A repository team wants Copilot coding agent to work on low-risk implementation issues. The team wants visible progress in GitHub Issues and reviewable changes in pull requests. The main branch requires status checks, CODEOWNERS review, and one approving review. A developer suggests allowing Copilot-created pull requests to merge after the test job passes. Which option best implements controlled autonomy?

Requiring a draft PR review and all required checks provides controlled autonomy. Copilot can work on the issue and create a draft pull request, making its progress visible. The draft status prevents premature merging, allowing human review and collaboration before the code is finalized. All required branch protections, including status checks and CODEOWNERS review, are still enforced on the draft PR before it can be marked ready for review and eventually merged. Allowing merge after the first successful test run bypasses critical human review and CODEOWNERS requirements, leading to uncontrolled autonomy. Requiring only Copilot’s issue activity signal first doesn't provide a mechanism for code review or quality gates. Requesting Copilot review before branch checks run is not a standard GitHub feature for controlling merges and doesn't replace human oversight.