A technical project manager designs human review for a Copilot agent that touches customer data, third-party APIs, and production configs. Security wants minimal exposure, auditability, and secret safety. Which security consideration best shapes the human-review design?

The design that scopes data and tool access minimally, protects secrets, and requires human approval with audit logs fits the risks of handling customer data, third-party APIs, and production configs. Least-privilege scoping limits the blast radius; vaulted secret handling with runtime injection helps prevent credential disclosure; and approval before high-impact actions, paired with audit logs, provides preventive control and accountability. Protecting secrets in a vault and requiring approval with detailed audit logs still fails to limit exposure: without minimal scoping, an approved action may read or affect more than necessary. Minimal scoping, vaulted secrets, and audit logs without approval fail on prevention: logs record autonomous execution after the fact but cannot stop an erroneous API call or config change. Minimal scoping and human approval with audit logs, without explicit secret protection, fail on credential safety: secrets can leak through prompts, traces, or files even when access and review are otherwise sound. An exam caveat is to distinguish detective controls, which record activity, from preventive controls, which gate it; auditability does not replace approval for high-impact operations. In practice, map each tool to allowed data fields and write scopes, store keys in a managed vault with short-lived tokens, require approval for external and production writes, and sample audit trails to confirm the approver, context, and outcome are reconstructable.