A market-insights manager wants a nightly competitive-summary agent that reads approved RSS feeds, needs only read access to one repo, and posts a structured brief as an issue. Which schedule, permissions, and output configuration should the manager select for least-privilege automation?

The correct configuration aligns schedule, least-privilege permissions, and required output with the business request: a nightly cron-style scheduled trigger satisfies the once-per-day competitive summary cadence without manual intervention, read-only access constrained to the single designated repository prevents unnecessary exposure of other code while still allowing the agent to persist logs, and structured issue output creates a trackable, assignable record for review. The event-driven trigger on each new RSS item is a sound pattern for real-time alerting but fails the timing concept here because it replaces a predictable nightly batch with unpredictable intraday runs, increasing cost, noise, and missed-summary risk if feeds update irregularly. The multi-repo discovery scope is commonly used for organization-wide audits but violates least-privilege for this task because it grants visibility beyond the one approved repo when only one repo is needed. The discussion-post output is widely used for collaborative commentary but fails the deliverable concept because discussions lack the triage workflow, assignment, and closure semantics the manager specified for the brief as an issue. An exam caveat is to distinguish functionally similar mechanisms by the stated constraint rather than by general best practice, since frequent polling, broader read scopes, and social outputs can look efficient but contradict explicit nightly, single-repo, or issue requirements. As a practical check before go-live, inspect the automation run history to confirm the cron fired overnight, the token shows read-only single-repo authorization, and the artifact appears as a formatted issue with attached run logs.