Ask why a working automation has not been switched on and the answer is almost never technical. It is that nobody was willing to be accountable for what it might do unsupervised, and no document existed that made that accountability specific enough to accept.
The three bands
| Band | Meaning | Typical examples |
|---|---|---|
| Autonomous | The system acts without a human in the loop and logs what it did. | Sending a reminder, capturing a status update, booking into an open slot, answering from approved content, writing an outcome to the CRM |
| Approval required | The system prepares the action; a named human releases it. | Payment plans beyond set limits, price quotes outside a band, anything sent to a regulator or a VIP account, first contact on a disputed account |
| Never automated | Reserved for humans regardless of confidence. | Clinical judgement, legal advice, termination or credit decisions, escalated complaints, anything where being wrong is not recoverable |
How to write one that survives contact with reality
The exercise fails when it is done from a process diagram. Real processes contain a long tail the diagram does not: the customer who calls back angry, the invoice that arrives without a purchase order, the candidate who needs the interview moved twice. Roughly 15–20% of real cases fall outside the documented path.
- Build it from an exception map, not a flowchart. Watch the work before you classify it.
- Write the escalation trigger as a number wherever you can — a value threshold, a sentiment signal, a retry count — not as a judgement call the system cannot make.
- Name the human, by role, for every approval band. An approval queue nobody owns is an outage waiting to happen.
- Decide what happens when the system is unsure. Silence is a decision, and usually the wrong one.
- Have the process owner sign it. If they will not sign, the process is not ready — and that is useful information, cheaply bought.
Why the boundary is also a commercial document
The two most public automation reversals of recent years — a fintech that rolled back chat automation on quality grounds and a bank that reinstated forty-five roles after call volumes rose — were both boundary failures rather than technology failures. In each case the system was doing work that needed judgement, and the organisation discovered the boundary after crossing it rather than before.
A boundary matrix is cheap insurance against being the next example.
