A program manager builds a custom release-notes agent for a 40-person product org. It must read issues and PRs, must never push code or merge, and must request approval before posting externally. Which guardrail setup best enforces safe limits for the custom agent?

The correct setup works because it translates all three business constraints into enforceable tool controls, granting read-only scopes for issues and pull requests for summarization while explicitly denying push and merge and gating external posting behind human approval, which enforces least privilege, prevents autonomous repository mutation, and preserves accountability across the 40-person org. The auto-publish after validation approach fails on authorization because automated checks can verify links or formatting but cannot substitute for required human judgment on accuracy, timing, and external messaging, so it violates the explicit approval requirement despite correct read and deny-write controls. The staging-branch push approach fails on containment because a narrowly scoped write is still a write, creating branch sprawl, history changes, and credential reuse risk while directly violating the never-push rule even though blocking merge and requiring approval are sound. The docs-only merge approach fails on separation of privilege because retaining any merge ability, even limited to documentation, leaves a high-impact mutation path the agent must never hold and undermines auditability of repository state. An exam caveat is that familiar hardening patterns with scoped tokens, CI gates, or docs-only exceptions remain wrong if they preserve a single forbidden capability, so verify every must, must-never, and approval clause rather than choosing the most secure-looking design. As a practical check, review the deployed tool allowlist, attempt push and merge in a sandbox tenant, and confirm that publish calls remain blocked and logged until a recorded human approval event occurs.