A program manager owns a customer feedback triage agent that must run each weekday morning, read only support issues, and post a labeled digest to one repository. Security forbids broad write access or unreviewed outputs. Which configuration should the manager choose to set workflow schedule, permissions, and output for safe automation?
Select an answer to reveal the explanation.
Short Explanation
You're giving the agent a shift schedule and a hall pass, not master keys. Tight scoping keeps the digest timely and safe. It's like a mail clerk with access to one inbox and one bulletin board.
Full Explanation
The correct configuration aligns schedule, least-privilege permissions, and controlled output in one design: a weekday morning cron satisfies the run window without weekend noise, read-only access limited to issues enforces data minimization for triage, and a labeled digest scoped to a single repository ensures predictable, auditable publishing that respects the ban on broad write and unreviewed automation. The daily alternative fails on scheduling precision because running every calendar day adds weekend executions, extra token use, and unexpected digests that violate the weekday-only mandate even though permissions and destination are correct. The read-all repository alternative fails on permission scope because expanding from issues to full repository content violates least privilege and exposes code, pull requests, and secrets beyond the support-issue need despite keeping timing and single-repo output intact. The every-team-repo alternative fails on output containment because fan-out publishing breaks the single-repository destination control, multiplying write surface, notification noise, and review burden even when timing and read scope remain proper. Exam caveat is to evaluate all three axes together rather than selecting a choice that satisfies two familiar best practices while quietly breaking the third, since distractors often use plausible daily triggers, broad read convenience, or multi-repo reuse. Practical check is to inspect the workflow file for the weekday cron expression, confirm the token or permission block allows issues read with no write grants, and run a dry-run to verify the labeled digest renders and posts only to the designated repository with required review before enablement.