A cleanup agent is granted permission to delete stale branches. It reads a list of branches and immediately begins deleting them — including a branch named 'release-candidate-2.1' that is 47 days old. The deletion triggers a production incident because the branch was being used as the source for an active hotfix. Which architectural pattern would have prevented this incident?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Think of this like a surgeon who skips reviewing the patient chart and goes straight to the operating table — bad outcomes follow. Answer B is correct: the plan-then-execute pattern with a human review gate is the architectural fix. The agent should produce a deletion plan artifact first, a human approves it, and only then does execution begin. Naming conventions, thresholds, and scheduling don't address the fundamental risk of immediate irreversible action.
Full explanation below image
Full Explanation
The core failure here is that the agent collapsed planning and execution into a single, uninterrupted action sequence. This is a violation of the plan-execute separation principle, one of the foundational guardrails in agentic AI architecture.
Why B is correct: Separating the agent's run into two distinct phases — a read-and-plan phase followed by a human-reviewed execution phase — inserts a critical safety gate before irreversible actions. The agent produces a structured deletion plan artifact (a list of branches it intends to delete with metadata: age, last commit, open PRs, etc.) and halts. A human or automated policy engine reviews the plan, removes any branches that should be exempt, and approves execution. This pattern catches edge cases like 'release-candidate-2.1' that pass the numeric threshold but fail a broader contextual review.
Why A is wrong: Better branch naming conventions reduce ambiguity for human readers but do not prevent an agent from blindly applying a date-based filter. The agent deleted 'release-candidate-2.1' not because the name was ambiguous, but because it acted without a confirmation step. Naming is hygiene, not a safety gate.
Why C is wrong: Adjusting the staleness threshold from 47 to 90 days would have spared this specific branch by coincidence — but the same incident could happen to a 91-day-old release branch in the next cycle. Threshold tuning addresses a symptom, not the architectural vulnerability of acting without a review step.
Why D is wrong: Timing the agent run for off-peak hours reduces the blast radius (fewer people actively working) but does not prevent the deletion itself. A deleted branch is equally gone at 3 AM as at 3 PM. Off-peak scheduling is an operational consideration, not an architectural guardrail against irreversible autonomous action.