Audit log streaming is the correct choice because it exports audit events to an external destination where the organization can apply its required two-year retention policy. This captures agent-initiated activity as part of the organization's auditable GitHub events.
Standard audit-log retention in GitHub may not meet a long-term evidence requirement on its own. Streaming allows the organization to store and search the exported events in a SIEM, data lake, or logging platform with retention controls aligned to compliance policy.
Log forwarding is not the required GitHub audit mechanism in this scenario. Enabling Git events can increase event visibility, but it does not independently provide the requested long-term retention of all relevant agent-initiated actions.
The external destination should preserve actor details, timestamps, repository identifiers, action types, and correlation information needed to reconstruct agent activity during an investigation.
Study-guide topics: accountability, audit log streaming, retention, and agent activity traceability.