Two Axes, Not One
"Automated" collapses two independent questions into one word, and separating them is what makes this boundary drawable. Ask instead: who decided that this specific run should happen, and is that person still present while it runs.
A person clicking a dispatch button scores human on both. A schedule scores machine on the first and usually absent on the second — the decision was made once, generically, at configuration time, and applies later to a specific run nobody looked at. That is a standing delegation, and it is a perfectly normal thing to grant deliberately. The failure is granting it by accident, which is what happens when "automated" is treated as one property.
What Dispatch Is Allowed to Do
The permitted action is narrow and worth stating precisely: on an explicit human action, hand a short-lived, opaque, single-use ticket to the local machine, which opens a visible interactive session with the right project loaded and the first command prepared. Then it stops. The session is a session — a person can read it, interrupt it, and argue with it.
That is process launching, not autonomous work. The distinction survives because of what dispatch does not get to do: it does not decide which item to run, it does not run anything after the session opens, it does not retry, and it cannot be triggered by anything except the click.
Why the Ticket Is Short-Lived, Opaque, and Single-Use
Each property closes a specific hole. Short-lived means a ticket that leaks tomorrow is worthless. Opaque means it carries no work description — the receiver exchanges it for the real payload, so possession of the ticket alone tells an attacker nothing about what is being done. Single-use means consuming it invalidates it, which turns "replayed the same launch twice" from a possibility into an error you can see in a log.
None of that is about distrust of the person clicking. It is that a dispatch path is the one place where an outside actor could get a session started, so it should be the narrowest surface in the system.