A fintech product manager uses Copilot to draft payment validation logic, must keep customer data out of prompts, and requires a teammate to approve every AI suggestion before merge. Which human-review safeguard best addresses Copilot security considerations for sensitive code?

The correct safeguard is appropriate because payment validation logic is sensitive code where Copilot can reproduce hardcoded secrets, suggest insecure patterns, or reflect policy violations, so mandatory teammate review that explicitly checks for secrets, validates functional and security behavior, and confirms data-handling compliance satisfies both the no-customer-data-in-prompts constraint and the every-suggestion-needs-approval rule while creating an auditable merge gate. One plausible but incorrect safeguard requires teammate approval focused only on functional correctness and test coverage, which upholds the approval workflow yet fails as a security control because it omits secrets scanning and policy compliance and can allow keys or noncompliant logic to merge when tests pass. Another plausible safeguard emphasizes redacting customer data with careful self-review, which supports data minimization but violates the explicit teammate-approval requirement and weakens assurance because authors often miss their own leaked secrets and over-trust AI output. A third plausible safeguard retains teammate approval and compliance confirmation but relies on real customer payloads for verification, which directly violates the requirement to keep customer data out of prompts and expands exposure through telemetry, retention, or memorization. Exam caveat: distinguish general code-review quality from Copilot-specific security review, since approval for correctness alone does not equal review for secrets, provenance, and policy. Practical check: enforce sanitized synthetic examples in prompts, require checklist-based peer approval blocking merge, and scan diffs for secrets and policy exceptions before merge.