A team is designing the autonomy policy for their CI/CD agent. They are considering three actions and two proposed assignments: (A) branch creation — fully autonomous, (B) pull request merge — human-in-the-loop review required, (C) production deployment — explicit human approval required before action. Which statement BEST describes this autonomy assignment?
Select an answer to reveal the explanation.
Short Explanation
You've matched the autonomy level to the risk: branch creation is low-risk and reversible, so it can run fully autonomous. Pull request merges need a human in the loop, and production deployments need explicit approval. That's exactly how you scale oversight with potential damage.
Full Explanation
The autonomy assignment in the question correctly implements the principle of proportional oversight: the level of human involvement in an agent's decision should scale with the risk and irreversibility of the action.
Branch creation — fully autonomous: Creating a branch is low-risk and fully reversible. An agent creating branches for its own work is standard operating procedure that requires no human gate. Requiring human approval for branch creation would create unnecessary friction with minimal safety benefit.
Pull request merge — human-in-the-loop review: Merging a pull request integrates agent-generated code into the main codebase, where it will affect other developers and downstream systems. Having a human review the pull request before merge allows catching logical errors, design issues, and unintended side effects that automated tests might miss. The human is in the decision loop but doesn't need to initiate the process.
Production deployment — explicit approval required: Production deployments affect live users and carry the highest blast radius of the three actions. Requiring an explicit named human approval (not just review) before deployment ensures a conscious, accountable decision is made before live impact occurs.
Why the other statements fail: - The claim that branch creation should require human approval because it could introduce untested code applies excessive caution to the lowest-risk action. Branch creation cannot affect production, break other developers' work, or modify shared history. It is the prototypical fully-autonomous agent action. - The claim that all three actions should be fully autonomous to maximize agent efficiency removes human oversight from pull request merge and production deployment. Continuous integration checks verify functional correctness but cannot substitute for architectural judgment, design review, or accountability for live deployments. - The claim that pull request merge should be fully autonomous since automated continuous integration checks already validated the code assumes that passing checks means the code is safe to merge. Those checks validate test outcomes but not code quality, security patterns, architectural alignment, or team conventions. Automated checks are necessary but not sufficient for merge gates.
Proportional autonomy assignment is the core principle of responsible agent design: match the oversight level to the consequence level.