What an editorial agent should be allowed to do, and what it should not

What an agent may do

An agent connected to Brenzuri over MCP can do what a writer can do in the interface: create a brief, start a run, read the source list, read the confidence report, add a source to a flagged claim and keep a flag with a note. It does those things inside a credit budget its owner set, and every one of them is written into the article's version history under the agent's name.

It cannot approve, and it cannot see the workspace's credit balance. It is told whether a run is affordable, not how much is left. Those two limits are not settings; there is no tool for either, so no prompt can reach them.

Why approval stays with a person

Approval is the moment a company's name goes on the text. The Partnership on AI's guidance for newsrooms recommends that a named person remain accountable for any published output a model contributed to^†, and the same principle is what makes an AI label mean something: it is derived from that approval record, for that exact version, and cannot be set by anyone.

The practical consequence is that an agent can bring an article to the point of approval and then stop. The person who approves sees the source list, the flags and what the agent changed.

The cases that shaped it

The permission set was not designed in the abstract. In 2023 a technology publisher paused an AI-written finance series after readers found unattributed errors, and the correction notice named no person responsible^†. Two years of similar cases point the same way: the failure is never that a model wrote a sentence, it is that nobody was on record as having read it.

So the rule is short. Write, read, fix: yes. Approve, publish, spend beyond the budget: no. The MCP scopes intersect with the owner's role and never exceed it.

Frequently asked questions