A SOC manager is evaluating a new SOAR platform. One analyst argues that a single Python script that pulls IOCs from a threat feed and writes them to a firewall blocklist already gives the team 'orchestration.' The manager wants to correct this misunderstanding by explaining the core distinction between automation and orchestration. Which statement most accurately describes that distinction?