A team wants Copilot to help fix failed checks on pull requests. The guardrail requirement is that Copilot may propose and commit fixes, but humans must decide whether security-sensitive changes are ready to merge. Which four actions should you perform in order? 1. Require CODEOWNERS review for sensitive paths. 2. Let Copilot bypass required reviews on bot PRs. 3. Configure required checks for automated validation. 4. Merge the PR when Copilot comments are resolved. 5. Ask Copilot to address review feedback on the PR. 6. Review the diff and approve only acceptable changes.

The correct order ensures a secure and efficient workflow for Copilot-assisted pull request fixes. First, "Configure required checks for automated validation" (3) establishes initial quality and security gates that Copilot's proposed fixes must pass. Next, "Require CODEOWNERS review for sensitive paths" (1) implements the critical human guardrail, ensuring security-sensitive changes always get human eyes before merging, even if Copilot proposes them. Then, "Ask Copilot to address review feedback on the PR" (5) leverages Copilot's ability to iterate on its suggestions based on human input. Finally, "Review the diff and approve only acceptable changes" (6) represents the human decision point, where the team member evaluates Copilot's final proposed changes, especially those in sensitive areas, before allowing the merge. The other options are incorrect because they either misorder these steps, omit crucial human review for sensitive changes, or incorrectly suggest merging before proper human approval. For example, letting Copilot bypass required reviews (2) would violate the security guardrail.