A delegation boundary is the line that defines which tasks an AI system can do on its own, which tasks require human review, and which must remain human-only. In cyber security, this boundary is part of control design: it determines where automation ends and accountable judgment begins. It is not just an efficiency choice; it is a safety rule.
This matters because attackers often exploit unclear boundaries. If a phishing triage model is allowed to auto-close alerts, a missed signal can become a breach. If an AI assistant can draft firewall changes or approve account recovery without review, it can amplify mistakes or be manipulated by prompt injection and poisoned inputs. Defenders use delegation boundaries to require human approval for high-risk actions, keep AI in low-risk analysis, and log every handoff. A strong boundary makes it easier to verify output, limit blast radius, and preserve accountability when AI is used in SOC work, incident response, and access control.