A compliance program manager oversees a policy-docs repo where Copilot agents and contractors propose updates. Leadership requires no direct pushes to main, peer review of every change, and automated checks before merge. Which branch strategy and policy should the manager recommend to enforce reviewed agent changes?

Short-lived feature branches with pull requests into protected main are the right strategy: branch protection blocks direct pushes, required peer reviews cover every agent and contractor change, and required passing checks gate the merge. Short-lived branches also keep review scope small and auditable. Requiring checks only at the release stage is useful release management, but it fails the before-merge requirement: the code has already reached main, so defects or policy violations must be reverted rather than prevented. Requiring passing checks with owner auto-approval can reduce friction for bot workflows, but automatic approval is not independent peer review of each change’s correctness, compliance, and risk. Pull requests with reviews and passing checks but no branch protection preserve a useful workflow, yet the no-direct-push rule depends on discipline; direct pushes remain technically possible and unaudited. For exams, distinguish enforcement location and timing from sound practices elsewhere: release validation or auto-approval does not satisfy a merge-time control requirement. As a practical check, inspect main’s protection rules to confirm direct pushes are blocked, the required reviewers are specified, stale reviews are dismissed, and required status checks must pass before merging.