For a big organization, this now means two more audit sessions with IT security, which means about 5-7 hours of meetings spent with them, only for them to then

For a big organization, this now means two more audit sessions with IT security, which means about 5-7 hours of meetings spent with them, only for them to then decide that the bot does not adhere to the obscure, 1990s-era document ITSEC-37893/378B section A.epsilon subsection D7 ("Auditability of automatic functionality by certified public accountants") which was written by some legalese zombie who last saw a computer in the 1960s and which reasonable people agree is not something that's relevant to the use-case - but ITSecurity won't budge and has veto powers. Large organizations are far more likely to buy a solution that works for 80% of the use-cases out of the box, and then live with not fulfilling the other 20% by training their users around it (and constantly complain about the users) - especially if that means you can move accountability to the supplier in the contract. WHICH 80% of functionality is important is decided by what you best can sell to top management. The sweet spot for quick decisions and technological adaptions are SMBs up to about 500 employees.