A phishing surge triggers AI triage, ticket creation, and a draft user notice that waits for the CISO to send. Which end-to-end automation pattern is this?

Orchestrated AI automation steps with human oversight on outbound notices describe an end-to-end IR pattern: a phishing surge triggers AI triage and ticket creation, and a draft user notice is prepared—but sending waits for the CISO (or delegated authority). Orchestration works because high-volume municipal phishing needs speed on repetitive internal steps, while resident communications need accuracy, legal/comms alignment, and accountable approval. Chaining automated prep with a human send gate preserves both throughput and civic trust.

Orchestrated AI automation steps with human review of triage classifications fails because it places the human gate on reviewing triage outputs, whereas this surge automates triage for speed and reserves human oversight for the outbound notice awaiting the CISO send. Orchestrated AI automation steps with human approval for ticket creation fails because it gates the internal ticketing step for approval, whereas here ticket creation is automated and the required hold is the draft user notice pending CISO authorization to send. Orchestrated AI automation steps with human oversight of inbox classifier tuning fails because classifier tuning is background model maintenance, not the in-flow approval where a prepared draft notice waits for the CISO to send.

Exam caveat: orchestration diagrams on exams often hide where credentials live—if the automation identity can still send mail/SMS, the “wait for CISO” step is cosmetic. Operational check: implement the phishing playbook as staged workflow with explicit wait states, bind send actions to human-held credentials or approval APIs, log triage-to-notice lineage, and measure time-to-approve without removing the human gate under pressure.