A team is defining escalation paths for agent-operated development workflows. Match each signal to the best escalation response. Which mapping is correct?

1. Copilot-created draft PR has failing required checks: The best response is to review failed checks before marking ready (A). This ensures human oversight addresses immediate issues before further integration. 2. Copilot CLI hook denies a high-risk Bash command: The appropriate action is to open an approval path with the denied command (B). This allows a human to explicitly approve or deny a potentially dangerous operation, maintaining security. 3. MCP server tools are missing from agent logs: Inspecting MCP startup and setup steps (C) is the correct response. This directly addresses the root cause of missing tools, ensuring the agent's environment is correctly configured. 4. Agent changes files outside acceptance criteria: The best response is to narrow the issue scope and request review (D). This focuses the agent's work and ensures human review catches deviations from requirements. Option E (Add pullrequesttarget to every workflow) is a security concern, not an escalation response. Option F (Re-run all jobs and merge on success) is premature without understanding the cause of failure.