A GitHub Copilot agent can perform the following actions: (1) read repository files, (2) create a branch, (3) deploy to production, and (4) write a new secret to GitHub Secrets. How should these actions be classified by risk level?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Reading a file is like peeking in a window — low stakes. Creating a branch is opening a door — modest stakes. Deploying to production is turning on a nuclear reactor — high stakes. Writing a secret is handing out master keys — critical stakes. Risk scales with irreversibility and blast radius.
Full explanation below image
Full Explanation
Agent actions must be classified by their operational, security, and compliance risk to determine the appropriate level of oversight and approval required.
Why B is correct: - Read repository files (low): Read-only, no side effects, easily reversible by doing nothing. - Create a branch (low-medium): Mutable but easily deleted, no production impact, isolated from main. - Deploy to production (high): Potentially affects end users, may be difficult to roll back instantly, compliance risk. - Write a secret to GitHub Secrets (high/critical): Irreversible credential exposure risk, security/compliance impact, extremely difficult to fully audit if the secret is misused.
Why A is wrong: Repository interactions vary enormously in risk. Treating all repository actions as equally risky leads to either under-controlling dangerous actions or over-controlling safe ones.
Why C is wrong: Branch creation is a low-medium risk action. The idea that creating a branch is the riskiest action ignores the much greater risks of production deployment and secret management.
Why D is wrong: The reversibility of production deployments depends on the application — many production deployments involve database migrations or external API calls that cannot be instantly rolled back. Secrets that have been exposed cannot be 'unread' by unauthorized parties, even if rotated afterward.