A repository owner proposes this autonomy policy for Copilot cloud agent on a regulated service. Evaluate the following statements. 1. The policy allows meaningful agent autonomy without allowing self-merge. 2. Required reviews and checks provide accountability before changes reach main. 3. Passing the agent’s draft PR checks means Responsible AI review is no longer needed.

Copilot autonomy policy for regulated-api

Allowed:
- Copilot may be assigned issues labeled agent-ok.
- Copilot may research the repository and create implementation plans.
- Copilot may create commits only on copilot/** branches.
- Copilot may open draft pull requests.
- Copilot may request changes from itself after reviewer comments.

Not allowed:
- Copilot must not merge pull requests.
- Copilot must not approve its own pull request.
- Copilot must not disable required checks.
- Copilot must not receive production secrets at runtime.

Repository controls:
- main requires two approving reviews.
- main requires codeql and contract-tests checks.
- Copilot firewall remains enabled with recommended allowlist.