--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/36/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/36/foundations" issue: 36 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Rina Takahashi","Nora Kaplan"] published: 2026-07-06 updated: 2026-07-02 articles: 21 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 36 — Foundations Conceptual clarity earned from building at scale ### Conceptual Anchor - [Capability Surfaces and Consequence Surfaces]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Conceptual Anchor Agent demos keep getting more impressive. An agent navigates a website, checks out, coordinates with other agents via A2A, assembles a report. The capability is real. And yet something tells you this isn't shipping to production next quarter. That instinct has a structural explanation: the infrastructure for what agents can reach and invoke is expanding far faster than the infrastructure for proving what happened, whether it was authorized, and what to do when something goes wrong. Two surfaces, two timescales, and the gap between them is where deployments stall. ### Tools & Practice - [One Refund, Four Layers]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Tools & Practice A browser automation framework runs five checks before a refund button click fires. The tool call carries an order ID and an amount. The auth layer verifies the connection. Every layer does its job, and none of them can answer the most basic question afterward: was this refund supposed to happen? One $47.99 reversal, traced through four layers of infrastructure, shows exactly where the checking stops. ### Further Reading - **Visa Plugs Its Payment Network Into ChatGPT, Letting AI Agents Shop and Pay for Users** — [Source]() — Published 2026-07-01 Spending limits, merchant restrictions, fraud monitoring: Visa is building the consequence infrastructure that makes agent commerce possible at all. - **OWASP Top 10 for Agentic Applications (2026)** — [Source]() — Published 2026-07-01 A security framework built specifically for systems that plan, decide, and act across workflows. The threat model itself is the interesting part. - **The State of AI in 2025: Agents, Innovation, and Transformation** — [Source]() — Published 2026-07-01 62% of organizations experimenting with agents, 23% scaling them, no single function above 10% at scale. The bottleneck looks like accountability, not capability. - **MCP Authorization Specification (2025-06-18)** — [Source]() — Published 2026-07-01 Audience-bound tokens and confused-deputy risks at the protocol level. Worth reading for how authority boundaries get drawn before agents touch anything. - **OWASP Non-Human Identities Top 10** — [Source]() — Published 2026-07-01 Offboarding, secret leakage, overprivilege, long-lived credentials. Agent identity as a lifecycle problem, not a point-in-time authentication check. ### Expanding Reach Agents are only as useful as what they can actually reach. Over the past year, that reach has been getting formalized: protocols for connecting to tools and data, standards for agents to locate and coordinate with other agents, and browser automation primitives that define how software interacts with web interfaces mechanically. These four developments shape what we'd call the capability surface. Each one makes a different category of interaction programmatically addressable, whether that's invoking a tool, discovering a peer, or clicking a button that's finished animating. - **MCP Formalizes How Agents Connect to Tools** — [Source]() — Published 2026-07-01 Tag: Tool Protocol The June 2025 MCP specification builds on JSON-RPC 2.0 to give LLM applications a standard interface to external capabilities. Servers expose three primitives: resources (data and context), prompts (templated workflows), and tools (executable functions). Authorization follows OAuth 2.1 with explicit token audience binding per RFC 8707. - **A2A Protocol Lets Agents Find Each Other** — [Source]() — Published 2026-07-01 Tag: Agent Discovery Hosted by the Linux Foundation since June 2025 and backed by over 100 companies, A2A v0.3.0 specifies how agents discover and coordinate with peers. The key mechanism is the Agent Card: a machine-readable manifest declaring identity, capabilities, endpoints, and security requirements. - **Playwright Verifies Targets Before Every Browser Action** — [Source]() — Published 2026-07-01 Tag: Browser Automation Playwright's actionability system auto-waits before each interaction, confirming that elements are visible, stable (not mid-animation), enabled, and unobstructed by overlapping content. If any check fails within the configured timeout, the action raises a TimeoutError rather than clicking blindly into whatever's there. - **W3C WebDriver Specifies Remote Browser Control Primitives** — [Source]() — Published 2026-07-01 Tag: Browser Control The May 2026 Working Draft defines a platform-neutral HTTP wire protocol for remote browser introspection and control, covering navigation, element interaction, script execution, and screen capture. One telling detail: its navigator.webdriver flag explicitly announces to pages that automation is driving the session. ### Catching Up Agents can already browse, buy things, fill out forms, and close transactions. The capability is there. What's still catching up is everything surrounding the action: who authorized it, how it shows up in a ledger, what happens when something goes wrong. Call it the consequence surface. Across payment networks, security organizations, and research labs, new infrastructure is being built to make agent behavior legible, bounded, and reversible. Governance arriving after the capability it governs. The pattern holds even as most enterprises remain stuck between experimenting with agents and actually running them in production. Independence, it turns out, requires a lot of scaffolding. - **Visa Plugs Its Payment Network Into ChatGPT** — [Source]() — Published 2026-07-02 Tag: Agentic Payments Visa embedded payment infrastructure directly inside ChatGPT, letting agents shop and buy at any Visa-accepting merchant. Users configure spending caps, approved merchant lists, and which purchases require human sign-off. Most early transactions, Visa expects, will still involve a person. - **Mastercard Says Agents Must Register Before Paying** — [Source]() — Published 2026-07-02 Tag: Agent Identity Mastercard's Agent Pay framework requires AI agents to be verified and registered before they can transact. Agentic Tokens encode consumer-set spending limits and merchant restrictions. Every agent-initiated purchase becomes identifiable across the payment chain, and authorization can be revoked in real time. - **OWASP Catalogs Ten Security Risks for Autonomous Agents** — [Source]() — Published 2026-07-02 Tag: Security Framework The peer-reviewed framework targets AI systems that plan, decide, and act on their own. It covers threats from goal hijacking to rogue agent behavior, introduces "least agency" as a design principle, and draws from confirmed incidents rather than hypotheticals. - **Typing and Scrolling Patterns Give Browsing Agents Away** — [Source]() — Published 2026-07-02 Tag: Agent Detection UC Davis researchers instrumented a honey website to compare seven browsing agents against human visitors. Browser fingerprints alone didn't reliably distinguish them. Behavioral signals did: paste-based text entry, direct jumps to click targets, and distinctive scrolling rhythms separated agents from people every time. - **Plenty of Agent Experiments, Very Few at Scale** — [Source]() — Published 2026-07-02 Tag: Deployment Gap McKinsey's latest State of AI survey puts numbers on a widely felt reality: 62% of organizations are experimenting with agents, but only 23% have scaled any agentic system. No single business function has crossed 10% scaled adoption. The distance between pilot and production remains vast. - **Some Agents Bypassed Every Anti-Bot Defense Tested** — [Source]() — Published 2026-07-02 Tag: Access Control A June 2026 preprint found that certain browsing agents slipped past all tested anti-bot mechanisms, CAPTCHAs and commercial protection services included. Read alongside the behavioral fingerprinting work, the picture is mixed: detection is achievable, but the adversarial floor keeps shifting underneath it. ### Past Articles - [Four Stories About the Same Purchase]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Legibility Gap Visa's integration with OpenAI brings real payment infrastructure to AI agents: tokenized credentials, spending controls, merchant restrictions. The interesting problem starts when a purchase goes wrong. A chargeback forces every party to independently explain the same event, and an agent-initiated transaction must be legible to four audiences with incompatible evidence needs. Recording what happened is straightforward. Making it understandable to everyone who has to adjudicate demands something a comprehensive log can't provide on its own. - [The OTel GenAI Spec Has an Implicit Reader]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Trace Anatomy The OpenTelemetry GenAI semantic conventions define how to trace agent workflows: which agent ran, what tools it called, how many tokens it consumed. Read closely, the spec's attributes reveal a consistent design choice about who's looking at the data. It's a developer, diagnosing failures. The conventions are genuinely useful for that purpose. When the reader shifts to an auditor tracing authorization chains, an operator enforcing cost boundaries, or a compliance team documenting human oversight, the attributes that exist start outlining the shape of the ones that don't. - [The Context Window Fills Up Long Before It's Full]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Conceptual Piece A model with a 200K token context window starts degrading at 50K. Selective retrieval using a quarter of the tokens beats full-context loading by nearly 20 accuracy points. The finding gives "context engineering" its teeth. The work is keeping the context window clean. But teams choosing a context strategy today are choosing a reliability envelope with no data on what that envelope actually contains. The research to measure it hasn't been done. - [Where the Snapshot Lives Changes Everything Else]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Tool Architecture Study Playwright now ships two modes for agent-driven browser automation. One streams page snapshots into the LLM's context window. The other writes them to disk as files. The token difference is 4x. The difference in what each mode leaves behind after the session ends is harder to quantify and harder to ignore. One produces artifacts you can diff and inspect independently of the agent's own account. The other stores observation and inference in the same stream, inseparable after the fact. Where the snapshot lives turns out to determine what you can verify. ## Other sections in Issue 36 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()