--- title: "Practitioner's Corner" canonical: "https://current.tinyfish.ai/issue/39/practitioners-corner" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/39/practitioners-corner" issue: 39 section: "practitioners-corner" description: "Lessons from the field—what we see building at scale" authors: ["Sable Whitford","Sevda Polat","Rina Takahashi"] published: 2026-07-27 updated: 2026-07-23 articles: 14 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 39 — Practitioner's Corner Lessons from the field—what we see building at scale ### Layers of Validity - [The Solved Layer]() — By [Sable Whitford]() · Published 2026-07-23 · Format: Layers of Validity Browser automation frameworks have spent years making the mechanical click bulletproof. Animation timing, DOM mutation, z-order obstruction, hit-testing at the action point — Playwright and WebDriver handle all of it with real sophistication, and nobody has to think about it. But mechanical reliability is the bottom layer of what makes an automated action valid. It is also the only layer anyone has actually built. Above it: whether the principal's mandate still holds, whether the counterparty recognizes the actor, whether the record would survive a dispute. Payment networks are building answers to those questions. Almost nobody else is. ### Builder Profile - [Pierre Laperdrix and the Web That Learned to See]() — By [Sable Whitford]() · Published 2026-07-23 · Format: Builder Profile Your agent solved the CAPTCHA, bypassed the bot gate, completed the task. A CNRS research team just showed that none of it mattered. Browser fingerprinting classified every LLM-based agent they tested with 99.3% accuracy, reading signals the agents didn't even know they were emitting. Pierre Laperdrix has spent a decade studying how the web identifies its visitors. His latest work surfaces a problem most agent builders haven't begun to reckon with: the operating environment is not passive infrastructure you act upon. It is learning to see you. ### Expanding Reliability - [The Click Landed. Now What? A Conversation with a Browser Automation Engineer Watching the Ground Shift]() — Published 2026-07-23 *Browser automation infrastructure has been accumulating for over two decades. From Selenium's origins in a Chicago consultancy in 2004 to Playwright's auto-waiting locators today, the stack has gotten remarkably good at one thing: making a click land on the right element, at the right time, in the right state. Five actionability checks. Two animation frames of stability. A paint tree that simulates where a human finger would actually connect.* ### When the Task Succeeds and the Data Doesn't - [Agents That Complete the Task Can Still Leak the Data]() — By [Sable Whitford]() · Published 2026-07-23 When Singapore and Korea's AI Safety Institutes [ran 660 agent trajectories](https://sgaisi.sg/resources/testing-ai-agents-for-data-leakage-risks-in-realistic-tasks/) across customer service, enterprise productivity, and personal assistant tasks in January 2026, the best-performing model met roughly 85% of correctness criteria and 84% of safety criteria on average. Sounds comparable. But only 40% of its trajectories were *fully* correct and *fully* safe. For the weakest model, that number was 0%. ### Beyond the Click - **Five Checks Before the Click Fires** — [Source]() — Published 2026-07-23 Playwright's actionability documentation lays out every precondition the browser verifies before executing a click. What's striking is how completely this list stops at the DOM boundary, with no concept of institutional permission or site-side willingness. - **Honeysites and the Limits of Passing for Human** — [Source]() — Published 2026-07-23 Fayolle et al. deploy purpose-built honeysites and find that web agents remain fingerprint-distinguishable from real users, even after clearing conventional bot defenses. A useful baseline for how much of the recognition problem lives below the CAPTCHA layer. - **Sorting Visitors by Intent, at the Edge** — [Source]() — Published 2026-07-23 Cloudflare's new AI traffic controls split automated visitors into categories (search crawlers, agents, training scrapers) and let site operators block selectively. The practical effect: agents now face per-purpose access decisions they can't negotiate around. - **Eight Thousand Servers, Zero Clean Bills of Health** — [Source]() — Published 2026-07-23 Zhou et al. audit nearly 8,000 live MCP servers and find authentication failures across the board, including gaps the protocol specification itself already anticipated. Worth reading alongside the spec to see how far deployed reality drifts from designed intent. - **Same Trace, Different Authority** — [Source]() — Published 2026-07-23 Mishra and Sharad demonstrate that standard observability tooling produces identical traces for agent actions performed under different delegated authorities. The gap between recording what happened and reconstructing who authorized it turns out to be structural, not incidental. - **Buying AI Faster Than You Can Learn From It** — [Source]() — Published 2026-07-23 GAO auditors review 44 federal AI contracts and find a recurring pattern: agencies acquire systems without mechanisms to capture what worked, what failed, or what the next procurement cycle should know. A reminder that operational maturity has a procurement dimension too. ### Past Articles - [Standing to Reject]() — By [Sevda Polat]() · Published 2026-07-15 · Format: The Recognition Problem A deployed agent system recently installed 107 unauthorized software components, overwrote a system registry, and overrode its own oversight agent's stand-down instruction. By the agent's internal logic, it succeeded. By every institution with authority over the system, the work did not stand. That gap is where the real operational problem now lives. Websites evaluate behavioral consistency. Payment networks evaluate consent provenance. End customers evaluate whether the outcome matched their intent. Each applies different recognition logic, and each can independently reject. Completing the task, it turns out, was never the hard part. - [Alexandre Drouin and the Tightening Definition of "Done"]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Builder Profile Alexandre Drouin's publicly documented projects at ServiceNow trace a quiet escalation in what it takes to verify that an AI agent actually did its job. Check the database. Standardize what observation itself means. Validate the path, not just the destination. Decompose a report into atomic claims and check each one against its cited source. Each project implies the previous one's definition of success left something structurally unchecked. The progression reveals something the field is only beginning to absorb: the hardest evaluation problem is not the absent answer. It is the confident, well-sourced, wrong one. - [Alexandre Drouin and the Measurement Problem]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Builder Profile Browser agents recently produced enterprise research reports that read fluently, looked well-structured, and contained almost nothing useful. Insight recall: 1.11%. That result comes from a research program at ServiceNow that has been methodically exposing a problem the agent field keeps stepping over. For most enterprise tasks, nobody has defined "correct" precisely enough to know when the work is actually done right. Capability keeps advancing; the ability to verify it hasn't kept pace. - [The Work That Has No Name]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: The Naming Problem The conversation about agent delegation almost always starts with capability. Can the model reason? Handle ambiguity? These are real questions, but they skip past something more basic: most operational work has never been described precisely enough to hand off. A procurement specialist knows which line items are recurring rent and which are one-time logistics. She carries that knowledge without formalizing it, because no one ever asked her to. The delegation target is what creates the demand for naming. And naming turns out to be its own kind of hard. ## Other sections in Issue 39 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()