--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/37/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/37/foundations" issue: 37 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Nora Kaplan","Rina Takahashi"] published: 2026-07-12 updated: 2026-07-09 articles: 28 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 37 — Foundations Conceptual clarity earned from building at scale ### The Noun Problem - [The Verb-Noun Gap]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: The Noun Problem Anyone can physically sign a document. The motion is trivial. What makes a signature consequential is everything the motion doesn't contain: authority, scope, organizational recognition. The agent ecosystem is converging rapidly on standardized actions — call, click, discover, complete — and they're getting reliable. But the organizational concepts those actions need to carry weight (mandate, delegation, approval, dispute) remain undefined. The next maturity threshold belongs to acts that can be recognized as acts within the institutions where they happen. ### Reading the Spec - [What's Inside a Tool Call]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Reading the Spec An MCP tool call carries a name, some arguments, and gets back a result. That's the complete method-specific payload. There's no field for who authorized the action, what policy governed it, what state existed before it fired, or how to reverse it. Authorization lives at the transport layer, structurally separate from the invocation. When it's absent, the call looks identical — no field goes empty, no flag flips. The spec gives agents everything needed to execute. Accounting for what happened afterward is someone else's problem. ### Primary Sources - **MCP Tools Specification (v2025-06-18)** — [Source]() — Published 2026-07-08 The canonical tool-call schema standardizes name and arguments — a clean verb with no slots for mandate, authority, or approval. - **MCP Authorization Specification (v2025-06-18)** — [Source]() — Published 2026-07-08 MCP's closest gesture toward governance covers transport access, not delegated business authority, and stays optional for the most common transport. - **Agent2Agent Protocol v0.3.0 Specification** — [Source]() — Published 2026-07-08 A2A offers agents a rich discovery card and nine task-lifecycle states, then explicitly places credential acquisition and delegated authority outside the protocol's scope. - **A First Measurement Study on Authentication Security in Real-World Remote MCP Servers** — [Source]() — Published 2026-07-08 When 40% of live MCP servers expose tools with no authentication and every OAuth-enabled server tested carries at least one flaw, the distance between spec language and deployed reality becomes measurable. - **Observability for Delegated Execution in Agentic AI Systems** — [Source]() — Published 2026-07-08 Mishra and Sharad demonstrate that identical execution traces can be consistent with multiple incompatible delegation assignments. The problem is missing nouns, not missing logs. - **An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios** — [Source]() — Published 2026-07-08 A joint evaluation by two national AI safety institutes finds that agents completing tasks and agents handling data safely are separable outcomes. The verb succeeds while the governance nouns go unexamined. ### Verbs the Ecosystem Has Every protocol in the agent stack moves something specific across the wire. A schema. A bearer token. A pointer event. A span. The clarifying exercise is mapping where each verb's payload actually stops. These eight cards trace a path from discovery through execution to observability. Each names a protocol, describes what it delivers, and identifies the point where the technical guarantee ends and the governance question begins. A pattern emerges quickly: the ecosystem has largely standardized how agents reach things and invoke them. How organizations authorize, bound, or contest what agents do remains almost entirely unspecified. That gap looks structural, not developmental. - **Discovery Surfaces What Exists Without Granting Any Access** — [Source]() — Published 2026-07-08 Tag: Agent Discovery MCP's tools/list returns tool names, descriptions, and schemas. A2A Agent Cards publish capabilities and endpoints. Both surface what's available. No mandate, approval record, or scope boundary travels with the listing. Finding a tool and being authorized to invoke it remain entirely separate facts. - **Connection Opens a Channel Without Binding Any Purpose** — [Source]() — Published 2026-07-08 Tag: Session Layer MCP's lifecycle negotiates capabilities through JSON-RPC initialize/initialized messages. Authorization is explicitly optional. STDIO transports pull credentials from the environment. A live session proves two parties can exchange messages. What those messages are permitted to cause is a question the protocol leaves open. - **OAuth Authentication Proves Identity and Nothing Beyond That** — [Source]() — Published 2026-07-08 Tag: Identity Layer MCP's OAuth 2.1 layer binds audience-scoped bearer tokens to HTTP requests. It's optional, and measurement studies found widespread deployment gaps. Knowing which client connected is architecturally separate from knowing what that connection may trigger on the server. - **Tool Calls Carry Arguments, Never an Approval Record** — [Source]() — Published 2026-07-08 Tag: Tool Invocation MCP's tools/call sends a tool name and typed arguments. Credentials ride in the HTTP Authorization header, not inside the call body. No standard fields exist for caller identity, human approval, or policy basis. Technically complete, organizationally unbound. - **Click Confirms Element Geometry but Not Business Authority** — [Source]() — Published 2026-07-08 Tag: Browser Action Playwright's actionability checks confirm the target is visible, stable, enabled, and event-receiving before firing. WebDriver scrolls elements into view. The mechanics of clicking are well-handled. Whether that click constitutes an authorized business action, on current data, from a site recognizing automation, goes unexamined. - **Retrieval Proves Viewing Permission, Says Nothing About Action** — [Source]() — Published 2026-07-08 Tag: Context Retrieval RAG pipelines filter results by identity provider or OData security filters, proving the user may see a document. That covers viewing permission. It says nothing about whether an agent may turn retrieved content into a customer commitment, price concession, or CRM mutation downstream. - **Benchmarks Match Goal States Without Checking Organizational Standing** — [Source]() — Published 2026-07-08 Tag: State Validation tau-bench compares agent-produced database states against annotated targets. WorkArena validates through UI and database checks across ServiceNow tasks. Both verify the outcome matched the goal. Authorized delegation and the ability of affected parties to contest the result sit entirely outside their scope. - **Traces Log Execution Without Distinguishing Between Delegation Stories** — [Source]() — Published 2026-07-08 Tag: Execution Trace OpenTelemetry's GenAI conventions capture model calls, agent IDs, tool spans, and token counts. Research shows identical traces can map to multiple incompatible delegation stories. More spans won't fix this. Delegation context itself has to be woven into the observability layer. ### Nouns the Ecosystem Needs Agent protocols specify how to connect and how to invoke. They don't yet specify how to govern. MCP defines a tool call as a name and arguments. A2A defines task states like submitted, working, and completed. Neither carries the governance objects that would make an agent's act accountable, bounded, or reversible. Commerce is further along because payment rails already carry structures for authorization, dispute, and reversal. Money makes vague delegation operationally intolerable. Outside payments, these concepts remain application-defined or entirely absent. The eight nouns below name what's missing: governance primitives that would need to exist before an agent's act can survive institutional scrutiny. - **The delegation that authorizes an agent's act** — [Source]() — Published 2026-07-08 Tag: Principal Delegation Without a mandate, there's no way to know whether the agent acted for the right person within the right limits. ACP's delegate-payment field carries allowance bounds, currency, and expiration. MCP's tool-call body carries only a name and arguments. Mandate would need to travel with every tool call and task request. - **Proof the action falls within granted scope** — [Source]() — Published 2026-07-08 Tag: Authority Proof Authentication answers who connects. Tool availability answers what exists. Delegated authority is a different question entirely: whether this agent, acting right now, stays within what the principal actually granted. It would need to travel in tokens or be reconstructable from claims, identity records, and runtime context. - **Evidence a specific human approved this action** — [Source]() — Published 2026-07-08 Tag: Binding Approval A confirmation prompt proves a human was shown something. That's all. An approval record binds the approved action, the state at approval time, the approver's identity, policy checks, and consequence scope into a single reviewable object. MCP recommends confirmation prompts but defines no schema for tying approval to the action that actually executed. - **Explicit limits on what the agent may touch** — [Source]() — Published 2026-07-08 Tag: Session Limits Scope boundary defines what an agent may do, read, or commit within a task. Today it lives implicitly in tool design rather than as a protocol field. Visa's agentic rules require cardholder-defined payment instructions. ACP's allowance object, with amount, merchant, and expiration, is the closest deployed example. - **Capturing what was true when the agent acted** — [Source]() — Published 2026-07-08 Tag: Decision State Benchmarks validate final state but ignore decision-time state. A document's permissions may shift between retrieval and action. A price may update between observation and commitment. State attestation would need to live in observability infrastructure, linked to the specific tool call or browser action it informed. - **How counterparties identify a delegated agent arriving** — [Source]() — Published 2026-07-08 Tag: Counterparty Identity A legitimate agent, a scraper, and an account-takeover script can produce nearly identical requests. Behavioral fingerprints distinguish agents from humans, but stealth mimicry degrades institutional legibility. Payment networks are building verified-agent registries. Outside payments, no machine-readable delegation signal reaches the receiving service. - **A structured path to contest an agent's act** — [Source]() — Published 2026-07-08 Tag: Formal Challenge Stripe's Dispute object carries amount, reason, evidence, and resolution status. Neither MCP nor A2A defines a disputed or contested state. The hardest case here isn't fraud. It's a valid account where the agent exercised broad delegation and someone later calls it a bad judgment. - **Unwinding or compensating when a challenged act fails** — [Source]() — Published 2026-07-08 Tag: Operational Consequence Without remedy, accountability becomes recordkeeping without teeth. ACP order objects include refunds, returns, exchanges, and chargebacks. MCP tool calls return success or failure with no reversibility class, no compensation path, no affected-party identifier. Remedy needs to exist as both capability declaration and act record. ### Past Articles - [One Refund, Four Layers]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Tools & Practice A browser automation framework runs five checks before a refund button click fires. The tool call carries an order ID and an amount. The auth layer verifies the connection. Every layer does its job, and none of them can answer the most basic question afterward: was this refund supposed to happen? One $47.99 reversal, traced through four layers of infrastructure, shows exactly where the checking stops. - [Capability Surfaces and Consequence Surfaces]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Conceptual Anchor Agent demos keep getting more impressive. An agent navigates a website, checks out, coordinates with other agents via A2A, assembles a report. The capability is real. And yet something tells you this isn't shipping to production next quarter. That instinct has a structural explanation: the infrastructure for what agents can reach and invoke is expanding far faster than the infrastructure for proving what happened, whether it was authorized, and what to do when something goes wrong. Two surfaces, two timescales, and the gap between them is where deployments stall. - [Four Stories About the Same Purchase]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Legibility Gap Visa's integration with OpenAI brings real payment infrastructure to AI agents: tokenized credentials, spending controls, merchant restrictions. The interesting problem starts when a purchase goes wrong. A chargeback forces every party to independently explain the same event, and an agent-initiated transaction must be legible to four audiences with incompatible evidence needs. Recording what happened is straightforward. Making it understandable to everyone who has to adjudicate demands something a comprehensive log can't provide on its own. - [The OTel GenAI Spec Has an Implicit Reader]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Trace Anatomy The OpenTelemetry GenAI semantic conventions define how to trace agent workflows: which agent ran, what tools it called, how many tokens it consumed. Read closely, the spec's attributes reveal a consistent design choice about who's looking at the data. It's a developer, diagnosing failures. The conventions are genuinely useful for that purpose. When the reader shifts to an auditor tracing authorization chains, an operator enforcing cost boundaries, or a compliance team documenting human oversight, the attributes that exist start outlining the shape of the ones that don't. ## Other sections in Issue 37 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()