A security engineering team is rolling out Copilot cloud agent across several repositories. They need a repeatable process for deciding when the agent can act autonomously, when it can only prepare a draft pull request, and when a human must approve privileged execution. Which four actions should you perform in order? 1. Map repository paths to operational, security, and compliance impact 2. Enable automatic workflow execution for every Copilot PR 3. Define allowed actions for each autonomy level 4. Attach human approval gates to high-risk transitions 5. Validate the policy with sample Copilot-created PRs 6. Remove required checks for low-risk documentation updates

The correct order prioritizes understanding risk before defining actions and approvals. First, map repository paths to operational, security, and compliance impact (1) to understand the sensitivity of different code areas. This foundational step informs subsequent decisions. Next, define allowed actions for each autonomy level (3). Based on the impact mapping, you can specify what Copilot can do autonomously versus what requires human intervention. Then, attach human approval gates to high-risk transitions (4). This implements the defined autonomy levels by ensuring critical changes are reviewed. Finally, validate the policy with sample Copilot-created PRs (5) to ensure the rules work as intended in practice. Option 1 is incorrect because enabling automatic workflow execution for every PR (2) is too permissive and bypasses the necessary risk assessment and policy definition. Option 4 is incorrect because starting with approval gates (4) before understanding repository impact (1) or defining actions (3) is premature and unstructured. Removing required checks (6) is a specific optimization that comes much later, after a robust policy is established and validated.