A repository owner wants Copilot coding agent to propose changes to regulated deployment policy files, but not allow those changes to be applied without human approval and a traceable review path. Which four actions should you perform in order? 1. Add a protected environment for regulated deployment application 2. Require reviewer approval or deployment protection on that environment 3. Let the agent apply the policy after validation succeeds 4. Route the apply job through the protected environment 5. Record approval evidence in the pull request or deployment timeline 6. Grant broad write permissions to simplify the workflow

The correct sequence ensures human oversight and traceability for sensitive changes. First, create a protected environment (1) to isolate the regulated deployment. Then, enforce reviewer approval or deployment protection on this environment (2), requiring human sign-off before any changes can proceed. Next, route the agent's apply job through this protected environment (4), ensuring it cannot bypass the required approvals. Finally, record approval evidence (5) in the pull request or deployment timeline, providing a clear audit trail. Option 3, "Let the agent apply the policy after validation succeeds," is incorrect because it bypasses human approval. Option 6, "Grant broad write permissions to simplify the workflow," is incorrect as it undermines security and control, which is contrary to the requirement for regulated files.