Automated investigation and response is enabled. What must the SOC still govern?

1. Automation levels, scoped permissions, review requirements, and action evidence
2. Remove all incident owners
3. Delete action history after every run
4. Assume every automated action is always correct