Protective Automation Design