A platform team is designing a graduated autonomy program for a dependency-update agent. In Phase 1, the agent proposes PRs for human approval. In Phase 2, it can auto-merge PRs that pass all CI checks. In Phase 3, it is allowed to tag and release patch versions. Which condition MOST appropriately gates the transition from Phase 2 to Phase 3?
Select an answer to reveal the explanation.
Short Explanation
You don't earn release authority just by clocking time or passing CI. You need a documented 90-day Phase 2 track record with zero production incidents from auto-merged changes, plus a human release manager's approval, because releasing software puts changes in front of customers.
Full Explanation
Graduated autonomy programs must gate each phase transition on evidence that directly corresponds to the new power being granted. Phase 3 is not merely merging code; it is cutting a release and pushing an artifact that customers will receive, which is a qualitatively higher-stakes action. The condition requiring a documented 90-day track record in Phase 2 with zero production incidents attributable to the agent's auto-merged changes, and approval from a human release manager for Phase 3 activation, is correct because it combines three essential elements: a meaningful observation window long enough to capture diverse dependency types and edge cases; a zero-production-incident requirement, which is the right outcome metric for whether the agent is safe to trust with more power; and explicit human authorization, which maintains accountability, ensures the transition is a deliberate decision rather than an automatic promotion, and creates a governance artifact. The condition based only on the agent operating in Phase 2 for at least 30 calendar days is insufficient because it is purely time-based with no quality bar. An agent could spend 30 days merging changes that caused silent regressions caught only in production. Duration without outcome data tells you nothing about readiness. The condition based on the CI pipeline passing at a rate above 95% across the agent's PRs in Phase 2 is tempting because CI pass rate is a real signal, but it measures whether tests pass before merging, not whether merged changes caused problems in production. An agent could consistently pass CI and still ship changes that degrade performance, break integrations, or create supply-chain risks. The condition based on an engineering manager submitting a ticket requesting Phase 3 activation and the platform team completing it within the next sprint is a process formality without any quality gate. It relies entirely on organizational process rather than agent performance data, and the engineering manager's confidence is not evidence of agent safety.