A business analyst supervises a Copilot coding agent that drafted release notes, updated API docs, and proposed database migration scripts for a fintech app. Compliance requires accuracy, safe SQL, and no leaked secrets before merging to main. Which practice best reviews agentic workflow outputs for accuracy and safety?

The correct practice is right because it enforces human review of agentic outputs across all compliance risks before main is updated: manual diff inspection catches hallucinated release notes, unsafe SQL patterns, and accidental secret exposure that automation alone can miss, validating claims against linked issues and tests ensures accuracy to requirements rather than plausible text, and blocking merge until checks pass enforces the required preventive gate. The approach that approves merge while safety and secret scans are still running fails on sequencing and control timing, since compliance requires verification before merge and post-merge detection leaves main contaminated and forces revert and secret rotation. The approach that checks SQL and secrets and blocks merge but skips claim validation fails on accuracy and traceability, since safe and secret-free code can still misdescribe features, APIs, or migration effects and violate documentation truthfulness. The approach that validates claims and relies only on automated scans while blocking merge fails on depth of review, since scanners miss business logic errors, subtle destructive SQL, and context-dependent leaks that explicit diff inspection must catch. On exams, do not select a choice merely because it mentions scans and gates; every element of accuracy, safety, secrets, manual review, and pre-merge blocking must be present. In practice, open the pull request diff, cross-check each note and doc change to its issue and test result, run SQL lint, secrets detection, and CI, and keep branch protection that prevents merge until all required checks succeed.