Escalation + traceability/accountability

The idea, in plain English

Two official sub-skills:

• Escalation paths — route a decision back to a human when the agent shouldn't decide alone.
• Traceability + accountability — make every agent action visible, attributable, and reviewable after the fact.

These are the human-in-the-loop and after-the-fact halves of safety (2.7 was the in-the-moment half).

Escalation — hand it back to a human

• The PR is the primary escalation/review gate. The agent proposes; a human (and required checks) review and approve before merge. It never decides "ship to main" alone (2.6).
• Environment protections are the enforcement point for sensitive ops — they require approvals (required reviewers) and protect sensitive operations before a job proceeds. This is where "ask a human" is enforced for prod-grade actions.
• In-run escalation: a preToolUse/permissionRequest hook can deny + interrupt to stop and hand back; the notification hook alerts a human (e.g. agent_idle = waiting) — though it doesn't fire in the cloud agent.
• Principle (1.4/1.5): escalate after repeated failure or when criteria are unclear — don't loop or guess.

Traceability + accountability — the record

Because every API call is authenticated, every agent action is permission-controlled and leaves an audit trail — the foundation of accountability. The records:

Worked example — autonomous, accountable, escalatable

---
on: { schedule: nightly }
permissions: { contents: read, pull-requests: write }
environment: production      # ← environment protection: required reviewers must APPROVE
safe-outputs: { create-pull-request: true }   # proposes a PR; never merges itself
---
Propose dependency bumps as a PR.

Read it as a sentence: "Run nightly, open a PR (never merge), and gate anything touching production behind required-reviewer approval."

The cert-language version

Escalation routes decisions back to a human — the PR review gate and environment protections (required approvals for sensitive operations) are the enforcement points; hooks can interrupt/notify to hand back. Traceability/accountability follows from every action being authenticated → permission-controlled → audited: the session log, workflow run logs, the PR, and artifact attestations together let you attribute and review every agent action.

Our summary · grounded in MS Learn — Agent tooling, MCP, and execution environments (+ Knowledge Check) + GitHub Docs (Copilot CLI/hooks, artifact attestations, environments) · fetched 2026-05-30

Common confusions (read these or lose points)

• "Escalation = the agent retries harder." No — escalation is handing back to a human (PR review, required approvals), not looping. Retrying is 2.7.
• "The audit trail is optional." No — it's automatic: every action is authenticated and logged. That's what makes agents accountable.
• "Environment protections are about secrets only." Their role here is to require approvals and protect sensitive operations — the enforcement point for human sign-off.
• "The session log is the record of record." The PR is the durable, reviewable record of what changed; logs + attestations support it.
• "notification hooks work in the cloud agent." No — notification does not fire in the cloud agent.