An organization operates in a regulated industry (healthcare, HIPAA scope). They are planning an agent that performs database schema migrations. Their compliance team requires that any schema change affecting tables that store PHI (Protected Health Information) must receive explicit human approval before execution. Which architecture planning decision correctly implements this requirement?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Logging after the fact and sending notification emails are not approval gates — they're paperwork. HIPAA doesn't accept 'we told someone it happened'; it requires explicit prior authorization for changes to PHI systems. GitHub Environments with required reviewers create a hard workflow gate that the agent literally cannot bypass. The correct answer is C.
Full explanation below image
Full Explanation
HIPAA and similar healthcare regulations require that changes to systems handling PHI go through an authorization process before execution — not just notification. The key word is 'explicit human approval,' which means the workflow cannot continue without a documented human decision to proceed.
GitHub Environments with required reviewers implement this as a hard technical control: when the migration workflow reaches the deployment step that targets the 'PHI-tables' environment, the workflow pauses and requires approval from at least one designated reviewer before any commands run. The agent cannot bypass this pause; it is enforced by the GitHub Actions platform.
The design requires two architectural decisions: (1) the agent must classify each migration by the tables it touches and determine whether any are in the PHI-table category, and (2) PHI-touching migrations must be routed to a job that targets the protected environment, while non-PHI migrations can proceed to a non-protected environment.
This creates the required prior authorization record: the GitHub environment approval log shows who approved, when, and for which workflow run — a compliance-ready audit trail.
Option A is incorrect because logging after execution does not provide prior authorization. The migration has already run when the log entry is created. This is a documentation requirement, not an authorization control.
Option B is incorrect because email notification is advisory, not a blocking gate. The agent can continue executing whether or not anyone reads or responds to the email. HIPAA requires authorization, not notification.
Option D is incorrect because limiting permissions prevents the agent from working on PHI tables at all, eliminating the agent's utility for the PHI migration use case. The requirement is controlled access with human approval, not prohibition.