What evidence may show automation rather than manual activity?¶

Automation is most strongly shown by evidence of the mechanism itself: a script, scheduler, workflow, API client or service that generated the activity. Repetition, timing and scale can support that conclusion, but patterns alone are not decisive.

A person can repeat copied instructions quickly, and a bot can deliberately vary its timing and content.

Combine behaviour with technical markers¶

Indicators that may support automation include:

• very short or mechanically regular intervals;
• parallel requests or unusually large target lists;
• repeated request structures and consistent errors;
• machine-generated identifiers;
• common process, API client or scheduler identifiers;
• scripts, tasking files, configuration or workflow records; and
• output files or logs produced without interactive steps.

Direct technical markers are generally more informative than regular behaviour alone. The same process or job identifier across varied requests may reveal automation even when the operator adds random delays.

Test legitimate alternatives¶

Monitoring, integration, backup and deployment systems also generate high-volume, precisely timed events. Compare the relevant service account, approved workflow, target list and business purpose with the disputed activity.

If the underlying mechanism cannot be recovered, explain that the conclusion is inferred from the observed pattern. Avoid presenting “bot-like” timing as certainty. Even where automation is established, the person who configured, launched or benefited from it remains a separate attribution question.