Every AI vendor pitch arrives with the same slide: a default position on automation. Some pitch full automation. Some pitch copilots. Some pitch chat. Whichever shape it takes, it's positioned as the right answer for whatever you're trying to do.
The pitch is the wrong shape. The right answer isn't a single point on the human-in-the-loop spectrum. It's a placement decision, made deliberately, for each workflow you're considering. Some workflows belong at full automation. Some belong at AI-suggests-only. Most belong somewhere specific in the middle.
Knowing where each workflow belongs, and why, is the actual work of deploying AI in business operations and finance ops. Vendors who skip that conversation and pitch a single point on the spectrum are selling you a shape that might not fit all your work.
The spectrum
There are five rough points on the spectrum, from least to most automated. Every AI workflow you're considering today belongs at one of them.
Five points on the automation spectrum
- 1Suggest. The agent flags something for human attention. The human takes the next step.
- 2Recommend. The agent proposes a specific action with reasoning. The human decides.
- 3Execute with approval. The agent takes the action only after a human confirms.
- 4Execute with exception review. The agent takes routine actions automatically and routes edge cases or high-stakes ones to a human.
- 5Execute autonomously. The agent takes the action and informs the human after the fact, or not at all.
Most workflows belong at points 2, 3, or 4. Very few belong at point 5. Surprisingly few belong at point 1.
The spectrum framing isn't new. Academic and product literature has been mapping AI agent autonomy levels for years, with names like Human-in-the-Loop, Human-on-the-Loop, and Human-out-of-the-Loop. The framework above is the operator version: shorter and sharper, oriented to the decision a buyer has to make next Tuesday rather than to taxonomy.
What goes wrong at each end
Push every workflow to point 5 and you create a trust crisis. The first time an AI agent autonomously reroutes a shipment that costs you a contract, or auto-approves a refund that turns out to be fraud, the business pulls the program. You can have audit logs ready for every action. The reaction is still going to be “we shouldn't have given the AI that authority.” That lesson burns more bridges than the savings buy.
Push every workflow to point 1 and the AI doesn't earn its keep. If the agent just flags things for the human to decide, and the human still does the diagnosis, the analysis, and the action, you spent a real budget and got a notification system.
Both ends miss. The work is matching each workflow to the level of autonomy its consequences actually justify.
A platform that can only do point 1 is a notification system. A platform that can only do point 5 is a liability machine.
How to decide
Four questions to ask of any workflow you're thinking about automating.
Four questions to place a workflow on the spectrum
Reversibility.
How easy is it to undo? A bad reroute can be fixed; a bad public message can't be unsent. More reversible actions allow for more automation.
Consequence.
How bad is a wrong call? Auto-flagging a measurement glitch is cheap; auto-paying a fraudulent invoice costs real money.
Frequency.
How often does it happen? Zone rebalances run hundreds per day; capitalization decisions, twice a year. High frequency → more automation.
Regulatory exposure.
Does it touch SOX, SOC 2, GDPR? If it needs an audit-relevant control, a human stays in the loop, regardless of how cheap or reversible it is.
A workflow with high reversibility, low consequence, high frequency, and no regulatory exposure sits at point 4 or 5. Automate broadly, route exceptions.
A workflow with low reversibility, high consequence, low frequency, and high regulatory exposure sits at point 2 or 3. The agent recommends, a human approves.
Most workflows fall somewhere in the middle and need the framework applied case by case. Treat this as a starting point, not a rule.
What this means for buying
When you evaluate an AI vendor, the right question isn't “how much can your AI automate?” It's “where on the spectrum does each of our workflows live, and can your platform sit at all five points depending on which one we're running?”
A platform that can only do point 1 is a notification system. A platform that can only do point 5 is a liability machine. A platform that lets you place each workflow at the right point, and shift it rightward as you build trust, is operating at the actual level of nuance the work demands. Ask the governed AI workflow questions, then ask this one: can you place this workflow where it actually belongs?
The future of enterprise AI isn't a single answer. It's deliberate placement. Each workflow on the spectrum where its consequences and frequency justify, shifted right or left as evidence accumulates. That's the discipline. A serious AI platform has to support it.
A less impressive slide, but the right answer.
Cimba is the agentic command center for enterprise business and finance operations. If you're trying to figure out where each of your workflows belongs on the spectrum, book a demo.
Evaluating enterprise AI?
Ask us the hard questions.