A team deploys an agent to handle routine infrastructure changes — updating environment variables and rotating non-critical secrets. They want human-in-the-loop oversight without blocking the rest of the CI/CD pipeline when a reviewer is unavailable. Which design best achieves both goals?
Select an answer to reveal the explanation.
Short Explanation and Infographic
A food truck doesn't close the grill while waiting for the health inspector to finish their walk-through — the inspector works in parallel. Human-in-the-loop doesn't have to mean blocking everything. An async approval workflow lets the main pipeline keep moving while a reviewer signs off on the agent's work on their own schedule, with an escalation path if they go quiet.
Full explanation below image
Full Explanation
Human-in-the-loop (HITL) oversight and delivery pipeline velocity are often perceived as conflicting goals — but a well-designed asynchronous approval workflow resolves this tension without sacrificing either.
Option C is correct. A parallel approval workflow decouples the human oversight gate from the main pipeline critical path. The main pipeline (tests, builds, deployments of other components) continues unblocked. The agent's infrastructure changes are held in a pending state, waiting for explicit reviewer sign-off. A configurable timeout with escalation (e.g., after 2 hours without a response, escalate to a secondary reviewer or auto-approve if the change is below a defined risk threshold) ensures that reviewer unavailability does not cause indefinite blocking. This design is used in mature GitOps workflows (e.g., Atlantis, Spacelift) and gives teams confidence that changes are reviewed without creating a pipeline bottleneck.
Option A is incorrect. Blocking the entire pipeline for reviewer availability is exactly the tradeoff the question asks you to avoid. If an on-call engineer is unavailable (attending an incident, in a meeting, asleep in a different timezone), the pipeline stalls for all work — not just the agent's changes. This design destroys velocity and creates a single point of failure.
Option B is incorrect. Post-execution reporting with no approval gate eliminates the human-in-the-loop requirement. An awareness notification is not oversight — it is notification of a done deed. If the agent made an error, the change is already applied by the time anyone reads the report. This design prioritizes velocity at the complete expense of safety.
Option D is incorrect. Separating review requirements by change type (env vars vs. secrets) without considering reviewer availability does not solve the pipeline-blocking problem. If a reviewer is unavailable and a secret rotation is queued, the pipeline still blocks. Additionally, the question asks for a design that handles reviewer unavailability — option D does not address this dimension at all.
Key principle: human oversight and delivery speed are not mutually exclusive. Async approval workflows with escalation paths are the standard pattern for achieving both in agentic CI/CD pipelines.