A 200-person fintech has an organization policy that allows only approved Copilot agents, blocks public repo data for suggestions, and requires audit logging for agent actions. Luis wants to prototype a support triage helper. Which approach best adheres to organizational standards when using Copilot and agents in this regulated setting?

The compliant path requires satisfying all three controls together: approved-tool governance, private-only suggestion context, and auditable execution, which the correct choice does by restricting work to the sanctioned agent and the logged workspace. The community-agent prototype fails on governance because marketplace popularity does not equal organizational approval, and in a regulated fintech unvetted agents can introduce unreviewed data handling or permissions even when logging and private context are otherwise correct. The public-suggestions variant fails on data boundary because enabling repository-wide context for better completion quality directly violates the block on public repo data, a common performance-versus-policy tradeoff where improved relevance does not excuse exfiltration or IP risk. The separate unlogged workspace variant fails on auditability because moving approved work with private suggestions outside monitored infrastructure breaks traceability for incident review and regulatory attestation, even though tool choice and data source look correct. An exam caveat is that partially compliant answers are intentionally attractive, so select only the answer that meets every stated policy element rather than the most efficient engineering workflow. As a practical check before building, verify the agent ID in the approved catalog, confirm exclusion of public code is enforced, and confirm actions appear in the audit log with a test run.