A Responsible AI principle states that AI systems should be transparent and explainable to users affected by their decisions. A code-review agent is being designed that will automatically approve or block pull requests based on quality and security criteria. Which architectural decision best implements the transparency principle for this agent?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Transparency means the person affected by an AI decision can understand why it was made and what to do about it. 'Your PR was blocked' is not transparency. 'Your PR was blocked because file auth.py line 43 uses MD5 for password hashing (CWE-327, severity:critical) — replace with bcrypt' is transparency. The correct answer is B.
Full explanation below image
Full Explanation
The Responsible AI transparency principle, as applied to agentic systems, requires that affected parties can understand the basis for the agent's decisions. For a code-review agent, this means the developer whose PR is evaluated must be able to understand: what the agent evaluated, what it found, why it approved or blocked, and what they can do to resolve blocking issues.
A structured comment on the PR serves as the transparency artifact. For blocking decisions, it should include: the specific finding (file path, line number), the rule or criterion violated, the severity classification, a brief explanation of why this is a problem, and (where possible) remediation guidance or a link to documentation.
For approval decisions, the comment should cite the criteria verified (test coverage thresholds met, no high-severity findings, no secrets detected, etc.) so the team builds trust in what the agent is checking.
This also serves a compliance purpose: the comment is an immutable record (in the PR timeline) of why each decision was made, creating an auditable decision log.
Option A is incorrect because requiring developers to dig through workflow run logs is not transparency — it is obscurity. The logs may be verbose and hard to navigate, and many developers will not know where to look. Transparency requires the explanation to reach the person who needs it.
Option C is incorrect because a generic message with a link to a standards document fails the explainability test — it tells the developer that some standard was violated but not which one or where, forcing them to guess.
Option D is incorrect because the transparency principle explicitly rejects black-box operation for systems that make decisions affecting people. The concern about 'gaming' is addressed by evaluating the actual code quality outcomes, not by hiding criteria.