--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/39/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/39/foundations" issue: 39 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Sable Whitford","Nora Kaplan","Rina Takahashi"] published: 2026-07-27 updated: 2026-07-23 articles: 24 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 39 — Foundations Conceptual clarity earned from building at scale ### Evidence Locker Concept - [The Evidence Locker]() — By [Sable Whitford]() · Published 2026-07-23 · Format: Evidence Locker Concept An agent updates a billing tier, submits a regulatory form, merges a PR. Three days later someone shows up asking who authorized it. You reach for what you have: traces built for engineers debugging execution, outputs built for users seeing results. Neither answers the question. Both look like evidence because they're detailed, but specificity isn't verification. The evidence locker is a third artifact, designed for the stakeholder who arrives after the fact needing to accept, contest, or unwind what an agent did. Its contents scale with how hard the work is to reverse. ### SQL Evidence Bundle - [What a Query Result Needs Before It Counts]() — By [Sable Whitford]() · Published 2026-07-23 · Format: SQL Evidence Bundle An agent runs a query. $14.2M comes back, clean execution, no errors. Looks like an answer. But the best-evaluated system in the EntSQL benchmark hit 15.9% accuracy when enterprise domain knowledge was required, and the benchmarks themselves carry annotation error rates above 50%. That number isn't an answer. It's a claim wearing a suit. What follows builds the evidence bundle that makes such a claim contestable, element by element, each layer entering because the previous one left something dangerously exposed. ### Evidence Across the Stack - **GenAI Observability** — [Source]() — Published 2026-07-23 Traces capture the skeleton of agent execution. Prompt content and tool arguments stay hidden behind opt-in gates. - **EntSQL: Grounding Text-to-SQL in Long-Context Enterprise Knowledge** — [Source]() — Published 2026-07-23 Top systems hit 15.9% accuracy when queries required business knowledge the schema alone couldn't provide. - **Pervasive Annotation Errors Break Text-to-SQL Benchmarks and Leaderboards** — [Source]() — Published 2026-07-23 Over half the "correct" labels in major benchmarks are wrong. Hard to trust evidence built on corrupted ground truth. - **A First Measurement Study on Authentication Security in Real-World Remote MCP Servers** — [Source]() — Published 2026-07-23 Four in ten live MCP servers accept unauthenticated calls. No credentials, no audit trail, no evidence of who acted. - **Adoption and Impact of Command-Line AI Coding Agents at Microsoft** — [Source]() — Published 2026-07-23 Merged PRs become the proxy for agent productivity. Useful signal, but review infrastructure reveals its own blind spots. - **MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP** — [Source]() — Published 2026-07-23 Poisoned tool descriptions redirect agents 84% of the time with 0.3% detection. Metadata is an attack surface, not a trust signal. ### What's in the Locker An agent run produces a trace. It logged the calls, returned the output, maybe even succeeded. But a trace tells you what happened. It doesn't tell you whether the outcome was allowed to stand. That second question demands a record, not a log. And the shape of that record depends entirely on what kind of agent ran and what kind of scrutiny might follow. A dashboard annotation and a wire transfer don't warrant the same evidence bundle. Below are five cards, one per agent type, listing the minimum artifacts that should survive a run. Think of them as checklists shaped by the specific challenge each agent type will most likely face later. - **The Number Means Nothing Without the Query** — [Source]() — Published 2026-07-23 Tag: SQL Agents Versioned metric definition and source documentation consulted. Generated SQL with dialect assumptions noted. Raw execution results plus sample rows. Known caveats and exclusions. Reviewer context: who saw the full evidence bundle before the number traveled downstream. Business meaning dies once prose leaves the query behind. - **Browser Runs Start With Who Said Go** — [Source]() — Published 2026-07-23 Tag: Browser Agents Delegated authority chain showing who authorized the action and its scope. Target-site recognition status (did the site accept automated access, or resist it?). State snapshots before and after. Session evidence including auth source and challenges encountered. Documented remedy path for reversal or escalation. - **Keep the Diff, Not the Agent's Summary** — [Source]() — Published 2026-07-23 Tag: Coding Agents The actual diff, not the agent's description of it. Test results and full CI output. Code-owner review record with real review depth, not rubber stamps. Rollback path documentation. Issue linkage proving the change was authorized. The review machinery already exists; evidence should flow through it. - **Tool Calls Need Governance the Protocol Skips** — [Source]() — Published 2026-07-23 Tag: MCP Tools Tool identity and version. Credential scope with token audience and expiry. Exact invocation arguments. Raw tool response, including error states. A bound approval record showing what the human actually confirmed. Server trust basis documenting your organization's review of tool metadata before it was ever called. - **Permissions Can Change Between Retrieval and Action** — [Source]() — Published 2026-07-23 Tag: RAG Retrieval Source document provenance with version and ingestion timestamp. Access-control verification method and when it ran. Chunk lineage showing the parsing and retrieval path. Embedding model version. Freshness timestamps covering source update, re-embedding date, and index propagation delta. What was permitted at retrieval time may not be permitted later. ### What's Missing Agent runs produce logs, traces, outputs. What they routinely fail to produce is the evidence you'd actually need if someone challenged the result. These seven gaps share a shape. The action completes. The tool was called, the query returned rows, the page loaded, the PR merged. But the institutional meaning of that action stays unresolved. Who authorized it? Under what scope? Against which definitions? With what recognition from the counterparty? Call them ordinary omissions. They stay invisible until a question arrives that the run's own records can't answer. The ecosystem keeps improving how agents act. It hasn't caught up on how they prove what they did. - **No Record Exists of Who Authorized the Agent** — [Source]() — Published 2026-07-23 Tag: Unsigned Mandates MCP authorization remains optional. A session log proves the agent held a working token. It does not prove that a specific person delegated a specific task with defined scope and expiry. When the result gets challenged, the challenge has nowhere to land. - **Agent Holds Broader Access Than the Task Needs** — [Source]() — Published 2026-07-23 Tag: Unscoped Credentials AWS warns operators not to treat a readonly flag as a security boundary. When credentials exceed what the task requires and no runtime scope evidence gets captured, demonstrating least privilege after the fact is the problem you cannot solve. - **The Query Ran Clean but Meaning Went Unverified** — [Source]() — Published 2026-07-23 Tag: Ungrounded Metrics EntSQL's best system reached 15.9% execution accuracy on enterprise questions, even with domain documentation provided. SQL can execute cleanly while the business term behind the question was never resolved against an authoritative definition. A polished number and a grounded one look identical. - **Browser Agent Visited but the Site Saw Nothing** — [Source]() — Published 2026-07-23 Tag: Unrecognized Visits Cloudflare now separates AI traffic into Search, Training, and Agent categories, with default blocking planned for agent visits on ad-supported pages. A successful browser session today may face retroactive challenge if neither party recorded what the visit was for. - **Tool Descriptions Treated as Fact Without Any Check** — [Source]() — Published 2026-07-23 Tag: Untrusted Metadata The MCP spec warns that tool annotations are hints, not trustworthy policy. Research on implicit tool poisoning shows manipulated metadata can steer agents toward high-privilege actions, with attack success rates reaching 84.2% and detection rates as low as 0.3%. - **Clean Output but No Way to Contest It** — [Source]() — Published 2026-07-23 Tag: Unreviewable Outputs Microsoft reports adopters merging 24% more pull requests. OpenAI finds over 80% of sampled Codex users making requests exceeding 30 minutes of equivalent human work. At that volume, approval starts functioning as a signature on the result rather than a genuine check of the reasoning. - **State Changed with No Snapshot or Rollback Path** — [Source]() — Published 2026-07-23 Tag: Irrecoverable State Browser automation confirms an element is visible and clickable. It does not confirm the action was the right business decision, or that the displayed state was current. Without a pre-action snapshot or rollback path, every mistake becomes a cleanup project against no baseline. ### Past Articles - [Precise About What?]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Practical Check Agent outputs keep getting more detailed, more structured, more confident-looking. That's exactly the problem. A text-to-SQL tool hands you clean numbers with decimal places. An API connector reports a successful authenticated call. A browser framework confirms it clicked the button. Every one of these outputs radiates specificity, and specificity feels like proof. It isn't. The detail is what I've been calling a precision alibi: the absence of visible failure standing in for the presence of actual verification. Three domains, one pattern, and a diagnostic habit worth building before the outputs get any more polished. - [False Precision]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Concept Hallucination has a name. Refusal has a name. There's a third AI failure mode nobody's bothered to name yet: output that is specific before anyone has verified what it means. A SQL query returns 1,847 rows against a schema nobody validated. A benchmark presents gold-standard annotations that turn out to be riddled with errors. A browser agent clicks a button and logs success. Every one of these carries the texture of correctness — the row count, the executed code, the green checkmark — without the meaning to back any of it up. We trust specificity. A precise answer gets less scrutiny than a vague one. That's exactly what makes this pattern dangerous enough to deserve a word. - [The Verb-Noun Gap]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: The Noun Problem Anyone can physically sign a document. The motion is trivial. What makes a signature consequential is everything the motion doesn't contain: authority, scope, organizational recognition. The agent ecosystem is converging rapidly on standardized actions — call, click, discover, complete — and they're getting reliable. But the organizational concepts those actions need to carry weight (mandate, delegation, approval, dispute) remain undefined. The next maturity threshold belongs to acts that can be recognized as acts within the institutions where they happen. - [What's Inside a Tool Call]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Reading the Spec An MCP tool call carries a name, some arguments, and gets back a result. That's the complete method-specific payload. There's no field for who authorized the action, what policy governed it, what state existed before it fired, or how to reverse it. Authorization lives at the transport layer, structurally separate from the invocation. When it's absent, the call looks identical — no field goes empty, no flag flips. The spec gives agents everything needed to execute. Accounting for what happened afterward is someone else's problem. ## Other sections in Issue 39 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()