A team wants Copilot-generated pull requests to run fast validation automatically. Human approval should be required only when the PR touches high-risk paths such as .github/workflows/**, src/auth/**, or src/payments/**. The workflow should run on pull requests to main and only read repository contents. Which option completes the workflow?

name: risk-scoped-agent-review

on:
  (Missing value 1):
    branches:
      - main

permissions:
  contents: (Missing value 2)
  pull-requests: read

jobs:
  classify-risk:
    runs-on: ubuntu-latest
    outputs:
      high_risk: ${{ steps.paths.outputs.high_risk }}
    steps:
      - uses: actions/checkout@v4
      - id: paths
        uses: dorny/paths-filter@v3
        with:
           filters: |
             high_risk:
               - '.github/workflows/**'
               - 'src/auth/**'
               - 'src/payments/**'

   require-review:
     needs: classify-risk
     if: (Missing value 3)
     runs-on: ubuntu-latest
     steps:
       - run: echo "High-risk Copilot change requires maintainer review."