--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/35/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/35/foundations" issue: 35 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Rina Takahashi","Nora Kaplan"] published: 2026-06-29 updated: 2026-06-25 articles: 23 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 35 — Foundations Conceptual clarity earned from building at scale ### Trace Anatomy - [The OTel GenAI Spec Has an Implicit Reader]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Trace Anatomy The OpenTelemetry GenAI semantic conventions define how to trace agent workflows: which agent ran, what tools it called, how many tokens it consumed. Read closely, the spec's attributes reveal a consistent design choice about who's looking at the data. It's a developer, diagnosing failures. The conventions are genuinely useful for that purpose. When the reader shifts to an auditor tracing authorization chains, an operator enforcing cost boundaries, or a compliance team documenting human oversight, the attributes that exist start outlining the shape of the ones that don't. ### Legibility Gap - [Four Stories About the Same Purchase]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Legibility Gap Visa's integration with OpenAI brings real payment infrastructure to AI agents: tokenized credentials, spending controls, merchant restrictions. The interesting problem starts when a purchase goes wrong. A chargeback forces every party to independently explain the same event, and an agent-initiated transaction must be legible to four audiences with incompatible evidence needs. Recording what happened is straightforward. Making it understandable to everyone who has to adjudicate demands something a comprehensive log can't provide on its own. ### Evidence From Every Angle - **OWASP Top 10 for Agentic Applications 2026** — [Source]() — Published 2026-06-25 Agent risk scales with authority and side effects, not just model vulnerability. - **EU AI Act: Regulatory Framework for Artificial Intelligence** — [Source]() — Published 2026-06-25 High-risk AI systems must log actions, document decisions, and guarantee human oversight. - **NIST SP 800-63B: Digital Identity Guidelines for Authentication** — [Source]() — Published 2026-06-25 Identity infrastructure reads automated, cloud-origin access as a fraud signal, not proof of delegation. - **OWASP Non-Human Identities Top 10** — [Source]() — Published 2026-06-25 Service account risks compound when the credential holder can reason and plan. - **MCP 2025-06-18 Authorization Specification** — [Source]() — Published 2026-06-25 The protocol settles transport-layer auth mechanics but leaves governance questions explicitly open. ### The Audiences A single agent action generates questions for six different audiences. The user wants confirmation their intent was honored. The developer wants to know what broke. The service on the receiving end wants to know if the session is even legitimate. And the auditor, regulator, and merchant each need evidence the others never thought to produce. The pattern underneath all six is worth sitting with. The records that current agent systems generate were designed for developers and quietly repurposed for everyone else. A debugging trace does not become an accountability record just because someone hands it to an auditor. A polished summary does not become oversight just because the user reads it. Each stakeholder looks at the same action through a different lens, and most of them find the page blank. - **Users Deserve More Than the Agent's Own Story** — [Source]() — Published 2026-06-25 Tag: User Oversight The person who delegated the task needs to confirm their intent was followed, constraints held, and the outcome actually matches what they asked for. Instead, they get the agent's self-reported summary. Step-by-step visibility, constraint status at each decision point, and a binding link between what was approved and what was executed? Almost never there. - **Developers Are Best Served, but Gaps Remain** — [Source]() — Published 2026-06-25 Tag: Developer Tooling Developers have the richest tooling today. OpenTelemetry's GenAI conventions cover model calls, tool invocations, latency, and errors. Still, production reveals blind spots: replay capability, final-state verification against the systems the agent actually touched, cost attribution at workflow granularity, and records that tie approvals to specific executions. - **Service Providers Can't Tell Who Sent the Request** — [Source]() — Published 2026-06-25 Tag: Relying Party When a service receives a request from an agent, the fundamental question is simple: is this session legitimately delegated, and should we treat it as authorized? No standard mechanism lets a browser-based agent declare its identity or delegation chain in a way the receiving service can verify. Most anti-abuse systems just flag automation as suspicious. - **Auditors Keep Getting Logs Built for Debugging** — [Source]() — Published 2026-06-25 Tag: Audit Evidence Auditors need reproducible evidence: who authorized what, whether policies were followed, and whether final states are correct across every system the agent touched. What they actually receive are engineering traces built to diagnose failures. Separation of principals, constraint records at action boundaries, delegation-chain evidence? These are rarely captured in any structured form. - **Regulators Need Records That Don't Exist Yet** — [Source]() — Published 2026-06-25 Tag: Regulatory Readiness Regulators want documentation of oversight mechanisms, risk controls, incident definitions, and operating boundaries. Reasonable asks. But current agent systems produce neither regulator-legible records nor governance artifacts. Proving interruptibility, demonstrating human oversight design, reporting incident rates against exposure denominators: these require records most deployments never generate in the first place. - **Payment Rails Are Ahead of Every Other Channel** — [Source]() — Published 2026-06-25 Tag: Commerce Evidence Commerce counterparties need transaction-level proof of consumer intent, spending limits, and agent identity for fraud scoring and dispute resolution. Visa and Mastercard are building agent-recognition rails, which puts them ahead of the curve. Generic web automation for procurement, benefits enrollment, and vendor management has nothing comparable for binding a mandate to a transaction. ### Evidence Standards When an agent acts on someone's behalf, "it worked" is the beginning of the conversation, not the end. The action needs to be provable. Not just to the user who triggered it, but to the merchant who processed it, the compliance team that reviews it next quarter, the regulator who shows up with questions. That proof fragments into distinct evidence types, each answering a different question with its own characteristic failure mode. Who authorized this? Through what chain? Under what rules? Did the other system actually land in the right state? Where did the data come from? And can the record itself be trusted after the fact? These six categories are a way of seeing where gaps hide before a dispute or an incident forces the question into the open. - **A Login Is Not a Mandate to Act** — [Source]() — Published 2026-06-25 Tag: Intent Proof Session cookies prove someone authenticated. They say nothing about whether that person wanted this particular agent to book this particular flight at this particular price. Sufficient intent proof ties approval to the specific execution target, page state, and consequences. Approving a plan and authorizing what actually happened are different things entirely. - **Seven Links Between a User and a Receipt** — [Source]() — Published 2026-06-25 Tag: Authorization Chain Robust delegation keeps seven elements distinct: human requester, agent identity, runtime identity, tool authorization, resource audience, approval binding, and audit record. Collapse any one of them and disputes become a fog. Token audience validation matters here because without it, credentials drift silently across service boundaries. - **Rules in Someone's Head Produce Zero Evidence** — [Source]() — Published 2026-06-25 Tag: Policy Compliance If spending limits and vendor restrictions live only in policy documents nobody reads, agents can't demonstrate they stayed within bounds. Compliance that holds up requires versioned, machine-readable rules referenced in the execution trace, with per-action assertions computed before the action runs. Not claimed after. - **The Agent Said It Worked. Did It?** — [Source]() — Published 2026-06-25 Tag: Final State A clean transcript can sit alongside a duplicate order, a wrong database entry, or a leaked credential. Verification means querying the authoritative downstream system directly and comparing intended state against observed state. Worth noting: even failed agent runs may have changed something on the other side. - **Inputs and Outputs Break Into Separate Problems** — [Source]() — Published 2026-06-25 Tag: Data Provenance Where did the retrieved data come from, and was it licensed for this use? That's one problem. Whether the generated output maintains integrity from creation through delivery is another. C2PA addresses output credentials reasonably well. Input-source provenance at scale remains largely an open question. - **Records Must Convince People Who Weren't There** — [Source]() — Published 2026-06-25 Tag: Tamper Resistance The parties who most need to trust an execution record are the ones absent when it ran: the merchant, the auditor, the regulator months later. That trust requires cryptographic hashing at production time, append-only storage, trusted timestamps, and legibility without access to proprietary agent-platform tooling. ### Past Articles - [The Context Window Fills Up Long Before It's Full]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Conceptual Piece A model with a 200K token context window starts degrading at 50K. Selective retrieval using a quarter of the tokens beats full-context loading by nearly 20 accuracy points. The finding gives "context engineering" its teeth. The work is keeping the context window clean. But teams choosing a context strategy today are choosing a reliability envelope with no data on what that envelope actually contains. The research to measure it hasn't been done. - [Where the Snapshot Lives Changes Everything Else]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Tool Architecture Study Playwright now ships two modes for agent-driven browser automation. One streams page snapshots into the LLM's context window. The other writes them to disk as files. The token difference is 4x. The difference in what each mode leaves behind after the session ends is harder to quantify and harder to ignore. One produces artifacts you can diff and inspect independently of the agent's own account. The other stores observation and inference in the same stream, inseparable after the fact. Where the snapshot lives turns out to determine what you can verify. - [The Accessibility Tree Wasn't Built for AI Agents]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Perception Walkthrough Accessibility trees were built for screen readers, not AI agents. But both share the same constraint: neither can see a web page. Both need it translated into structured, sequential text. Playwright MCP builds its entire browser automation architecture around that convergence, using accessibility snapshots that cost a fraction of what screenshots require per interaction. The token savings are real and they compound across multi-step workflows. So does the downside: on 95.9% of the web's top million pages, the underlying markup has detectable failures. The agent inherits every one of them. - [The Number You Didn't Ask About]() — By [Nora Kaplan]() · Published 2026-06-11 · Format: Reliability Lens An agent succeeds at a task 70% of the time. Frame the results one way and you can report 97%. Frame them differently and you report 34%. Same system, same math, a 63-point gap created entirely by which question the benchmark decided to answer. Nearly every major agent benchmark chooses the generous framing. The number that captures what production actually feels like, consecutive successes across a full workload, is one that almost nobody reports. ## Other sections in Issue 35 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()