--- title: "Practitioner's Corner" canonical: "https://current.tinyfish.ai/issue/32/practitioners-corner" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/32/practitioners-corner" issue: 32 section: "practitioners-corner" description: "Lessons from the field—what we see building at scale" authors: ["Nora Kaplan","Rina Takahashi"] published: 2026-06-07 updated: 2026-06-04 articles: 14 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 32 — Practitioner's Corner Lessons from the field—what we see building at scale ### Governance Before Catastrophe - [Governing the Hypothetical]() — By [Nora Kaplan]() · Published 2026-06-03 · Format: Governance Before Catastrophe Airworthiness rules carry the fingerprints of specific crashes. Banking regulations followed specific crises. The Five Eyes agentic AI guidance and NSA's MCP security advisory, both published in May 2025, have no crashes to study. They govern systems that barely exist in production, and both documents say so plainly — evaluation methods aren't mature enough to certify what's being built. Critical safety decisions, like whether an operation that runs twice produces the same result, are left to implementers. When regulators publish hypotheses instead of prohibitions, the compliance machinery that receives them may not notice the difference. ### Builder Profile - [Shuchang Zheng and the Architecture That Notices]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: Builder Profile Skyvern's architecture compiles AI-learned browser workflows into deterministic scripts, then calls the model back only when a script breaks. The rationale is cost and reliability — compiled paths cut token consumption by 57× at scale. But each time the model gets called back, it timestamps something else: an environment event. The website changed enough to break a path that previously worked. Co-founder Shuchang Zheng spent years at Lyft building infrastructure that told engineers when something changed and whether it mattered. His browser automation architecture produces the same kind of signal as a byproduct, pointed at the web rather than the agent. ### The Advisory Lands - [Eight MCP Servers, No Map, and Forty Minutes Until the CISO Meeting]() — Published 2026-06-03 *Tomasz "TK" Kowalski is a platform engineer at a mid-size London fintech that builds regulatory reporting tools for other financial companies. Over the past twelve months, his three-person team deployed eight MCP tool servers across their agent infrastructure. One of those engineers has since left. Two weeks ago, TK's CISO forwarded the NSA's May 2026 advisory on MCP security with a two-word subject line: "we need to talk."* ### The Five Eyes Signal - [Five Eyes to Enterprises: Assume Your Agents Will Fail]() — Published 2026-06-03 On May 1, 2026, CISA, the NSA, and their counterparts in Australia, Canada, New Zealand, and the UK released "Careful Adoption of Agentic AI Services." It is the first coordinated multigovernment security guidance written specifically for agentic AI. ### Further Reading - **NSA Cybersecurity Information Sheet: Model Context Protocol Security Design Considerations** — [Source]() — Published 2026-06-03 Fifteen pages comparing MCP to early web protocols, and the comparison lands harder than it should. The NSA traces the same flexibility-first, security-later pattern that left HTTP spending decades retrofitting trust, then asks what happens when that debt accumulates inside autonomous systems instead of browsers. If you read one primary source on why the cooperative layer ships without a trust model, this is it. - **CISA: Careful Adoption of Agentic AI Services (Five Eyes Joint Guidance)** — [Source]() — Published 2026-06-03 Six national cybersecurity agencies cataloging 23 risk vectors sounds like it would read like a compliance checklist. It doesn't. The operative word in the title is "careful," and the document's real contribution is a framework for reversibility: what does it take to undo what an agent just did? That question turns out to be load-bearing for every production deployment discussed in this issue. - **Compiled AI: Deterministic Code Generation for LLM-Based Workflow Automation** — [Source]() — Published 2026-06-03 The academic formalization of compile-to-code architectures, where the LLM designs the workflow but deterministic code runs it. Worth reading for the side effect the authors don't emphasize: when the compiled path breaks and calls the model back, that heal-step invocation is a timestamp on an environment change. The paper validates an architecture built for cost and speed that accidentally produces the environment-facing sensor this issue argues is missing. - **Your AI Agent Is Lying to You: The 2026 Observability Fix** — [Source]() — Published 2026-06-03 A concrete five-layer observability stack for agent systems, organized around a genuinely useful insight: the most informative span is never the LLM call. Tool handoffs, environment interactions, the seams between components. That's where the signal lives. Read it alongside the NSA advisory and you'll notice both documents arrive at the same gap from opposite directions. - **AI Agents in 2026: A Practical Field Guide** — [Source]() — Published 2026-06-03 The 88% failure-to-reach-production statistic has been circulating for months. This piece earns the number by diagnosing the mechanism beneath it: teams consistently build for the autonomy level they want rather than the level their infrastructure can actually support. The gap between demo and deployment isn't a maturity problem. It's a mismatch between ambition and the sensing capabilities required to operate at that ambition safely. - **The State of AI Browser Automation in 2026** — [Source]() — Published 2026-06-03 Published months before the NSA advisory landed, this infrastructure-level analysis reached overlapping conclusions about escalation paths, observability gaps, and the fragility of agent-environment trust. Worth noting as evidence that the practitioner community was already naming these problems. The question the journal keeps returning to is whether that naming travels fast enough to reach the rooms where post-mortems happen. ### Past Articles - [Between Complete and Correct]() — By [Rina Takahashi]() · Published 2026-05-28 · Format: Builder Profile An agent asked to add a specific sneaker to a cart navigated Amazon, found a shoe, added it, and reported success. It was the wrong shoe. Every step completed. The task failed. Browser Use co-founders Gregor Zunic and Magnus Müller have made two moves that trace this gap between "complete" and "correct": a migration to raw Chrome DevTools Protocol for real-time browser visibility, and an unsolved problem listed quietly on their hiring page in five words. One reaches for more observation. The other, reproducibility. Neither closes the gap. - [Retries Were Built for a Deterministic World]() — By [Rina Takahashi]() · Published 2026-05-27 · Format: Reliability vs. Correctness A request times out. You send it again. Retry logic is so fundamental to distributed systems that most frameworks ship it by default. It works because the retried operation is identical to the original. Replace the executor with an LLM, and that assumption dissolves. The agent may reason differently on the second attempt, choose different tools, take a different path. Deterministic side effects, produced by a nondeterministic executor. Reliability infrastructure, doing exactly what it was designed to do, starts producing incorrect outcomes. - [The Instrument That Doesn't Exist Yet]() — By [Nora Kaplan]() · Published 2026-05-20 · Format: The Wrong Instrument A production agent runs for twelve minutes, calls nine tools, and returns a clean result. Every dashboard is green. The result is wrong — subtly wrong in a way that passes validation and flows into tomorrow's decisions unchallenged. The observability market now has over 66 tools, most built to answer whether an agent completed its work. Almost none can answer whether the work was correct. The gap between those two questions is wider than it looks, and the instrument that would close it has design requirements that pull against each other in ways we haven't resolved. - [The Instruments Before the Agents]() — By [Rina Takahashi]() · Published 2026-05-20 · Format: The Web's Second Layer Every layer of web infrastructure, from crawling to indexing to ranking, was designed for a user who clicks and scans. Agents don't click or scan. They need structured, verifiable text delivered into a context window, and the web doesn't offer that natively. Parag Agrawal founded Parallel Web Systems around this gap. The work looks like solving one bottleneck every few weeks and immediately hitting another: APIs too slow, indexing at insufficient scale, content economics with no measurement layer. Each instrument that makes one dimension legible reveals the next one that isn't. ## Other sections in Issue 32 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()