---
title: "Echoes"
canonical: "https://current.tinyfish.ai/issue/39/echoes"
publication: "TinyFish"
publisher: "TinyFish"
language: "en-US"
guide: "https://current.tinyfish.ai/llms.txt"
permalink: "https://current.tinyfish.ai/issue/39/echoes"
issue: 39
section: "echoes"
description: "Past infrastructure decisions echoing in today's production realities"
authors: ["Sevda Polat","Sable Whitford","Nora Kaplan"]
published: 2026-07-27
updated: 2026-07-23
articles: 15
---

# TinyFish

> CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made.

[Read on the website](<https://current.tinyfish.ai/issue/39/echoes>)

## Issue 39 — Echoes

Past infrastructure decisions echoing in today's production realities

### The Reduced Form

- [What the Form Carried](<https://current.tinyfish.ai/issue/39/echoes/article/32314/markdown>) — By [Sevda Polat](<https://current.tinyfish.ai/team/200/markdown>) · Published 2026-07-23 · Format: The Reduced Form

A U.S. military pocket purchase order once had four color-coded carbon copies. White went to finance. Blue went to the vendor. Pink served as the receiving and accounting record. Green stayed with the purchaser. Tear along the perforation and the institutional workflow was already in motion — the object was the process. When HTML formalized the `<form>` element in 1995, it reproduced the data-collection surface with real precision: name/value pairs, a destination URI, a method. Everything else was left out of scope. No authority. No routing. No accountability structure. Automated agents now fill out what remains.

### The Carbon Copy

- [The Colors Were the Routing Table](<https://current.tinyfish.ai/issue/39/echoes/article/32306/markdown>) — By [Sevda Polat](<https://current.tinyfish.ai/team/200/markdown>) · Published 2026-07-23

A three-part carbonless invoice created three institutional records the instant a pen touched paper. White to the customer. Yellow to accounting. Pink to the field technician. The colors were routing instructions embedded in the physical structure of the document itself. You could audit the form set at a glance: are all parts present? Who has them? Distribution was something the paper *did*, not something someone remembered to configure afterward.

### The Forms Designer

- [An Interview with the Woman Who Designed Systems That Happened to Fit on Paper](<https://current.tinyfish.ai/issue/39/echoes/article/32313/markdown>) — Published 2026-07-23

*Dolores "Dot" Pfeiffer retired from the General Services Administration in 1985 after thirty-one years in forms management. She does not exist. But the discipline she represents was thoroughly real, formally codified, and staffed by people who took it seriously. The practices described here are drawn from declassified agency records, official government guidance, and congressional history.*

### Restoring the Furniture

- [What the Approval Chain Was Holding Together](<https://current.tinyfish.ai/issue/39/echoes/article/32315/markdown>) — By [Sevda Polat](<https://current.tinyfish.ai/team/200/markdown>) · Published 2026-07-23 · Format: Restoring the Furniture

For decades, enterprise workflow systems painstakingly rebuilt institutional process in software: approval chains, role assignments, audit trails, digital signatures. Each layer reconstructed authority that screens had quietly stripped away. Then bots arrived and navigated those surfaces without inheriting any of the logic underneath. A GSA Inspector General audit showed what that looks like in practice: security plans written for human users that never once mentioned the bots clicking through them.

- [The Newest Furniture](<https://current.tinyfish.ai/issue/39/echoes/article/32316/markdown>) — By [Sevda Polat](<https://current.tinyfish.ai/team/200/markdown>) · Published 2026-07-23 · Format: Restoring the Furniture

Visa and Cloudflare, solving different problems in different industries, independently arrived at the same structural move: re-deriving paper-era governance concepts for automated actors. Mandate scope. Purpose classification. Delegation ceilings. A notarized letter from 1950 carried these elements without trying. Now they are being spelled out as API fields and HTTP-layer defaults, because the actors occupying these systems carry less institutional context than any that came before.

### Further Reading

- **RFC 1866: HTML 2.0 Specification — The Forms Section** — [Source](<https://datatracker.ietf.org/doc/rfc1866/>) — Published 2026-07-23

The spec that gave us name-value pairs and action URIs but never once asked who was typing. Worth reading for what it assumes.

- **David Bearman, "Diplomatics, New Uses for an Old Science"** — [Source](<https://archivo.cartagena.es/doc/Archivos_Social_Studies/Vol2_n1/02-bearman_diplomatics.pdf>) — Published 2026-07-23

Bearman traces how institutions spent centuries encoding authority into paper documents. The web rebuilt the form but skipped that entire discipline.

- **Visa Rules — Agentic Transaction Framework (April 2026)** — [Source](<https://usa.visa.com/content/dam/VCOM/download/about-visa/visa-rules-public.pdf>) — Published 2026-07-23

When payments forced the question of delegated action, Visa wrote operating rules for mandate, consent, and credential. The most concrete version of this problem becoming governance.

- **GSA Office of Inspector General: RPA Security Audit (2024)** — [Source](<https://www.oversight.gov/sites/default/files/documents/reports/2024-08/A230020-Final-Report-Redacted.pdf>) — Published 2026-07-23

A federal audit found 119 bots accessing sensitive systems with no identity records and no revocation process. A preview of reach without governance.

- **Ben Shneiderman on Direct Manipulation Interfaces** — [Source](<https://www.cs.umd.edu/~ben/about.html>) — Published 2026-07-23

Shneiderman's 1983 principles assumed a human who could see the result, judge it, and reverse course. Agents keep the gesture but lose that perceptual loop entirely.

- **WebArena: A Realistic Web Environment for Building Autonomous Agents (ICLR 2024)** — [Source](<https://proceedings.iclr.cc/paper_files/paper/2024/hash/4410c0711e9154a7a2d26f9b3816d1ef-Abstract-Conference.html>) — Published 2026-07-23

The best agent scored 14% where humans hit 78%. Read it less as a capability benchmark and more as evidence of the gap between clicking through a form and completing a business task.

### Past Articles

- [The Expired Settlement](<https://current.tinyfish.ai/issue/39/echoes/article/31141/markdown>) — By [Sable Whitford](<https://current.tinyfish.ai/team/201/markdown>) · Published 2026-07-15 · Format: Mechanics and New Terms

A click from an authenticated session used to be enough. Enough to buy, authorize, trigger. The human supplied the intent; the intent justified the action. Now Visa is embedding payment rails inside AI agents, Mastercard wants agents registered before they can spend, and the old settlement is expiring in public. The early design choices are revealing what "enough" has to mean when nobody's sitting behind the browser anymore.

- [Delivery vs. Accountability](<https://current.tinyfish.ai/issue/39/echoes/article/31140/markdown>) — By [Sable Whitford](<https://current.tinyfish.ai/team/201/markdown>) · Published 2026-07-15 · Format: Mechanics and New Terms

Twenty years of browser automation engineering solved one question with extraordinary precision: did we click the thing? Selenium guessed. WebDriver calculated center points and checked for obstructions. Playwright added stability gates and event-readiness checks. Each generation made delivery more reliable. None of them ever asked whether the click should count. They didn't have to. A person was always behind the browser, carrying the accountability that no protocol bothered to name.

- [The Click as Social Settlement](<https://current.tinyfish.ai/issue/39/echoes/article/31139/markdown>) — By [Sable Whitford](<https://current.tinyfish.ai/team/201/markdown>) · Published 2026-07-15 · Format: The Settlement

Every click on "Place Order" or "I Agree" carries a compressed bundle of assumptions: visibility, intent, authority, accountability. Three foundational specs across four decades each assumed a human body would be present and perceiving, so none of them bothered to say so out loud. Now software agents can locate the button, invoke the event, transmit the form. They inherit everything the interface requires. Everything except the body that made the whole arrangement hold together.

- [The Token That Learned to Name Names](<https://current.tinyfish.ai/issue/39/echoes/article/29877/markdown>) — By [Nora Kaplan](<https://current.tinyfish.ai/team/26/markdown>) · Published 2026-07-08 · Format: Two Paths to Identity

OAuth emerged because giving a photo-printing service your full password was terrifying. By 2020, RFC 8693 had defined a precise grammar for delegation: who asked, who's acting, what permissions, until when. A vocabulary purpose-built for the moment an agent acts on someone's behalf. It's been sitting in the spec for six years. Almost no agent platform uses it.

## Other sections in Issue 39

- [Daily Brief](<https://current.tinyfish.ai/issue/39/daily-brief/markdown>)
- [Market Pulse](<https://current.tinyfish.ai/issue/39/market-pulse/markdown>)
- [Foundations](<https://current.tinyfish.ai/issue/39/foundations/markdown>)
- [Practitioner's Corner](<https://current.tinyfish.ai/issue/39/practitioners-corner/markdown>)
- [Vision](<https://current.tinyfish.ai/issue/39/vision/markdown>)

## More

- [Publication guide](<https://current.tinyfish.ai/llms.txt>)
- [Issue archive](<https://current.tinyfish.ai/issues/markdown>)