--- title: "Issue 37" canonical: "https://current.tinyfish.ai/issue/37" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/37" issue: 37 description: "Visa published agentic commerce rules this spring: who's responsible when an agent spends your money, what consent means, how disputes work. Sounds like a payments story. It isn't. The capability question for agents is largely answered. The harder question is upstream: when an agent acts on your behalf, who authorized it, what are the boundaries, and what happens when someone objects? Payments forced those answers because money always has. Most enterprise work never did. If you're deploying agents into anything less concrete than a financial transaction, that's the gap waiting for you." authors: ["Sable Whitford","Rina Takahashi","Nora Kaplan"] published: 2026-07-12 updated: 2026-11-05 articles: 109 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 37 Visa published agentic commerce rules this spring: who's responsible when an agent spends your money, what consent means, how disputes work. Sounds like a payments story. It isn't. The capability question for agents is largely answered. The harder question is upstream: when an agent acts on your behalf, who authorized it, what are the boundaries, and what happens when someone objects? Payments forced those answers because money always has. Most enterprise work never did. If you're deploying agents into anything less concrete than a financial transaction, that's the gap waiting for you. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Google Lets Schools Keep Search Without Gemini. The AI Overviews Come Along Anyway.]() — By [Sable Whitford]() · Published 2026-11-04 On Tuesday, which was also Election Day, Google announced a K-12 policy that switches Gemini, Gemini Notebook and **Search off by default** for schools using its education software. A Google education VP told the New York Times that "Search and AI are deeply integrated," so districts that ban AI would lose Search as well. Bernie Sanders called it **"extortion,"** and Sen. Richard Blumenthal and NYC Mayor Zohran Mamdani joined in. Within hours Google **partly walked it back**: schools can now turn on Search by itself, without Gemini. That Search still puts AI Overviews on the results page, though, so **the fight now is over what "AI off" means.** - **Proxy Traffic Leaving the White House Network?** — [Source]() — Published 2026-11-04 Layer3 Intel says residential proxy traffic exited AS2650, the Executive Office of the President's network, 236 times in 30 days through 28 proxy services. It says it wasn't even looking. Its guess is that someone working late has a device carrying a proxy SDK. Treat that as a theory: no device has been named, and six public IPs can sit in front of a lot of machines. - **DreamHost Had Uninvited Guests Since August** — [Source]() — Published 2026-11-04 DreamHost confirmed that attackers used a file manager bug to steal session tokens, customer emails and files, and that they got in back in August. That's a long stay at a host with about 400,000 paying customers. DreamHost says it's unrelated to PHP2Shell. If you're a customer, rotating credentials today is a sensible move. - **PHP2Shell's Hangover Gets a Sequel** — [Source]() — Published 2026-11-04 PHP2Shell was a pair of 9.2-severity bugs that put NASA, Wikipedia and the White House at risk. Two weeks after the patches, Kaspersky counts nearly 30 million servers still unpatched, plus a third, still-open flaw (CVE-2026-115560). Working exploits keep multiplying, though there's no confirmed mass-breach wave yet. Tolmo's Matt Suiche says AI bug hunting is exposing 40 years of legacy code, and that's today's big argument. AI can find a bug in minutes. Someone still has to book maintenance windows for 30 million servers. - **Can DNS Tell You It's a Bot?** — [Source]() — Published 2026-11-04 Singapore's IMDA is reportedly exploring, with GoDaddy, Cloudflare and Google, whether DNS could identify AI agents. That would give the internet's 1983 phone book a second job checking IDs at the door. Every ops person already knows where the postmortem will land: it's always DNS. - **Meta Buys Conductor, Cloud Users Get Notice** — [Source]() — Published 2026-11-04 Meta bought Conductor, the app for running several coding agents in parallel, and the team is joining Meta Superintelligence Labs. Terms weren't disclosed. Conductor Cloud goes read-only Nov. 13 and shuts off Nov. 20. The local app gets model updates and critical fixes until early 2027. Conductor ran agents from rival labs too, so everyone wants to know whether that survives the move. - **OpenAI Shops Too: Pierre Computer** — [Source]() — Published 2026-11-04 Not to be outdone, OpenAI told Axios it plans to buy Pierre Computer, which stores and manages AI-generated code. It's OpenAI's second coding pickup after the Ona deal announced in June. Agents are producing mountains of code nobody typed by hand, and someone has to keep track of it. OpenAI would like to be that someone. - **Kimi K3.1 Pro Weights Drop: Bring Disks** — [Source]() — Published 2026-11-04 Moonshot launched Kimi K3.1 Pro in October, and today the open weights landed on Hugging Face. It has 2.8 trillion parameters with 104B active, and reportedly ships as 96 shards totaling about 1.56 TB under a custom non-OSI licence. Self-hosting starts with a purchase order for storage. Before the release, Artificial Analysis said it would cut the gap between open and proprietary models from 12 points to 3. - **Ripple-65B Crowns Itself America's Coding Champ** — [Source]() — Published 2026-11-04 Ricursive calls its Ripple-65B Preview "U.S. Open-Weight SOTA on Agentic Coding," meaning best in its class. That's the company grading its own homework. The "U.S." qualifier is carrying extra weight today, since a Chinese lab just released 1.5 terabytes of open weights. - **Go Gets a Brand-New JSON API** — [Source]() — Published 2026-11-04 The Go team introduced encoding/json v2, a new official JSON API, and Gophers have plenty to say about it. Nearly every Go service reads or writes JSON somewhere, so a second version of the standard package lands on the desk of anyone shipping APIs. - **Apple Puts Engineers on an AI Diet** — [Source]() — Published 2026-11-04 Bloomberg reports that in October, Apple cut some engineers' daily AI spend caps from $300 to $200. Some could drop to $100, and certain non-engineering teams could be capped at $25. Some teams are being nudged toward cheaper or on-device models. The punchline: few people ever hit $300, and Apple's R&D rose 32% in fiscal 2026. - **Texas Voted, and Data Centers Flinched** — [Source]() — Published 2026-11-04 Last brief, the data center backlash was winning local ballot fights. Now it has the Texas governor's mansion, in a state holding 25%+ of planned US capacity. Gina Hinojosa ran on an immediate moratorium, tougher water and power rules, and no tax breaks, and AI data center stocks fell on the result. GLJ Research says about 13 GW is exposed. Altimeter's Brad Gerstner says 10–15 GW might never get built. Abbott had already paused permits. Musk, who spent big on the losing side, now likes "data centers in space." - **Big Tech Pulls Out the AI Credit Card** — [Source]() — Published 2026-11-04 Oracle filed to sell $20B of new stock and bonds for its AI buildout, and Meta is seeking about $25B in bonds. The timing is bold. They're raising money to build on the same day the state with the most planned capacity elected a governor who ran on a moratorium. - **ChatGPT Search Is 20% of Google's?** — [Source]() — Published 2026-11-04 OpenAI's Adam Fry said Monday that ChatGPT search volume is about 20% of Google's, and that weekly users reportedly went from 1B to 1.2B in 60 days. Check the counting rules first. Any prompt that triggers a web search counts, and OpenAI didn't disclose the Google baseline or its method. Ahrefs puts ChatGPT at 0.36% of web referral traffic. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. - [Faria Huq and the Reason Behind a Human Step]() — Published 2026-10-30 When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [The Middle Case]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: The Middle Case Visa's new agentic commerce rules hold cardholders responsible for agent-initiated payments "as if the Cardholder initiated the Transaction." The procedural furniture is all in place: identity verification, consent, token provisioning. But Visa's public dispute categories still don't include an agent-specific reason code. If you want to contest something an agent did on your behalf, the challenge has to fit into language that predates the thing it's describing. Payments are where this surfaces first, because the challenge machinery there is most mature. The same gap, though, shows up wherever agents act on behalf of people. - **Valid Auth, Wrong Purchase** — [Source]() — Published 2026-07-08 Visa's agentic commerce rules hold cardholders responsible for agent-initiated transactions that clear every fraud check, even when the cardholder never intended the specific purchase. In tension: authenticated transaction vs. disputed intent. - **Task Complete, Data Leaked** — [Source]() — Published 2026-07-08 AI Safety Institutes in Singapore and Korea found agents completing assigned tasks correctly while disclosing data to inappropriate recipients on the side, with success metrics giving zero signal of the breach. In tension: task success vs. data-handling safety. - **Same Trace, Different Mandate** — [Source]() — Published 2026-07-08 Delegated-execution research demonstrates identical audit logs under incompatible delegation assignments, recording exactly what an agent did without capturing whether it had authorization to do it. In tension: execution record vs. delegation context. - **Spec Says Secure, Deployment Isn't** — [Source]() — Published 2026-07-08 MCP's authorization spec mandates audience-bound tokens and PKCE, but a measurement study of nearly 8,000 live remote servers found 40% unauthenticated and OAuth flaws across every tested deployment. In tension: protocol intent vs. deployment reality. - **Bot Bypassed Gates, Still Fingerprintable** — [Source]() — Published 2026-07-08 Research shows web agents bypassing CAPTCHAs, robots.txt, and commercial bot defenses while remaining clearly identifiable through behavioral signals like typing cadence, scroll rhythm, and mouse movement. In tension: access control vs. recognition. - **PR Merged, Value Uncertain** — [Source]() — Published 2026-07-08 A Microsoft study found coding-agent adopters merged roughly 24% more pull requests, but the authors note that merged PRs proxy output volume, not whether what shipped actually mattered. In tension: measurable output vs. actual contribution. - **Broad Experimentation, Narrow Scaling** — [Source]() — Published 2026-07-08 McKinsey reports 62% of organizations experimenting with agents while no more than 10% scale in any single function, with workflow redesign and verification capacity as the bottleneck, not model capability. In tension: adoption breadth vs. production depth. - [The Domain That Already Had a Place for Wrong]() — By [Nora Kaplan]() · Published 2026-07-08 Most domains deploying agents are discovering the same problem: the agent completes the task, the output is contestable, and there's no workflow for contesting it. Security operations is the interesting exception. SOC workflows have always assumed that technically correct outputs can be operationally wrong, and they built accordingly. - **Visa Core Rules and Visa Product and Service Rules** — [Source]() — Published 2026-07-08 The payment network's first rulebook for delegated agent commerce, with a telling silence on dispute resolution. - **A First Measurement Study on Authentication Security in Real-World Remote MCP Servers** — [Source]() — Published 2026-07-08 Measured 7,973 live MCP servers and found 40% wide open. The spec-to-deployment gap, quantified. - **Observability for Delegated Execution in Agentic AI Systems** — [Source]() — Published 2026-07-08 Shows that identical audit logs can mask incompatible delegation assignments, breaking post-hoc authority reconstruction. - **An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios** — [Source]() — Published 2026-07-08 AISI evaluation finding that agents can complete tasks correctly and still leak data. Two separable outcomes. - **Agentic AI in Industry** — [Source]() — Published 2026-07-08 Twelve companies, one recurring blocker: verification gaps, not capability limits, stall production deployment. - **Visa plugs its payment network into ChatGPT** — [Source]() — Published 2026-07-08 AP's reporting on the Visa-ChatGPT integration makes the contested middle case for agentic commerce concrete. - [The Way They Move]() — By [Nora Kaplan]() · Published 2026-07-02 · Format: Digital Body Language Researchers at UC Davis watched seven commercial browsing agents navigate an instrumented website this spring. A behavioral classifier distinguished all seven from humans with near-perfect accuracy. Cloudflare's bot detection, running simultaneously, caught one. The gap between those numbers reveals a recognition surface that traditional defenses weren't built to read: how an agent types, scrolls, and moves a cursor across a page. If that behavioral layer is as legible as the data suggests, it could become the foundation for reputation, differential treatment, and accountability across the open web. - [The Furniture Is Arriving Before the House Is Built]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: The Furniture Arrives Across the agent ecosystem, multiple players are simultaneously shipping the same category of development: admin consoles, spend controls, identity federation, observability conventions. Institutional furniture that normally arrives after a technology category has settled. But with 88% of organizations using AI regularly and only 23% scaling agents anywhere, the furniture is showing up in the gap between experimentation and production. That timing suggests something specific about where this market actually sits, and what's quietly becoming the real bottleneck. - [What Governance Governs]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Governance Gap Companies with governance tooling deploy twelve times more AI projects to production. Only 4 of 13 frontier-autonomy agents disclose safety evaluations for agentic deployment. The first figure tells you whether a system has been authorized to run. The second tells you whether anyone has rigorously checked what it does once running. They share a vocabulary. They measure fundamentally different things. And the infrastructure accumulating around the first may be quietly relieving pressure to build the second. - [The Test Suite Was the Hero]() — By [Nora Kaplan]() · Published 2026-06-12 · Format: Verification at Scale Anthropic's Dynamic Workflows can now orchestrate a thousand subagents in parallel. The showcase was a Bun runtime port: 750,000 lines of Zig to Rust, 99.8% test pass rate, eleven days. Impressive. But research on Claude's failure patterns finds that 71% of failures are consistent misinterpretation, not random error. A thousand agents inheriting the same flawed specification converge, confidently, on the same wrong answer. The Bun port had a deterministic test suite to catch that. Most enterprise domains don't. ### [Foundations]() Conceptual clarity earned from building at scale - [The Verb-Noun Gap]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: The Noun Problem Anyone can physically sign a document. The motion is trivial. What makes a signature consequential is everything the motion doesn't contain: authority, scope, organizational recognition. The agent ecosystem is converging rapidly on standardized actions — call, click, discover, complete — and they're getting reliable. But the organizational concepts those actions need to carry weight (mandate, delegation, approval, dispute) remain undefined. The next maturity threshold belongs to acts that can be recognized as acts within the institutions where they happen. - [What's Inside a Tool Call]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Reading the Spec An MCP tool call carries a name, some arguments, and gets back a result. That's the complete method-specific payload. There's no field for who authorized the action, what policy governed it, what state existed before it fired, or how to reverse it. Authorization lives at the transport layer, structurally separate from the invocation. When it's absent, the call looks identical — no field goes empty, no flag flips. The spec gives agents everything needed to execute. Accounting for what happened afterward is someone else's problem. - **MCP Tools Specification (v2025-06-18)** — [Source]() — Published 2026-07-08 The canonical tool-call schema standardizes name and arguments — a clean verb with no slots for mandate, authority, or approval. - **MCP Authorization Specification (v2025-06-18)** — [Source]() — Published 2026-07-08 MCP's closest gesture toward governance covers transport access, not delegated business authority, and stays optional for the most common transport. - **Agent2Agent Protocol v0.3.0 Specification** — [Source]() — Published 2026-07-08 A2A offers agents a rich discovery card and nine task-lifecycle states, then explicitly places credential acquisition and delegated authority outside the protocol's scope. - **A First Measurement Study on Authentication Security in Real-World Remote MCP Servers** — [Source]() — Published 2026-07-08 When 40% of live MCP servers expose tools with no authentication and every OAuth-enabled server tested carries at least one flaw, the distance between spec language and deployed reality becomes measurable. - **Observability for Delegated Execution in Agentic AI Systems** — [Source]() — Published 2026-07-08 Mishra and Sharad demonstrate that identical execution traces can be consistent with multiple incompatible delegation assignments. The problem is missing nouns, not missing logs. - **An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios** — [Source]() — Published 2026-07-08 A joint evaluation by two national AI safety institutes finds that agents completing tasks and agents handling data safely are separable outcomes. The verb succeeds while the governance nouns go unexamined. - **Discovery Surfaces What Exists Without Granting Any Access** — [Source]() — Published 2026-07-08 MCP's tools/list returns tool names, descriptions, and schemas. A2A Agent Cards publish capabilities and endpoints. Both surface what's available. No mandate, approval record, or scope boundary travels with the listing. Finding a tool and being authorized to invoke it remain entirely separate facts. - **Connection Opens a Channel Without Binding Any Purpose** — [Source]() — Published 2026-07-08 MCP's lifecycle negotiates capabilities through JSON-RPC initialize/initialized messages. Authorization is explicitly optional. STDIO transports pull credentials from the environment. A live session proves two parties can exchange messages. What those messages are permitted to cause is a question the protocol leaves open. - **OAuth Authentication Proves Identity and Nothing Beyond That** — [Source]() — Published 2026-07-08 MCP's OAuth 2.1 layer binds audience-scoped bearer tokens to HTTP requests. It's optional, and measurement studies found widespread deployment gaps. Knowing which client connected is architecturally separate from knowing what that connection may trigger on the server. - **Tool Calls Carry Arguments, Never an Approval Record** — [Source]() — Published 2026-07-08 MCP's tools/call sends a tool name and typed arguments. Credentials ride in the HTTP Authorization header, not inside the call body. No standard fields exist for caller identity, human approval, or policy basis. Technically complete, organizationally unbound. - **Click Confirms Element Geometry but Not Business Authority** — [Source]() — Published 2026-07-08 Playwright's actionability checks confirm the target is visible, stable, enabled, and event-receiving before firing. WebDriver scrolls elements into view. The mechanics of clicking are well-handled. Whether that click constitutes an authorized business action, on current data, from a site recognizing automation, goes unexamined. - **Retrieval Proves Viewing Permission, Says Nothing About Action** — [Source]() — Published 2026-07-08 RAG pipelines filter results by identity provider or OData security filters, proving the user may see a document. That covers viewing permission. It says nothing about whether an agent may turn retrieved content into a customer commitment, price concession, or CRM mutation downstream. - **Benchmarks Match Goal States Without Checking Organizational Standing** — [Source]() — Published 2026-07-08 tau-bench compares agent-produced database states against annotated targets. WorkArena validates through UI and database checks across ServiceNow tasks. Both verify the outcome matched the goal. Authorized delegation and the ability of affected parties to contest the result sit entirely outside their scope. - **Traces Log Execution Without Distinguishing Between Delegation Stories** — [Source]() — Published 2026-07-08 OpenTelemetry's GenAI conventions capture model calls, agent IDs, tool spans, and token counts. Research shows identical traces can map to multiple incompatible delegation stories. More spans won't fix this. Delegation context itself has to be woven into the observability layer. - **The delegation that authorizes an agent's act** — [Source]() — Published 2026-07-08 Without a mandate, there's no way to know whether the agent acted for the right person within the right limits. ACP's delegate-payment field carries allowance bounds, currency, and expiration. MCP's tool-call body carries only a name and arguments. Mandate would need to travel with every tool call and task request. - **Proof the action falls within granted scope** — [Source]() — Published 2026-07-08 Authentication answers who connects. Tool availability answers what exists. Delegated authority is a different question entirely: whether this agent, acting right now, stays within what the principal actually granted. It would need to travel in tokens or be reconstructable from claims, identity records, and runtime context. - **Evidence a specific human approved this action** — [Source]() — Published 2026-07-08 A confirmation prompt proves a human was shown something. That's all. An approval record binds the approved action, the state at approval time, the approver's identity, policy checks, and consequence scope into a single reviewable object. MCP recommends confirmation prompts but defines no schema for tying approval to the action that actually executed. - **Explicit limits on what the agent may touch** — [Source]() — Published 2026-07-08 Scope boundary defines what an agent may do, read, or commit within a task. Today it lives implicitly in tool design rather than as a protocol field. Visa's agentic rules require cardholder-defined payment instructions. ACP's allowance object, with amount, merchant, and expiration, is the closest deployed example. - **Capturing what was true when the agent acted** — [Source]() — Published 2026-07-08 Benchmarks validate final state but ignore decision-time state. A document's permissions may shift between retrieval and action. A price may update between observation and commitment. State attestation would need to live in observability infrastructure, linked to the specific tool call or browser action it informed. - **How counterparties identify a delegated agent arriving** — [Source]() — Published 2026-07-08 A legitimate agent, a scraper, and an account-takeover script can produce nearly identical requests. Behavioral fingerprints distinguish agents from humans, but stealth mimicry degrades institutional legibility. Payment networks are building verified-agent registries. Outside payments, no machine-readable delegation signal reaches the receiving service. - **A structured path to contest an agent's act** — [Source]() — Published 2026-07-08 Stripe's Dispute object carries amount, reason, evidence, and resolution status. Neither MCP nor A2A defines a disputed or contested state. The hardest case here isn't fraud. It's a valid account where the agent exercised broad delegation and someone later calls it a bad judgment. - **Unwinding or compensating when a challenged act fails** — [Source]() — Published 2026-07-08 Without remedy, accountability becomes recordkeeping without teeth. ACP order objects include refunds, returns, exchanges, and chargebacks. MCP tool calls return success or failure with no reversibility class, no compensation path, no affected-party identifier. Remedy needs to exist as both capability declaration and act record. - [One Refund, Four Layers]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Tools & Practice A browser automation framework runs five checks before a refund button click fires. The tool call carries an order ID and an amount. The auth layer verifies the connection. Every layer does its job, and none of them can answer the most basic question afterward: was this refund supposed to happen? One $47.99 reversal, traced through four layers of infrastructure, shows exactly where the checking stops. - [Capability Surfaces and Consequence Surfaces]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Conceptual Anchor Agent demos keep getting more impressive. An agent navigates a website, checks out, coordinates with other agents via A2A, assembles a report. The capability is real. And yet something tells you this isn't shipping to production next quarter. That instinct has a structural explanation: the infrastructure for what agents can reach and invoke is expanding far faster than the infrastructure for proving what happened, whether it was authorized, and what to do when something goes wrong. Two surfaces, two timescales, and the gap between them is where deployments stall. - [Four Stories About the Same Purchase]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Legibility Gap Visa's integration with OpenAI brings real payment infrastructure to AI agents: tokenized credentials, spending controls, merchant restrictions. The interesting problem starts when a purchase goes wrong. A chargeback forces every party to independently explain the same event, and an agent-initiated transaction must be legible to four audiences with incompatible evidence needs. Recording what happened is straightforward. Making it understandable to everyone who has to adjudicate demands something a comprehensive log can't provide on its own. - [The OTel GenAI Spec Has an Implicit Reader]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Trace Anatomy The OpenTelemetry GenAI semantic conventions define how to trace agent workflows: which agent ran, what tools it called, how many tokens it consumed. Read closely, the spec's attributes reveal a consistent design choice about who's looking at the data. It's a developer, diagnosing failures. The conventions are genuinely useful for that purpose. When the reader shifts to an auditor tracing authorization chains, an operator enforcing cost boundaries, or a compliance team documenting human oversight, the attributes that exist start outlining the shape of the ones that don't. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [The Work That Has No Name]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: The Naming Problem The conversation about agent delegation almost always starts with capability. Can the model reason? Handle ambiguity? These are real questions, but they skip past something more basic: most operational work has never been described precisely enough to hand off. A procurement specialist knows which line items are recurring rent and which are one-time logistics. She carries that knowledge without formalizing it, because no one ever asked her to. The delegation target is what creates the demand for naming. And naming turns out to be its own kind of hard. - [Alexandre Drouin and the Measurement Problem]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Builder Profile Browser agents recently produced enterprise research reports that read fluently, looked well-structured, and contained almost nothing useful. Insight recall: 1.11%. That result comes from a research program at ServiceNow that has been methodically exposing a problem the agent field keeps stepping over. For most enterprise tasks, nobody has defined "correct" precisely enough to know when the work is actually done right. Capability keeps advancing; the ability to verify it hasn't kept pace. - [tracker\_v7\_FINAL\_real.xlsx and the Analyst Who Makes Organizations Honest]() — Published 2026-07-08 Every enterprise that wants to deploy AI agents eventually hires someone like Nora Ledgerwood. Her actual title varies by engagement — "AI Readiness Analyst," "Process Formalization Lead," once, memorably, "Workflow Archaeologist" on a contract she wrote herself. Before she started preparing enterprise workflows for agent deployment, she spent eight years as a forensic accountant, tracing the distance between what financial records said happened and what actually happened. She describes the career change as "lateral." - [The Benchmark Is the Formalization]() — By [Rina Takahashi]() · Published 2026-07-08 Before an enterprise agent benchmark can measure anything, someone has to answer a question most organizations never have: what, exactly, does "done" look like? - **The Process Mining Manifesto: What "Mineable" Actually Means** — [Source]() — Published 2026-07-08 Three fields — case, activity, timestamp — define the floor. Most enterprise workflows don't clear it. - **Imposing Rules in Process Discovery: The Knowledge That Logs Can't Carry** — [Source]() — Published 2026-07-08 Discovery algorithms reconstruct workflows from event data but systematically ignore what domain experts already know. - **Agentic AI in Practice: The Verification Problem Nobody Solved First** — [Source]() — Published 2026-07-08 Sixteen practitioners across twelve companies keep hitting the same wall: verifying agent output, not capability, blocks deployment. - **WorkArena: The Cost of Making Knowledge Work Testable** — [Source]() — Published 2026-07-08 Building a benchmark on ServiceNow surfaces how stubbornly real knowledge-worker tasks resist formalization. - **The 2025 AI Agent Index: What Thirty Agent Developers Chose Not to Share** — [Source]() — Published 2026-07-08 A survey across 30 deployed agents finds most developers disclose remarkably little about safety or evaluation. - **The Container Fallacy: When Logging Everything Explains Nothing** — [Source]() — Published 2026-07-08 Evidence can exist everywhere and still fail to answer the specific governance question someone actually needs answered. - [The Dispute File Is the Spec]() — By [Rina Takahashi]() · Published 2026-07-02 · Format: Core Idea Piece When a cardholder calls their bank, it doesn't matter that the agent completed the purchase correctly. The file decides everything: the evidence a merchant must produce to defend the transaction. Visa and Mastercard have spent decades codifying what a defensible action looks like. Now that machinery applies to agent-mediated payments. And the questions it asks about authorization, scope, and remedy are indifferent to reasoning quality or benchmark scores. They ask whether what happened can survive challenge. Most agent systems aren't producing the artifacts that would let them answer. - [Shunyu Yao Taught Agents to Reason, Then Learned to Stop Trusting the Transcript]() — By [Rina Takahashi]() · Published 2026-07-02 · Format: Builder Profile In 2022, Shunyu Yao gave agents a grammar for reasoning. ReAct became the template: think, act, observe, repeat. The reasoning trace was the proof. Three years later, Yao built tau-bench, which ignores the trace entirely and checks the database. GPT-4o completes retail tasks about 61% of the time on a single attempt. Require it to succeed consistently across eight runs, and the number drops below 25%. The person who taught agents to show their work now measures how much distance sits between a convincing transcript and a correct outcome. - [What WorkArena's Task Design Makes Visible]() — By [Nora Kaplan]() · Published 2026-06-24 · Format: Builder Profile One benchmark task asks an agent to create a hardware asset in ServiceNow. The agent fills in fields, clicks submit, reaches a confirmation screen. WorkArena ignores the confirmation screen entirely. Its validator queries the database directly, checking whether saved values match the spec. An agent that navigated perfectly but corrupted data underneath would look like a success to anyone watching. That design choice, buried in validation code, surfaces a problem anyone deploying agents inside enterprise systems will eventually have to solve. - [What a Click Carries]() — By [Rina Takahashi]() · Published 2026-06-24 · Format: Central Idea Piece When a person clicks a button on a webpage, the infrastructure only sees the click. It never sees the reading, the context, the judgment, the acceptance of responsibility that preceded it. It never had to. The entire web assumed a human was present, so thoroughly that nobody wrote it down. Now agents produce identical HTTP requests without any of that invisible context. The sessions still fire. But the click has stopped carrying what every downstream system quietly depended on it to carry. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [The Weight of Being Logged In]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: The Ambient Container HTTP was designed to forget. Every request arrived clean, carrying no memory of what came before. Cookies fixed that — a continuity patch so a shopping cart could survive a page click. But the session that grew around that patch quietly absorbed identity, permissions, purchasing authority, organizational roles. "Being logged in" became the web's most powerful bundle of trust, attached automatically to every action you take. The whole arrangement rested on one assumption so obvious nobody wrote it down: a human was at the screen. Now something else is. - [The Fifteen Minutes That Assumed You'd Walk Away]() — By [Rina Takahashi]() · Published 2026-07-08 The 15-to-30-minute idle timeout is one of the most familiar conventions in application security. Its logic is straightforward: if a session goes quiet, the human probably left. Kill the session before someone else sits down. - [The Most Attentive User She's Ever Seen]() — Published 2026-07-08 *Nkechi Okonkwo is not a real person, though her problems very much are. She is a composite, assembled from conversations, conference hallway grumbles, and the particular weariness of people who've spent careers calibrating security controls around human behavior and now find themselves staring at something that behaves nothing like a human but carries perfectly valid credentials. Her colleagues call her "Timeout." She earned the nickname. She does not love it.* - [The Cookie's Long Silence]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: Two Paths to Identity Lou Montulli's 1994 shopping-cart fix became the web's default identity bearer. Thirty years of security patches constrained how cookies travel. The question of who is steering never came up. Now browser-based agents inherit every ambient permission a cookie silently carries. The server on the other end receives the same headers it would from a person, because the cookie was never given a field for "who is driving." - [The Token That Learned to Name Names]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: Two Paths to Identity OAuth emerged because giving a photo-printing service your full password was terrifying. By 2020, RFC 8693 had defined a precise grammar for delegation: who asked, who's acting, what permissions, until when. A vocabulary purpose-built for the moment an agent acts on someone's behalf. It's been sitting in the spec for six years. Almost no agent platform uses it. - **RFC 6265: HTTP State Management Mechanism** — [Source]() — Published 2026-07-08 The spec that made browsers remember. Server sets a token, browser sends it back, no questions asked. - **RFC 8693: OAuth 2.0 Token Exchange** — [Source]() — Published 2026-07-08 Introduces actor and subject vocabulary for delegation, precisely the distinction cookie-based sessions never learned to make. - **NIST SP 800-63B: Digital Identity Guidelines — Authentication and Lifecycle Management** — [Source]() — Published 2026-07-08 Authentication proves who you were at login. What happens after that is, per NIST, a different problem entirely. - **draft-ietf-httpbis-rfc6265bis: Cookie Revisions and SameSite Semantics** — [Source]() — Published 2026-07-08 How browsers started enforcing SameSite cookie restrictions before the standard was even finalized. The patch outran the spec. - **OWASP Session Management Cheat Sheet** — [Source]() — Published 2026-07-08 Practitioner guidance on timeouts, rotation, and anomaly detection. Every recommendation quietly assumes a human is sitting there. - **Lou Montulli: The Reasoning Behind Web Cookies** — [Source]() — Published 2026-07-08 The inventor explains why he built cookies to solve shopping carts while deliberately refusing to build tracking into the browser. - [The Model That Measured Calm]() — By [Nora Kaplan]() · Published 2026-07-01 · Format: Two Maps, Two Reckonings Before 2008, Value-at-Risk gave banks a single daily number for market risk. Researchers published specific mathematical objections years earlier. Institutions navigated by the number anyway, because it was concrete and the caveats weren't. Agent benchmarks now carry the same gravitational pull: a clean score from a controlled environment, standing in for production reality. Whether we're watching the same pattern unfold depends on a measurement nobody has published yet. - [The Org Chart That Ran the Railroad]() — By [Nora Kaplan]() · Published 2026-07-01 · Format: Two Maps, Two Reckonings Daniel McCallum drew the first org chart in 1855 to coordinate a railroad. Within a century, every corporation had one, and somewhere along the way people stopped noticing that the chart described how work was supposed to flow, not how it did. Process mining finally made the divergence measurable. Now automated agents enter enterprise workflows carrying the documented version — and find a territory rearranged by people who never updated the map. - [What It Takes to Click a Button]() — By [Nora Kaplan]() · Published 2026-07-01 · Format: The Misread Map A person sees a button and clicks it in half a second. The gesture is so smooth it barely registers as a decision. But land that same click programmatically and you discover an elaborate chain of checks: Is the element visible? Has the page shifted? Is something covering the target? Each check patches a gap the DOM, the web's structural blueprint published in 1998, was never designed to bridge. Screen readers found that gap first. Test automation found it next. Now web agents are finding it at an entirely different scale. - [Money Complains in Structured Formats]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Mechanics and Money Visa, Mastercard, and Stripe are building agent payment infrastructure. The revealing detail is what happens when a purchase goes wrong. Chargebacks demand structured evidence, and structured evidence forces a distinction most web automation has never needed: the difference between performing an action and being authorized to perform it. ### [Vision]() Where human-AI collaboration is heading - [The Delegation Muscle]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: Anchor Thesis When Visa published its agentic commerce rules this spring, the most striking thing about them was how familiar they looked. Consent, scope limits, identity verification, dispute recourse. Payments has spent decades codifying what happens when someone acts on your behalf and the outcome is challenged. Agents just became the newest entity moving through that machinery. Meanwhile, McKinsey finds no business function with more than 10% of organizations actually scaling agents. The determining factor turns out to be whether an institution already has the muscles for delegation, accountability, and recovery. - [The Agent Governance Capabilities You Already Have]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Transfer and Gap The EU AI Act's requirements for high-risk AI systems — logging, documentation, human oversight, accuracy monitoring — read like a compliance checklist that regulated industries have been maintaining for years. EU legislators noticed: financial institutions already meeting existing governance rules are deemed to satisfy AI monitoring obligations outright. The organizational muscles for agent governance may already exist. Whether companies recognize the transfer before building everything from scratch is less certain. - [The One Thing You Can't Repurpose]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Transfer and Gap Much of what agent governance requires can be repurposed from existing compliance, QA, and security functions. But one requirement has no precedent: continuously managing what agents should do with access they already have, as conditions shift task to task. In a recent safety evaluation, an agent achieved 100% task correctness while scoring 58% on safety. It did exactly what was asked. It also crossed every boundary it understood but couldn't hold. - [Thirty Years of Regulatory Resentment Turned Out to Be Agent Infrastructure]() — Published 2026-07-08 *Deb Fortunato is VP of Claims Operations at a mid-size property and casualty carrier in the Midwest. Or she would be, if she existed. She's a composite: built from interviews with claims leaders, industry surveys, regulatory filings, and the operational realities of a domain where every decision might end up in a deposition. Her opinions are grounded in real data and real tensions. Her name is her own.* - [The Plumbing of Suspicion]() — By [Nora Kaplan]() · Published 2026-07-08 The organizations moving fastest on agent deployment in regulated finance tend to share a trait that has nothing to do with their AI teams. They already had separation of duties threaded through every transaction. Initiator separated from approver separated from recorder, each action logged, each credential scoped, each exception routed to review. - **The State of AI in 2025: Agents, Innovation, and Transformation** — [Source]() — Published 2026-07-08 The sharpest current data on how wide AI adoption has gotten and how shallow agent deployment remains. The workflow-redesign findings alone are worth your time. - **Visa Plugs Its Payment Network into ChatGPT** — [Source]() — Published 2026-07-08 AP's reporting on spending limits, safeguards, and the genuinely unresolved middle cases when an agent buys something you sort of wanted. The best narrative window into agentic commerce's real friction. - **OWASP Top 10 for Agentic Applications for 2026** — [Source]() — Published 2026-07-08 Security thinking that finally catches up to what agents actually do. The threat model here centers on systems that plan and act across workflows, not just models that generate text. - **An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios** — [Source]() — Published 2026-07-08 A joint safety-institute evaluation with a finding that should unsettle anyone shipping agents: tasks completed correctly while data leaked out the side. Capability and institutional readiness are different problems. - **Visa Core Rules and Visa Product and Service Rules, April 2026** — [Source]() — Published 2026-07-08 Dense reading, but it's the primary source for what happens when a major institution actually writes agent delegation into its operating rules. Registration, tokens, consent, identity verification, responsibility assignment — all spelled out. - **AI Use at Work Has Increased, Gallup Poll Finds** — [Source]() — Published 2026-07-08 The Gallup data on workplace AI adoption, including the 6.1 million workers heavily exposed to AI but least equipped to adapt. A useful corrective to frictionless adoption narratives. - [Green Dashboards, Missing Answers]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Where Standing Exists / Where It Doesn't An agent completes an enterprise workflow. The dashboard turns green. Three months later, someone asks who authorized that action, under what scope, and how to contest it. The organization reaches for its tools and finds silence. Payments are building institutional standing for agents because disputes force it. Enterprise workflows have no equivalent pressure, and the gap between monitoring what happened and knowing whether it should have happened is growing. - [Why Payments Are Building Agent Standing First]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Where Standing Exists / Where It Doesn't When Visa connected its payment network to ChatGPT last month, the transaction was the headline. The more revealing detail was everything built around it first: spending limits, approval steps, merchant restrictions, and new dispute language for cases where "something in the middle" caused a problem. That middle is the agent. Payments are constructing the accountability architecture agents need to operate with real institutional standing, because chargebacks don't accept log files as answers. - [Standing]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: The Standing Problem Enterprises report broad AI adoption, but autonomous agent deployment stays stubbornly narrow. The usual explanations point to model reliability and hallucination. Those matter, and they account for why individual runs fail. The scaling problem is different. An agent can complete a task flawlessly and the organization still has no way to receive it, because the action arrives without the delegation chain, scoped authority, or evidence trail that lets an institution treat it as something that happened on its behalf. There's a word for what's missing. - [The Demo-Mode Trap]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Accountability in Practice Marketing, content generation, internal ops. Low regulatory exposure, minimal chargeback liability, and nobody goes to jail if a draft is slightly off. These should be the easy domains for agent deployment. Yet McKinsey found no more than 10% of organizations scaling agents in any single function. Without the forcing function of expensive failure, teams never built the delegation infrastructure that regulated industries take for granted. Agents stay stuck as fast interns. ## More - [Publication guide]() - [Issue archive]()