--- title: "Echoes" canonical: "https://current.tinyfish.ai/issue/37/echoes" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/37/echoes" issue: 37 section: "echoes" description: "Past infrastructure decisions echoing in today's production realities" authors: ["Nora Kaplan","Rina Takahashi"] published: 2026-07-12 updated: 2026-07-09 articles: 15 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 37 — Echoes Past infrastructure decisions echoing in today's production realities ### The Ambient Container - [The Weight of Being Logged In]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: The Ambient Container HTTP was designed to forget. Every request arrived clean, carrying no memory of what came before. Cookies fixed that — a continuity patch so a shopping cart could survive a page click. But the session that grew around that patch quietly absorbed identity, permissions, purchasing authority, organizational roles. "Being logged in" became the web's most powerful bundle of trust, attached automatically to every action you take. The whole arrangement rested on one assumption so obvious nobody wrote it down: a human was at the screen. Now something else is. ### The Fifteen-Minute Assumption - [The Fifteen Minutes That Assumed You'd Walk Away]() — By [Rina Takahashi]() · Published 2026-07-08 The 15-to-30-minute idle timeout is one of the most familiar conventions in application security. Its logic is straightforward: if a session goes quiet, the human probably left. Kill the session before someone else sits down. ### Session Policy Under Stress - [The Most Attentive User She's Ever Seen]() — Published 2026-07-08 *Nkechi Okonkwo is not a real person, though her problems very much are. She is a composite, assembled from conversations, conference hallway grumbles, and the particular weariness of people who've spent careers calibrating security controls around human behavior and now find themselves staring at something that behaves nothing like a human but carries perfectly valid credentials. Her colleagues call her "Timeout." She earned the nickname. She does not love it.* ### Two Paths to Identity - [The Cookie's Long Silence]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: Two Paths to Identity Lou Montulli's 1994 shopping-cart fix became the web's default identity bearer. Thirty years of security patches constrained how cookies travel. The question of who is steering never came up. Now browser-based agents inherit every ambient permission a cookie silently carries. The server on the other end receives the same headers it would from a person, because the cookie was never given a field for "who is driving." - [The Token That Learned to Name Names]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: Two Paths to Identity OAuth emerged because giving a photo-printing service your full password was terrifying. By 2020, RFC 8693 had defined a precise grammar for delegation: who asked, who's acting, what permissions, until when. A vocabulary purpose-built for the moment an agent acts on someone's behalf. It's been sitting in the spec for six years. Almost no agent platform uses it. ### Session Sources - **RFC 6265: HTTP State Management Mechanism** — [Source]() — Published 2026-07-08 The spec that made browsers remember. Server sets a token, browser sends it back, no questions asked. - **RFC 8693: OAuth 2.0 Token Exchange** — [Source]() — Published 2026-07-08 Introduces actor and subject vocabulary for delegation, precisely the distinction cookie-based sessions never learned to make. - **NIST SP 800-63B: Digital Identity Guidelines — Authentication and Lifecycle Management** — [Source]() — Published 2026-07-08 Authentication proves who you were at login. What happens after that is, per NIST, a different problem entirely. - **draft-ietf-httpbis-rfc6265bis: Cookie Revisions and SameSite Semantics** — [Source]() — Published 2026-07-08 How browsers started enforcing SameSite cookie restrictions before the standard was even finalized. The patch outran the spec. - **OWASP Session Management Cheat Sheet** — [Source]() — Published 2026-07-08 Practitioner guidance on timeouts, rotation, and anomaly detection. Every recommendation quietly assumes a human is sitting there. - **Lou Montulli: The Reasoning Behind Web Cookies** — [Source]() — Published 2026-07-08 The inventor explains why he built cookies to solve shopping carts while deliberately refusing to build tracking into the browser. ### Past Articles - [The Model That Measured Calm]() — By [Nora Kaplan]() · Published 2026-07-01 · Format: Two Maps, Two Reckonings Before 2008, Value-at-Risk gave banks a single daily number for market risk. Researchers published specific mathematical objections years earlier. Institutions navigated by the number anyway, because it was concrete and the caveats weren't. Agent benchmarks now carry the same gravitational pull: a clean score from a controlled environment, standing in for production reality. Whether we're watching the same pattern unfold depends on a measurement nobody has published yet. - [The Org Chart That Ran the Railroad]() — By [Nora Kaplan]() · Published 2026-07-01 · Format: Two Maps, Two Reckonings Daniel McCallum drew the first org chart in 1855 to coordinate a railroad. Within a century, every corporation had one, and somewhere along the way people stopped noticing that the chart described how work was supposed to flow, not how it did. Process mining finally made the divergence measurable. Now automated agents enter enterprise workflows carrying the documented version — and find a territory rearranged by people who never updated the map. - [What It Takes to Click a Button]() — By [Nora Kaplan]() · Published 2026-07-01 · Format: The Misread Map A person sees a button and clicks it in half a second. The gesture is so smooth it barely registers as a decision. But land that same click programmatically and you discover an elaborate chain of checks: Is the element visible? Has the page shifted? Is something covering the target? Each check patches a gap the DOM, the web's structural blueprint published in 1998, was never designed to bridge. Screen readers found that gap first. Test automation found it next. Now web agents are finding it at an entirely different scale. - [Money Complains in Structured Formats]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Mechanics and Money Visa, Mastercard, and Stripe are building agent payment infrastructure. The revealing detail is what happens when a purchase goes wrong. Chargebacks demand structured evidence, and structured evidence forces a distinction most web automation has never needed: the difference between performing an action and being authorized to perform it. ## Other sections in Issue 37 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Practitioner's Corner]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()