--- title: "Echoes" canonical: "https://current.tinyfish.ai/issue/38/echoes" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/38/echoes" issue: 38 section: "echoes" description: "Past infrastructure decisions echoing in today's production realities" authors: ["Sable Whitford","Nora Kaplan"] published: 2026-07-20 updated: 2026-07-17 articles: 15 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 38 — Echoes Past infrastructure decisions echoing in today's production realities ### The Settlement - [The Click as Social Settlement]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Settlement Every click on "Place Order" or "I Agree" carries a compressed bundle of assumptions: visibility, intent, authority, accountability. Three foundational specs across four decades each assumed a human body would be present and perceiving, so none of them bothered to say so out loud. Now software agents can locate the button, invoke the event, transmit the form. They inherit everything the interface requires. Everything except the body that made the whole arrangement hold together. ### Before the Click - [The Record Was There Before the Click]() — By [Sable Whitford]() · Published 2026-07-15 Every batch job submitted to an IBM mainframe carried a [JOB statement](https://en.wikipedia.org/wiki/Job_Control_Language): submitter name, billing account, job class, log routing, completion notification destination. The machine didn't trust your presence. It trusted the record. You declared who you were, who paid, and where the evidence went *before* anything ran. ### Intent After Delegation - [You Can't Adjudicate a Vibe — A Dispute Analyst on What Happens When AI Does the Buying]() — Published 2026-07-15 *Margot Voss works in dispute risk at a major card network. She has spent eleven years adjudicating chargebacks, the formal process by which a cardholder contests a transaction and the network decides who pays. For the past year, she has been on a small team focused on what the industry calls "agent-initiated transactions": purchases made not by a person tapping a card or clicking a button, but by AI software acting on a person's behalf.* ### Mechanics and New Terms - [Delivery vs. Accountability]() — By [Sable Whitford]() · Published 2026-07-15 · Format: Mechanics and New Terms Twenty years of browser automation engineering solved one question with extraordinary precision: did we click the thing? Selenium guessed. WebDriver calculated center points and checked for obstructions. Playwright added stability gates and event-readiness checks. Each generation made delivery more reliable. None of them ever asked whether the click should count. They didn't have to. A person was always behind the browser, carrying the accountability that no protocol bothered to name. - [The Expired Settlement]() — By [Sable Whitford]() · Published 2026-07-15 · Format: Mechanics and New Terms A click from an authenticated session used to be enough. Enough to buy, authorize, trigger. The human supplied the intent; the intent justified the action. Now Visa is embedding payment rails inside AI agents, Mastercard wants agents registered before they can spend, and the old settlement is expiring in public. The early design choices are revealing what "enough" has to mean when nobody's sitting behind the browser anymore. ### Primary Sources - **The Xerox Star Retrospective** — [Source]() — Published 2026-07-15 Where "point at something visible and act on it" became the foundational bargain every graphical interface inherited without renegotiating. - **RFC 1866: HTML 2.0 Specification** — [Source]() — Published 2026-07-15 The original web form model gave us GET and POST as structured intention, but left business meaning, identity, and authorization entirely to someone else's problem. - **Selenium Project History** — [Source]() — Published 2026-07-15 Browser automation was born to test a time-and-expenses app. It asked whether software could replicate a human's click and, having answered yes, moved on without asking what that click should carry. - **W3C WebDriver Specification** — [Source]() — Published 2026-07-15 Scroll-into-view checks, obscurance calculations, center-point geometry, event dispatch. Hundreds of words specifying how to deliver a click to a coordinate, and nothing about whether the clicker has standing to act. - **Visa Embeds Its Payment Network in ChatGPT** — [Source]() — Published 2026-07-15 When an AI agent crosses a live payment rail, the old settlement surfaces fast. "Something acted on my behalf" becomes a dispute category no chargeback process was designed for. - **RFC 8693: OAuth 2.0 Token Exchange** — [Source]() — Published 2026-07-15 The delegation vocabulary already exists here. Token exchange defines an "actor" claim that distinguishes who is acting from whose authority backs the action. The click never learned to speak it. ### Past Articles - [The Token That Learned to Name Names]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: Two Paths to Identity OAuth emerged because giving a photo-printing service your full password was terrifying. By 2020, RFC 8693 had defined a precise grammar for delegation: who asked, who's acting, what permissions, until when. A vocabulary purpose-built for the moment an agent acts on someone's behalf. It's been sitting in the spec for six years. Almost no agent platform uses it. - [The Cookie's Long Silence]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: Two Paths to Identity Lou Montulli's 1994 shopping-cart fix became the web's default identity bearer. Thirty years of security patches constrained how cookies travel. The question of who is steering never came up. Now browser-based agents inherit every ambient permission a cookie silently carries. The server on the other end receives the same headers it would from a person, because the cookie was never given a field for "who is driving." - [The Weight of Being Logged In]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: The Ambient Container HTTP was designed to forget. Every request arrived clean, carrying no memory of what came before. Cookies fixed that — a continuity patch so a shopping cart could survive a page click. But the session that grew around that patch quietly absorbed identity, permissions, purchasing authority, organizational roles. "Being logged in" became the web's most powerful bundle of trust, attached automatically to every action you take. The whole arrangement rested on one assumption so obvious nobody wrote it down: a human was at the screen. Now something else is. - [The Model That Measured Calm]() — By [Nora Kaplan]() · Published 2026-07-01 · Format: Two Maps, Two Reckonings Before 2008, Value-at-Risk gave banks a single daily number for market risk. Researchers published specific mathematical objections years earlier. Institutions navigated by the number anyway, because it was concrete and the caveats weren't. Agent benchmarks now carry the same gravitational pull: a clean score from a controlled environment, standing in for production reality. Whether we're watching the same pattern unfold depends on a measurement nobody has published yet. ## Other sections in Issue 38 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Practitioner's Corner]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()