Two Axes, Not One
"Automated" collapses two independent questions into one word, and separating them is what makes this boundary drawable. Ask instead: who decided that this specific run should happen, and is that person still present while it runs.
A person clicking a dispatch button scores human on both. A schedule scores machine on the first and usually absent on the second — the decision was made once, generically, at configuration time, and applies later to a specific run nobody looked at. That is a standing delegation, and it is a perfectly normal thing to grant deliberately. The failure is granting it by accident, which is what happens when "automated" is treated as one property.
What Dispatch Is Allowed to Do
The permitted action is narrow and worth stating precisely: on an explicit human action, hand a short-lived, opaque, single-use ticket to the local machine, which opens a visible interactive session with the right project loaded and one fixed first command: the claim for the item that was clicked, built from a template installed on that machine, never from anything carried in the link. Where the app can pre-fill a message, the command waits there for the person to send it. Where it cannot, the handler sends that one command itself and reports that the turn started. Then it stops. The session is a session — a person can read it, interrupt it, and argue with it.
That is process launching, not autonomous work. The distinction survives because of what dispatch does not get to do: it does not decide which item to run, it sends nothing beyond that one fixed command, it does not retry, and the only way in is a ticket the workshop issued moments ago for one queued item — which, in the census, is requested by a click.
Why the Ticket Is Short-Lived, Opaque, and Single-Use
Each property closes a specific hole. Short-lived means a ticket that leaks tomorrow is worthless. Opaque means it carries no work description — the receiver exchanges it for the real payload, so possession of the ticket alone tells an attacker nothing about what is being done. Single-use means consuming it invalidates it, which turns "replayed the same launch twice" from a possibility into an error you can see in a log.
None of that is about distrust of the person clicking. It is that a dispatch path is the one place where an outside actor could get a session started, so it should be the narrowest surface in the system.