Control you can see

The worry is not automation itself. It is automation nobody can see, question or undo.

Visible by default

Every change should arrive as a proposal with a reason attached. If a person cannot read why something changed, they cannot approve it in good faith.

Undo as a feature

A single undo step per edit, and a history that lists every change with its trigger, turns a risky tool into a safe one.