Implement Guardrails and Accountability
This domain tests your ability to design, configure, and justify guardrail and human-in-the-loop (HITL) systems within GitHub Copilot agents and agentic AI workflows. It covers risk classification, autonomy-level assignment, permission scoping, irreversibility controls, and the trade-off between approval overhead and execution velocity. The domain carries 10% of the exam weight, meaning roughly 4–6 questions on a standard sitting. Questions typically present a scenario with competing constraints (speed vs. compliance, security vs. productivity) and ask you to select the correct autonomy level, approval gate, or permission scope.
Classifying Agent Actions by Operational, Security, and Compliance Risk
Core Classification Framework
Every action an agent can perform must be classified before an autonomy level or guardrail can be assigned. The exam tests three risk axes:
| Axis | Low Risk | Medium Risk | High Risk |
|---|---|---|---|
| Operational | Read logs, run unit tests, suggest code | Open PRs, modify config files | Deploy to production, restart services |
| Security | Read public repos | Write to private repos, add secrets | Modify IAM roles, expose credentials, exfiltrate data |
| Compliance | Read non-PII data | Process PII, generate audit logs | Delete audit logs, violate data residency, export regulated data |
Risk Dimensions to Memorize
- Reversibility: Can the action be undone without loss? Irreversible actions carry elevated risk regardless of operational severity.
- Blast radius: How many systems, users, or records are affected if the action fails or is malicious?
- Data sensitivity: Does the action touch PII, secrets, financial records, or regulated data (HIPAA, GDPR, SOC 2)?
- External exposure: Does the action cross a trust boundary (internal → internet, private → public)?
Common traps
- Confusing operational risk with security risk. A deployment action is high operational risk AND potentially high security risk — they are not the same axis.
- Treating read-only actions as automatically low risk. Reading a secrets vault is high security risk even though no data is written.
- Assuming reversibility is binary. Partial reversibility (e.g., a database migration that can be rolled back with data loss) is treated as irreversible for guardrail purposes.
- Ignoring compliance risk for actions that seem purely technical (e.g., copying a database table for testing may expose PII).
Worked Scenario
Requirement: An agent is configured to automatically rebase feature branches and push the result. Classify this action.
Reasoning: Rebasing rewrites commit history (partial irreversibility if the branch is shared). It touches the codebase (medium operational), does not directly expose secrets (low-medium security), and does not process regulated data (low compliance). Final classification: medium risk, requires policy guardrail, not full HITL unless force-pushing protected branches.
Assigning Autonomy Levels to Maximize Delivery Speed While Remaining Compliant
Autonomy Level Taxonomy
The exam uses a four-tier autonomy model. Know these names and boundaries precisely:
| Level | Name | Agent Behavior | Typical Use |
|---|---|---|---|
| L0 | Suggest Only | Agent produces output; human manually applies it | Security-sensitive code changes, policy documents |
| L1 | Assisted Execution | Agent executes but pauses at each step for confirmation | Complex multi-step refactors, first-time workflows |
| L2 | Supervised Autonomy | Agent executes within a defined policy envelope; logs everything; notifies on exceptions | CI/CD automation, test generation, dependency updates |
| L3 | Full Autonomy | Agent executes end-to-end without real-time human review | Fully reversible, low-blast-radius, pre-approved action classes |
Key rule: Autonomy level is assigned to an action class, not to an agent globally. The same agent can operate at L3 for reading logs and L0 for modifying branch protection rules.
Bold decision rule for the exam: When a question asks which level "maximizes delivery speed while remaining compliant," the answer is the highest level whose risk classification does not require a lower level — never higher.
Caption: Decision tree for mapping risk classification to autonomy level assignment.
Common traps
- Assigning L3 to an action class because the individual step is low risk, while ignoring that it is part of an irreversible sequence.
- Confusing L1 (Assisted Execution) with HITL. L1 pauses at every step; HITL is a specific gate at defined checkpoints — these are not synonyms.
- Picking L2 when the action involves external trust boundary crossing — that requires at minimum L1.
- Assuming that audit logging alone raises an L3 action to a compliant posture for compliance-sensitive data. Logging is a control, not a substitute for a lower autonomy level.
Unlock with a paid plan
8 more sections (about 2,782 words) continue below. Every paid plan unlocks all GH-600 study guides, the full question bank and mock exams, from $4.97/month.