An operations lead builds an automation that triages GitHub issues, labels bugs, and posts a Slack update. The automation must search code, edit labels, and send messages with least privilege. Which approach should the lead use to select and configure tools within automations?

The correct approach aligns tool selection directly with the stated tasks while enforcing least privilege, because triaging issues requires issue access, labeling bugs requires label write access, investigating context requires code search, and notifying the team requires Slack messaging, and scoping each permission to only the target repository and channel prevents unnecessary exposure. The workspace-wide permissions variant is commonly used to simplify reuse across projects but fails the least-privilege concept by granting broader access than this single automation needs, increasing blast radius if credentials leak. The variant that enables only issue, code search, and Slack access respects scoping but fails the functional completeness concept because without the label tool the automation can read and discuss issues yet cannot apply bug labels as required. The variant that enables only issue, label, and Slack access similarly respects scoping but fails by omitting code search, leaving the automation unable to perform the required code investigation before triage. As an exam caveat, prioritize exact verb-to-tool matching over attractive efficiency or reuse arguments when the stem explicitly states least privilege, since convenience distractors often add broad scopes or drop a less obvious tool. As a practical check, open the automation tool and permission panel before deployment and confirm that the four required capabilities are present and each scope is limited to the intended repository, labels, and Slack channel with no extra permissions retained.