The classic example is accounts payable: the person who enters a new vendor should not be the same person who approves payments to that vendor, and the person who approves a payment should not be the one who reconciles the bank account afterward. Splitting these roles makes an honest mistake easier to catch and a dishonest one harder to hide.
AI and automation can quietly erode this control if one workflow or one service account is given permission to do several of these steps at once for the sake of convenience. The common mistake is granting broad access to make an integration easier to build, then never revisiting the specific access it actually needs once the project is live.