis for a nuanced governance model. Without this, all changes are treated equally. 2. Map high-risk paths to owners or required reviewers: Once high-risk areas are identified, assigning specific reviewers ensures accountability and expert oversight for critical changes. 3. Keep automated checks required for low-risk pull requests: Automated checks (like CI/CD, linting, security scans) are essential for maintaining quality and catching common issues, even for low-risk changes, and should not be removed. 4. Monitor blocked PRs and tune the risk rules over time: Governance models are not static. Monitoring allows for iterative refinement, ensuring the rules effectively balance risk mitigation with development velocity. Incorrect options: Removing all human review (option 2) is too drastic and ignores the need for high-risk accountability. Requiring manual approval for every dependency update (option 5) is overly restrictive and contradicts the goal of speeding up low-risk work.