A deployment orchestrator agent determines that a hotfix is ready and instructs a deployment worker agent to deploy directly to the production environment. The worker agent has the technical capability to execute the deployment. No human has been notified. Which accountability principle is violated, and what is the correct design?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Two employees agreeing among themselves to unlock the safe does not count as management authorization — the authorization chain must reach a human with actual authority. On the exam: production deployments are irreversible actions that require human authorization in the chain, even when an orchestrator agent has already approved them.
Full explanation below image
Full Explanation
Production deployments are irreversible actions — they change the live environment, expose new code to users, and can cause outages that are not trivially undone. The core accountability requirement for irreversible actions is that human authorization must be in the approval chain. An orchestrator agent determining readiness and instructing a worker agent to deploy is entirely machine-driven authorization — two agents agreeing does not substitute for human judgment and accountability. Option C correctly identifies the violated principle and the fix: a human approval gate must be inserted before production deployments execute, regardless of the orchestrator's determination.
Option A (traceability) is a real principle but is not what is primarily violated here. Logs tell you what happened after the fact — they do not prevent unauthorized deployments. Adding logging improves accountability retrospectively but does not enforce the authorization requirement prospectively.
Option B (worker confirming with coordinator) adds an extra agent-to-agent handshake but still does not involve a human. Two agents confirming with each other does not satisfy the human authorization requirement for irreversible actions. The fix must bring a human into the approval loop, not just add another machine step.
Option D (revoking and re-granting permissions per deployment) is a creative interpretation of least-privilege but is not the primary principle violated here. The issue is the absence of human authorization, not the scope of the worker's permissions. Per-deployment permission grants would also require a human to grant them — which is essentially equivalent to option C — but option C more directly names the correct principle.