Every AI vendor pitch arrives with the same slide: a default position on automation. Some pitch full automation. Some pitch copilots. Some pitch chat. Whichever shape it takes, it's positioned as the right answer for whatever you're trying to do.
The pitch is the wrong shape. The right answer isn't a single point on the human-in-the-loop spectrum. It's a placement decision, made deliberately, for each workflow you're considering. Some workflows belong at full automation. Some belong at AI-suggests-only. Most belong somewhere specific in the middle.
Knowing where each workflow belongs, and why, is the actual work of deploying AI in business operations and finance ops. Vendors who skip that conversation and pitch a single point on the spectrum are selling you a shape that might not fit all your work.
The spectrum
There are five rough points on the spectrum, from least to most automated. Every AI workflow you're considering today belongs at one of them.
Five points on the automation spectrum
- 1Suggest. The agent flags something for human attention. The human takes the next step.
- 2Recommend. The agent proposes a specific action with reasoning. The human decides.
- 3Execute with approval. The agent takes the action only after a human confirms.
- 4Execute with exception review. The agent takes routine actions automatically and routes edge cases or high-stakes ones to a human.
- 5Execute autonomously. The agent takes the action and informs the human after the fact, or not at all.
Most workflows belong at points 2, 3, or 4. Very few belong at point 5. Surprisingly few belong at point 1.
The spectrum framing isn't new. Academic and product literature has been mapping AI agent autonomy levels for years, with names like Human-in-the-Loop, Human-on-the-Loop, and Human-out-of-the-Loop. The framework above is the operator version: shorter and sharper, oriented to the decision a buyer has to make next Tuesday rather than to taxonomy.
What goes wrong at each end
Push every workflow to point 5 and you create a trust crisis. The first time an AI agent autonomously reroutes a shipment that costs you a contract, or auto-approves a refund that turns out to be fraud, the business pulls the program. You can have audit logs ready for every action. The reaction is still going to be “we shouldn't have given the AI that authority.” That lesson burns more bridges than the savings buy.
Push every workflow to point 1 and the AI doesn't earn its keep. If the agent just flags things for the human to decide, and the human still does the diagnosis, the analysis, and the action, you spent a real budget and got a notification system.
Both ends miss. The work is matching each workflow to the level of autonomy its consequences actually justify.
A platform that can only do point 1 is a notification system. A platform that can only do point 5 is a liability machine.
How to decide
Four questions to ask of any workflow you're thinking about automating.
Four questions to place a workflow on the spectrum
Reversibility.
How easy is it to undo? A bad reroute can be fixed; a bad public message can't be unsent. More reversible actions allow for more automation.
Consequence.
How bad is a wrong call? Auto-flagging a measurement glitch is cheap; auto-paying a fraudulent invoice costs real money.
Frequency.
How often does it happen? Zone rebalances run hundreds per day; capitalization decisions, twice a year. High frequency, more automation.
Regulatory exposure.
Does it touch SOX, SOC 2, GDPR? If it needs an audit-relevant control, a human stays in the loop, regardless of how cheap or reversible it is.
A workflow with high reversibility, low consequence, high frequency, and no regulatory exposure sits at point 4 or 5. Automate broadly, route exceptions.
A workflow with low reversibility, high consequence, low frequency, and high regulatory exposure sits at point 2 or 3. The agent recommends, a human approves.
| Workflow | Where it belongs | Why |
|---|---|---|
| Churn-risk flag | Suggest | Early signal, and the play depends on the relationship. Cimba surfaces the at-risk account; the AM decides the outreach. |
| Flux / variance analysis | Recommend | A judgment call on what the drivers mean. Cimba explains the variance; the controller decides. |
| Month-end reconciliation | Approve | Touches the ledger and SOX controls. Cimba recommends the matched entries; a human approves before anything posts. |
| SLA breach response | Approve | Reassigning couriers is reversible but consequential. Cimba recommends the move; the ops lead approves from Slack. |
| Spend anomaly review | Exception | Routine spend clears automatically; anything over the policy threshold routes to a human. |
| Reorder under $1,000 | Autonomous | High frequency, low consequence, easily reversed. Cimba reorders and logs it. |
Most workflows fall somewhere in the middle and need the framework applied case by case. Treat this as a starting point, not a rule.
Placement is what makes outcomes attributable
Placement isn't only about safety. It's also how the value of a workflow becomes something you can point to. When a workflow sits at Approve, the arc is fixed: Cimba surfaces a Next Best Action with its projected impact, routes it to the owner, and executes only once a human confirms. Approve and execute, the same trusted way every time, every step logged to the append-only audit trail. Audit by design.
Because the action is named before it runs, the outcome it produces can be measured against it. Correct placement is what turns judgment into an attributable outcome. Here is one Next Best Action, placed at Approve, end to end.
08:1208:1208:1914:30One action, one measured outcome. Compounded across hundreds of actions a week, that is how operations teams reach a real number, on the order of +20% revenue per customer. Not hours saved. Revenue you can attribute. Get the placement wrong and that chain never forms: a workflow stuck at point 1 has no action to attribute anything to, and a workflow forced to point 5 gets pulled before the outcomes ever accumulate.
What this means for buying
When you evaluate an AI vendor, the right question isn't “how much can your AI automate?” It's “where on the spectrum does each of our workflows live, and can your platform sit at all five points depending on which one we're running?”
One default for everything
The vendor pitches a single point on the spectrum
Deliberate placement per workflow
Each workflow placed where its consequences justify
A platform that can only do point 1 is a notification system. A platform that can only do point 5 is a liability machine. A platform that lets you place each workflow at the right point, and shift it rightward as you build trust, is operating at the actual level of nuance the work demands. Ask the governed AI workflow questions, then ask this one: can you place this workflow where it actually belongs?
The future of enterprise AI isn't a single answer. It's deliberate placement. Each workflow on the spectrum where its consequences and frequency justify, shifted right or left as evidence accumulates. That's the discipline. A serious AI platform has to support it.
A less impressive slide, but the right answer.
Cimba is proactive AI for enterprise business and finance operations. If you're trying to figure out where each of your workflows belongs on the spectrum, book a demo.
Evaluating enterprise AI?
Ask us the hard questions.