A 200-person fintech adopts Copilot and coding agents under SOC 2, requiring approved data handling, logged AI changes, and no customer data in public repos. Teams ship fast across 50 repos. Which practice best ensures adherence to organizational standards when using Copilot and agents?
Select an answer to reveal the explanation.
Short Explanation
You're keeping speed without skipping guardrails auditors love. Policy enforcement acts like lane markings on a fast highway, letting teams move quickly while staying compliant.
Full Explanation
The correct practice is right because it combines preventive and detective controls at scale: Copilot content exclusions keep designated customer-data files out of training context and suggestions, org policies enforce approved models and handling across all 50 repos, and required reviews for agent pull requests provide logged human accountability for SOC 2 while preserving fast shipping. Centralizing licenses with usage analytics and requiring human review for agent pull requests is common for governance and auditability, but it fails on prevention because without exclusions Copilot may still access restricted data. Standardizing approved models with private defaults and secret scanning is common for safe defaults and leak detection, but it fails on oversight because scanning after the fact does not satisfy the logged pre-merge review requirement for AI changes. Configuring exclusions per repository with careful reviews applies the right controls locally, but it fails on centralized enforcement because manual per-repo setup drifts quickly and cannot ensure consistent adherence in a 200-person organization. For exams, when the stem emphasizes organizational standards across many repos, favor centralized policy enforcement over locally correct but fragmented practices. As a practical check, confirm org settings show exclusion paths, model restrictions, and branch rules requiring review with retained agent attribution in logs.