Share

Conceptual Anchor

Capability Surfaces and Consequence Surfaces

By Rina Takahashi— July 1, 2026

Feature image for article: Capability Surfaces and Consequence Surfaces

Agent demos keep getting more impressive. An agent navigates a website, checks out, coordinates with other agents via A2A, assembles a report. The capability is real. And yet something tells you this isn't shipping to production next quarter. That instinct has a structural explanation: the infrastructure for what agents can reach and invoke is expanding far faster than the infrastructure for proving what happened, whether it was authorized, and what to do when something goes wrong. Two surfaces, two timescales, and the gap between them is where deployments stall.

Conceptual Anchor

Capability Surfaces and Consequence Surfaces

By Rina Takahashi— July 1, 2026

Agent demos keep getting more impressive. An agent navigates a website, checks out, coordinates with other agents via A2A, assembles a report. The capability is real. And yet something tells you this isn't shipping to production next quarter. That instinct has a structural explanation: the infrastructure for what agents can reach and invoke is expanding far faster than the infrastructure for proving what happened, whether it was authorized, and what to do when something goes wrong. Two surfaces, two timescales, and the gap between them is where deployments stall.

Tools & Practice

One Refund, Four Layers

By Rina Takahashi— July 1, 2026

Feature image for article: One Refund, Four Layers

A browser automation framework runs five checks before a refund button click fires. The tool call carries an order ID and an amount. The auth layer verifies the connection. Every layer does its job, and none of them can answer the most basic question afterward: was this refund supposed to happen? One $47.99 reversal, traced through four layers of infrastructure, shows exactly where the checking stops.

Tools & Practice

One Refund, Four Layers

By Rina Takahashi— July 1, 2026

A browser automation framework runs five checks before a refund button click fires. The tool call carries an order ID and an amount. The auth layer verifies the connection. Every layer does its job, and none of them can answer the most basic question afterward: was this refund supposed to happen? One $47.99 reversal, traced through four layers of infrastructure, shows exactly where the checking stops.

Further Reading

Visa Plugs Its Payment Network Into ChatGPT, Letting AI Agents Shop and Pay for UsersSpending limits, merchant restrictions, fraud monitoring: Visa is building the consequence infrastructure that makes agent commerce possible at all.

OWASP Top 10 for Agentic Applications (2026)A security framework built specifically for systems that plan, decide, and act across workflows. The threat model itself is the interesting part.

Quick links

The State of AI in 2025: Agents, Innovation, and Transformation

MCP Authorization Specification (2025-06-18)

OWASP Non-Human Identities Top 10

Expanding Reach

Agents are only as useful as what they can actually reach. Over the past year, that reach has been getting formalized: protocols for connecting to tools and data, standards for agents to locate and coordinate with other agents, and browser automation primitives that define how software interacts with web interfaces mechanically.

These four developments shape what we'd call the capability surface. Each one makes a different category of interaction programmatically addressable, whether that's invoking a tool, discovering a peer, or clicking a button that's finished animating.

Expanding Reach

Agents are only as useful as what they can actually reach. Over the past year, that reach has been getting formalized: protocols for connecting to tools and data, standards for agents to locate and coordinate with other agents, and browser automation primitives that define how software interacts with web interfaces mechanically.

These four developments shape what we'd call the capability surface. Each one makes a different category of interaction programmatically addressable, whether that's invoking a tool, discovering a peer, or clicking a button that's finished animating.

Tool Protocol

MCP Formalizes How Agents Connect to Tools

The June 2025 MCP specification builds on JSON-RPC 2.0 to give LLM applications a standard interface to external capabilities. Servers expose three primitives: resources (data and context), prompts (templated workflows), and tools (executable functions). Authorization follows OAuth 2.1 with explicit token audience binding per RFC 8707.

Agent Discovery

A2A Protocol Lets Agents Find Each Other

Hosted by the Linux Foundation since June 2025 and backed by over 100 companies, A2A v0.3.0 specifies how agents discover and coordinate with peers. The key mechanism is the Agent Card: a machine-readable manifest declaring identity, capabilities, endpoints, and security requirements.

Browser Automation

Playwright Verifies Targets Before Every Browser Action

Playwright's actionability system auto-waits before each interaction, confirming that elements are visible, stable (not mid-animation), enabled, and unobstructed by overlapping content. If any check fails within the configured timeout, the action raises a TimeoutError rather than clicking blindly into whatever's there.

Browser Control

W3C WebDriver Specifies Remote Browser Control Primitives

The May 2026 Working Draft defines a platform-neutral HTTP wire protocol for remote browser introspection and control, covering navigation, element interaction, script execution, and screen capture. One telling detail: its navigator.webdriver flag explicitly announces to pages that automation is driving the session.

Catching Up

Agents can already browse, buy things, fill out forms, and close transactions. The capability is there. What's still catching up is everything surrounding the action: who authorized it, how it shows up in a ledger, what happens when something goes wrong.

Call it the consequence surface. Across payment networks, security organizations, and research labs, new infrastructure is being built to make agent behavior legible, bounded, and reversible. Governance arriving after the capability it governs. The pattern holds even as most enterprises remain stuck between experimenting with agents and actually running them in production. Independence, it turns out, requires a lot of scaffolding.

Catching Up

Agents can already browse, buy things, fill out forms, and close transactions. The capability is there. What's still catching up is everything surrounding the action: who authorized it, how it shows up in a ledger, what happens when something goes wrong.

Call it the consequence surface. Across payment networks, security organizations, and research labs, new infrastructure is being built to make agent behavior legible, bounded, and reversible. Governance arriving after the capability it governs. The pattern holds even as most enterprises remain stuck between experimenting with agents and actually running them in production. Independence, it turns out, requires a lot of scaffolding.

Agentic Payments

Visa Plugs Its Payment Network Into ChatGPT

Visa embedded payment infrastructure directly inside ChatGPT, letting agents shop and buy at any Visa-accepting merchant. Users configure spending caps, approved merchant lists, and which purchases require human sign-off. Most early transactions, Visa expects, will still involve a person.

Agent Identity

Mastercard Says Agents Must Register Before Paying

Mastercard's Agent Pay framework requires AI agents to be verified and registered before they can transact. Agentic Tokens encode consumer-set spending limits and merchant restrictions. Every agent-initiated purchase becomes identifiable across the payment chain, and authorization can be revoked in real time.

Security Framework

OWASP Catalogs Ten Security Risks for Autonomous Agents

The peer-reviewed framework targets AI systems that plan, decide, and act on their own. It covers threats from goal hijacking to rogue agent behavior, introduces "least agency" as a design principle, and draws from confirmed incidents rather than hypotheticals.

Agent Detection

Typing and Scrolling Patterns Give Browsing Agents Away

UC Davis researchers instrumented a honey website to compare seven browsing agents against human visitors. Browser fingerprints alone didn't reliably distinguish them. Behavioral signals did: paste-based text entry, direct jumps to click targets, and distinctive scrolling rhythms separated agents from people every time.