Not all security tasks should be automated. The architect applies a decision framework: automate tasks that are high-volume, low-complexity, and have well-defined outcomes. Tasks that require human judgment, involve high-blast-radius actions, or operate in ambiguous scenarios should remain human-supervised.
The automation maturity model progresses through: Notification (SOAR sends an alert) → Enrichment (SOAR gathers context automatically) → Containment (SOAR takes protective actions with approval) → Remediation (SOAR fully resolves incidents autonomously). Each tier requires progressively more confidence in the data and logic.