An automation that can act on your business without guards isn’t a time-saver. It’s a liability sitting quietly until the first edge case it never saw — and edge cases are not rare events, they’re the job.
There’s a forty-year-old paper every operator should read before they buy a bot. In “Ironies of Automation,” Lisanne Bainbridge pointed out the trap that still catches people today: the more of a process you automate, the more skilled and alert the human overseeing it has to be — because the human is now left with exactly the rare, hard, high-stakes cases the automation can’t handle, and has lost the daily practice that kept them sharp.1
That’s the irony. Naïve automation promises to remove people and instead quietly raises the bar on the people it keeps. Decades of human-factors research since have put numbers on the failure modes — automation complacency and automation bias, where operators stop checking a system that’s usually right and miss it on the day it’s wrong.2,4 The lesson isn’t “don’t automate.” It’s “automate with the human deliberately designed back in.” Concretely, that means four guards — and a gate.
The four guards
1 · Verification — does the output match reality?
Before any automated result is trusted, something checks it against the real world: a reconciliation, a sanity bound, a cross-total. An automation confidently producing the wrong number is worse than no automation, because people believe it.
2 · Monitoring — would you know if it broke?
Silent failure is the expensive kind. Every automation reports whether it ran, whether it ran clean, and whether its outputs are drifting. If a process can fail without anyone finding out for a week, it isn’t finished — it’s a future incident with a delay timer.
3 · Fallback — what happens when it fails?
Things fail: an API changes, a file is malformed, a network drops. The question is whether failure lands in a safe state. A good automation degrades to “do nothing and alert a human,” never to “do something unpredictable.” The manual path stays usable so the business never stops.
4 · Cost cap — what’s the worst it can spend?
Anything that can call a paid service or take a repeatable action needs a hard ceiling — per run and per day. The cap bounds the blast radius of a bug or a bad input. Unbounded loops are how a small mistake becomes a large invoice.
Naïve automation promises to remove people and instead quietly raises the bar on the people it keeps.
And the gate: a human on anything irreversible
Guards make an automation safe to run. The gate decides what it’s allowed to do alone. Sending money, deleting records, publishing in your name, anything you can’t cleanly undo — those stop for a human to approve. Reversible, low-stakes, high-volume work runs unattended; irreversible work waits for a person. This is the practical form of what the research calls choosing the right level of automation for the stakes — full autonomy where a mistake is cheap and recoverable, human approval where it isn’t.3,5
Why this is non-negotiable for us
Every automated component LEANTA ships carries all four guards plus the human gate — by default, not as an upsell. It’s slower to build than a quick script that “just does it,” and that’s the point: the people who sell you the quick script are gone by the time the edge case arrives. We’d rather ship something you can leave running and trust than something impressive you have to babysit.