In this case we hope that they are both. The software to perform validator actions is all automated, and should require no input from the account owner. But, the actions can only be performed based on voting of the governance tokens in the ecosystem, which hopefully prevents 1 person from controlling multiple instances of the "bot". With out this human level interaction the system becomes less secure.