An engineering team is deploying two GitHub Copilot agents in their pull request pipeline: Agent A posts automated code quality feedback comments on open PRs, and Agent B merges approved PRs into the main branch when certain criteria are met. How should the autonomy degree differ between Agent A and Agent B?
Select an answer to reveal the explanation.
Short Explanation and Infographic
A crossing guard can stop traffic autonomously all day, but a bridge operator always gets radio confirmation before raising the drawbridge — the stakes determine the autonomy level. On the GH-600 exam, Domain 1 requires matching the degree of autonomy to the reversibility and blast radius of each action. Commenting is low-risk and easily corrected; merging to main affects every engineer on the team and may be harder to undo.
Full explanation below image
Full Explanation
Domain 1's implement autonomy degrees objective requires that agents operate at a level of autonomy proportional to the risk, reversibility, and blast radius of their actions.
Agent A — Code Review Comments: Posting feedback comments on a pull request is a low-risk, reversible action. If a comment is incorrect or unhelpful, it can be deleted or corrected with minimal impact. The action affects only the PR discussion thread, not the codebase itself. This class of action is appropriate for high autonomy — the agent can act without waiting for human approval on each comment.
Agent B — Merging to Main: Merging a PR into the main branch is a fundamentally different action. It modifies the shared production branch, making it immediately visible to all team members and downstream CI/CD pipelines. If the merge is incorrect — wrong branch, wrong timing, unexpected conflicts — the damage propagates quickly. Reverting a merge is possible but disruptive and not always clean, especially when other work has been committed on top of the merge commit. This is exactly the class of action that requires an explicit human approval checkpoint.
Why (a) is wrong: Full autonomy for both agents ignores the risk differential. Agent B's merge action is not equivalent to Agent A's comment action, and treating them at the same autonomy level violates the Domain 1 principle of matching autonomy to risk.
Why (b) is wrong: Requiring human approval for every comment Agent A posts adds friction without proportional safety benefit. The goal is calibrated autonomy, not maximum restriction across the board.
Why (d) is wrong: 'Well-defined and deterministic' describes the technical operation, not the business risk. A deterministic operation can still have a large blast radius if it modifies a shared resource. Merge criteria being defined does not eliminate the need for human approval.
Why (c) is correct: Autonomy degree is matched to action risk and reversibility. Comments are low-risk and high-autonomy; merges to main are high-risk and require human approval.