--- title: "Practitioner's Corner" canonical: "https://current.tinyfish.ai/issue/35/practitioners-corner" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/35/practitioners-corner" issue: 35 section: "practitioners-corner" description: "Lessons from the field—what we see building at scale" authors: ["Rina Takahashi","Nora Kaplan"] published: 2026-06-29 updated: 2026-06-25 articles: 13 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 35 — Practitioner's Corner Lessons from the field—what we see building at scale ### Central Idea Piece - [What a Click Carries]() — By [Rina Takahashi]() · Published 2026-06-24 · Format: Central Idea Piece When a person clicks a button on a webpage, the infrastructure only sees the click. It never sees the reading, the context, the judgment, the acceptance of responsibility that preceded it. It never had to. The entire web assumed a human was present, so thoroughly that nobody wrote it down. Now agents produce identical HTTP requests without any of that invisible context. The sessions still fire. But the click has stopped carrying what every downstream system quietly depended on it to carry. ### Builder Profile - [What WorkArena's Task Design Makes Visible]() — By [Nora Kaplan]() · Published 2026-06-24 · Format: Builder Profile One benchmark task asks an agent to create a hardware asset in ServiceNow. The agent fills in fields, clicks submit, reaches a confirmation screen. WorkArena ignores the confirmation screen entirely. Its validator queries the database directly, checking whether saved values match the spec. An agent that navigated perfectly but corrupted data underneath would look like a success to anyone watching. That design choice, buried in validation code, surfaces a problem anyone deploying agents inside enterprise systems will eventually have to solve. ### Compliance Demand - [Show Me the Record — A Compliance Officer Confronts Her First Agent Workflow]() — Published 2026-06-24 *Prudence Tracewell describes herself as "the person whose signature means the firm thought about it." As Head of Supervisory Compliance at a mid-tier broker-dealer, she has spent fourteen years ensuring that when regulators come asking questions, the answers already exist in the record. Before that, she spent six years as an SEC examiner. She knows what those questions sound like from both sides of the table.* ### Payments Sidebar - [Money Makes Agents Legible]() — By [Rina Takahashi]() · Published 2026-06-24 An agent that fills out a form or monitors a price can operate in a gray area for a while. Nobody asks for its credentials. But the moment an agent tries to spend money on someone's behalf, a whole chain of participants needs to know it's there. ### Further Reading - **MCP Authorization Specification (2025-06-18)** — [Source]() — Published 2026-06-24 Names the confused-deputy problem with real precision, then makes authorization optional. The gap between specification and enforcement is the story. - **OpenAI's Computer-Using Agent (January 2025)** — [Source]() — Published 2026-06-24 The 58.1% WebArena score against 78.2% human performance is notable. The safety architecture that gap demands is more so. - **OWASP Top 10 for Agentic Applications (2026)** — [Source]() — Published 2026-06-24 Quietly redraws the threat model: the unit of security analysis becomes multi-step autonomous action, not individual model output. - **Anthropic Computer Use Tool Documentation** — [Source]() — Published 2026-06-24 Read the implementation guidance and you see the operational price of treating the GUI as an API: sandboxed containers, domain allowlists, human confirmation at every turn. - **OpenAI on Prompt Injection (November 2025)** — [Source]() — Published 2026-06-24 Makes explicit what practitioners already feel: injection risk scales with agent authority. More access and longer autonomy raise the cost of each failure. ### Past Articles - [Retry Logic Assumes a Contract That LLM Agents Can't Keep]() — By [Rina Takahashi]() · Published 2026-06-19 · Format: Retry Collision Retry logic in distributed systems works because of a quiet contract: same input, same execution path. An idempotency key ties attempts together, and the server returns a cached result instead of executing again. Agent systems inherit this discipline. But when an LLM decides which tools to call, token sampling variance means the same prompt can produce different tool selections, different parameters, different ordering on retry. Each individual tool call can be perfectly idempotent, and the composed sequence still produces different side effects on each attempt. One developer documented an agent double-charging a customer $847 when a timed-out payment triggered a retry that took a different path through the same workflow. - [The Web Wasn't Built for This]() — By [Nora Kaplan]() · Published 2026-06-19 · Format: Builder Profile To a person with a browser, a form field is a text box. To a machine trying to operate that same page, it's a hundred lines of nested HTML with the semantically important element buried under presentational scaffolding a visual cortex would simply ignore. Magnus Müller's Browser Use project started from a hobbyist's question about connecting LLMs to the web. His design choices since — rejecting vision-based navigation, treating site instability as a condition to absorb — trace the real complexity: the web was built for human interpreters, and operating it as a machine surfaces a mismatch that no selector strategy can bridge. - [The Wall That Used to Be There]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Enforcement Gap An agent running on an 8K-context model that entered a loop used to crash. The window filled, the API errored, the run died. That was an accidental safety mechanism, and it worked. Context windows now stretch past a million tokens, and the accidental wall is gone. A recent multi-agent loop ran for eleven days and $47,000 before a human noticed the billing dashboard. The team had monitoring. They could see it happening. They couldn't stop it programmatically. Watching and stopping, it turns out, require entirely different infrastructure. - [APIs for Websites That Don't Have APIs]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Builder Profile Suchintan Singh describes Skyvern as building "APIs for websites that don't have APIs." It sounds like a pitch deck line. But the phrase does real work if you've spent years watching ML platforms get measured by marketplace revenue, not model accuracy, and Selenium scripts break every time a frontend developer renames a CSS class. His team built a harder benchmark, scored below 50% on it, and published the results anyway. The architecture and the measurement both point the same direction: web agents are an infrastructure problem that the AI framing keeps obscuring. ## Other sections in Issue 35 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()