Governed AI publishing for this website

The CMS behind this site gives AI agents 19 publishing tools through an authenticated MCP server, with roles, idempotency, an audit trail, rate limits, and human approval before anything goes live.

What was at stake: A personal brand loses trust the moment it publishes an invented claim, so AI help is only useful if nothing reaches readers unreviewed.
The decision: AI agents can research, draft, and prepare articles through MCP, but only a person can approve and publish them.
What we chose not to do: No autonomous publishing, and no invented testimonials, metrics, or quotes: the prompt library forbids them and the content audit checks for them.

Joh's role: Product owner, architect, and engineer

AI Operations Audit

Context

The product and operating environment

This site is both a publication and a working example of governed AI. Articles, projects, and media are managed in a private CMS that AI agents can use through MCP, under the same editorial rules as a human editor.

Important constraints

Using AI to speed up drafting, SEO, and image work without letting it publish unreviewed content.

Preventing duplicate actions when an agent retries a request.

Knowing which agent did what, and being able to review it later.

Keeping AI output honest: no fabricated metrics, testimonials, or sources.

Engineering responsibilities

MCP server with 19 tools for drafts, updates, scheduling, preflight checks, quality review, SEO, internal links, and images.

Role-based access (reader, editor, publisher, admin) for agent credentials.

Idempotency keys, rate limits, and an audit log for every tool call.

Publication safety mode that keeps AI output as drafts until a person approves it.

Content audit that flags unsupported claims before publication.

Technical decisions

Treat AI agents as editors with limited permissions, not as publishers.

Make every write idempotent so a retried request cannot publish twice.

Record every tool call so any change can be traced and reviewed.

Write the honesty rules into the prompts and the audit, not just into a style guide.

Practical outcomes

AI handles the repetitive parts of publishing while a person keeps editorial control.

Every agent action is attributable and reviewable.

A reference implementation of the approval, logging, and undo pattern offered to clients.

Technology and systems

MCPNext.jsTypeScriptPrismaMongoDBOpenAI APIRole-based accessAudit logging

This case study describes Joh's role and publicly shareable technical scope. It does not expose confidential customer data, private credentials, internal commercial information, or imply an endorsement by the named organization.

Apply the same thinking

The right decision is worth more than the code.

The AI Operations Audit applies the same judgment to your business: what to automate, what to protect, and what to leave alone, in ten business days.