A cleanup agent is granted permission to delete stale branches. It reads a list of branches and immediately begins deleting them — including a branch named 'release-candidate-2.1' that is 47 days old. The deletion triggers a production incident because the branch was being used as the source for an active hotfix. Which architectural pattern would have prevented this incident?
Select an answer to reveal the explanation.
Short Explanation
Think like the surgeon who skips the chart and cuts first — bad outcomes follow. You need the plan-then-execute pattern with the human review gate before deletion. Naming rules, age thresholds, and off-peak runs don't stop immediate irreversible action.
Full Explanation
The core failure here is that the cleanup agent collapsed planning and execution into one uninterrupted action sequence. This violates the plan-execute separation principle, one of the foundational guardrails in agentic AI architecture.
Why the plan-then-execute pattern is correct: Separating the agent's run into two distinct phases — the read-and-plan phase followed by the human-reviewed execution phase — inserts the critical safety gate before irreversible actions. The agent produces the structured deletion plan artifact (the list of branches it intends to delete with metadata: age, last commit, open pull requests, etc.) and halts. The human or automated policy engine reviews the plan, removes any branches that should be exempt, and approves execution. This pattern catches edge cases like 'release-candidate-2.1' that pass the numeric threshold but fail the broader contextual review.
Why stricter branch naming conventions are wrong: Better branch naming conventions reduce ambiguity for human readers but do not prevent the agent from blindly applying the date-based filter. The agent deleted 'release-candidate-2.1' not because the name was ambiguous, but because it acted without the confirmation step. Naming is hygiene, not the safety gate.
Why the 90-day staleness threshold is wrong: Adjusting the staleness threshold from 47 to 90 days would have spared this specific branch by coincidence — but the same incident could happen to the 91-day-old release branch in the next cycle. Threshold tuning addresses the symptom, not the architectural vulnerability of acting without the review step.
Why off-peak scheduling is wrong: Timing the agent run for off-peak hours reduces the blast radius (fewer people actively working) but does not prevent the deletion itself. The deleted branch is equally gone at 3 AM as at 3 PM. Off-peak scheduling is the operational consideration, not the architectural guardrail against irreversible autonomous action.