A business analyst designs human review for a Copilot agent that drafts release notes and suggests database migration scripts from production schema samples. Reviewers must catch insecure code, leaked secrets, and over-permissive suggestions. Which security consideration should shape the human-review design for GitHub Copilot output?

The correct consideration applies because Copilot suggestions derived from production-adjacent context can plausibly contain hardcoded secrets, copyleft-licensed snippets, and insecure or over-permissive SQL and access patterns, so human review must explicitly verify output for those risks before merging rather than assuming fluency equals safety. The staging-correctness approach fails by concept of security versus functionality because passing tests for correctness and avoiding downtime does not detect leaked credentials, license obligations, or subtle injection and privilege flaws that still execute correctly. The release-notes clarity approach fails by concept of scope because improving accuracy and tone for documentation leaves the higher-risk migration scripts unexamined for vulnerabilities and over-permissive grants. The input-redaction approach fails by concept of input versus output controls because minimizing sensitive samples and retention is essential privacy hygiene but cannot guarantee generated code is free of memorized secrets, risky patterns, or licensing issues. An exam caveat is to distinguish preventing prompt exposure from validating generated artifacts, since the scenario specifically requires reviewers to catch flaws in what the model produces. A practical check is to enforce a pre-merge checklist with secret scanning, CodeQL or code scanning alerts triaged, license review, and least-privilege verification of every suggested script.