--- title: "Echoes" canonical: "https://current.tinyfish.ai/issue/42/echoes" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/42/echoes" issue: 42 section: "echoes" description: "Past infrastructure decisions echoing in today's production realities" authors: ["Sevda Polat","Sable Whitford"] published: 2026-08-17 updated: 2026-08-13 articles: 15 --- # TinyFish > A journal for living in the agentic age [Read on the website]() ## Issue 42 — Echoes Past infrastructure decisions echoing in today's production realities ### The Governance Gap - [The Two Channels]() — By [Sevda Polat]() · Published 2026-08-13 · Format: The Governance Gap In 1990, two studies independently found the same thing: spreadsheets spread through organizations colleague to colleague, while information-systems departments barely registered it. Governance showed up later, through audit findings and regulatory guidance — a separate organizational channel entirely. A Census Bureau working paper from this April, covering more than 117,000 firms, finds AI adoption splitting the same way: workers experimenting task by task, formal adoption moving through business functions, the two paths barely touching. What accumulates in the interval between adoption and oversight is the part that's hard to see and harder to undo. ### One Error's Anatomy - [The $110 Million Cell]() — By [Sevda Polat]() · Published 2026-08-13 In 2009, researchers audited 25 operational spreadsheets across five organizations. One workbook at a large firm contained a cell wrong by $110,543,305, a 137.5% distortion. Built within the previous year and in active use, the error had survived normal operations undetected. ### The Losing Side - [An Auditor Watches the Same Mistake Happen Twice]() — Published 2026-08-13 Every organization has spreadsheets that run critical business processes. Most organizations also have policies governing those spreadsheets. The distance between those two facts is where Nora Ledgerwood has spent her career. ### Machinery and Mirror - [What Broke Before the Spreadsheet Rules Arrived]() — By [Sevda Polat]() · Published 2026-08-13 · Format: Machinery and Mirror Read the compliance checklist for spreadsheets in financial services as a record of what has already gone wrong, and each requirement resolves into a specific incident. A fabricated input that cost $691 million produced today's reconciliation mandates. A formula error that shifted $1.1 billion in reported equity produced the inventory and review requirements. Roughly twenty years separated widespread adoption from specific governance, and the governance arrived only after the failures did. - [AI Diffusion Through Two Channels]() — By [Sevda Polat]() · Published 2026-08-13 · Format: Machinery and Mirror Census data covering 117,000 firms shows 6.8% reporting that workers use AI for tasks while the firm itself doesn't register as an adopter. The spreadsheet precedent tells you what tends to happen when individual use outruns institutional oversight, and roughly how long governance takes to catch up. But agents call external tools and change records in systems their firm doesn't own, which is where the comparison stops being useful. ### Further Threads - **Number Crunching without Programming: How VisiCalc Put Business Logic in Everyone's Hands** — [Source]() — Published 2026-08-13 Martin Campbell-Kelly's peer-reviewed account of how spreadsheets let millions encode logic without IT departments. - **When Spreadsheets Go Wrong: Measuring the Real Cost of Locally Built Business Logic** — [Source]() — Published 2026-08-13 An empirical audit of 25 operational spreadsheets found confirmed errors worth up to $100 million each. - **The Microstructure of AI Diffusion: How Top-Down and Bottom-Up Adoption Run on Separate Clocks** — [Source]() — Published 2026-08-13 Census survey of 117,000 firms finds formal and worker-led AI adoption moving through structurally distinct channels. - **Shadow AI by the Numbers: What the 2026 Verizon DBIR Found on Corporate Devices** — [Source]() — Published 2026-08-13 AI use on corporate devices tripled in one year; two-thirds of users access it through personal accounts. - **Bring Your Own AI: Microsoft's Survey of 31,000 Workers and the Tools They Won't Wait For** — [Source]() — Published 2026-08-13 78% of knowledge workers using AI at work brought their own tools; over half won't admit it. - **Governance Catches Up, Incompletely: Netskope's 2026 Cloud and Threat Report** — [Source]() — Published 2026-08-13 Managed AI accounts rose from 25% to 62%, yet sensitive-data violations more than doubled year-over-year. ### Past Articles - [Your Browser Believes the Edge Is the Site]() — By [Sevda Polat]() · Published 2026-08-05 · Format: Intelligence Returns Distributed caching entered the world in 1997 as a load-balancing result: how to keep everyone wanting the same file at once from melting a single server. Encryption changed what that position means. To serve a site over HTTPS, the machine nearest you has to hold credentials in the site's own name, which means your browser treats it as the party it was talking to all along. The reading that encryption drove out of the middle of the network found somewhere it is welcome. - [The Middle of the Network Wanted to Know]() — By [Sevda Polat]() · Published 2026-08-05 · Format: Intelligence Returns Traffic does not declare what it is for. There is no field for that, and there never was — so when broadband operators bought equipment to read inside the packets they carried, the machinery had to guess: from sizes, from timing, from patterns of bytes recurring at line rate. A 2008 FCC case shows what a guessing engine can do once it is sitting on the rack. Encryption's reply had no way to tell the honest operators from the opportunistic ones, and made no attempt. - [The Network Was Built Not to Know]() — By [Sevda Polat]() · Published 2026-08-05 · Format: Network Ignorance Three engineers argued in 1984 that only the two ends of a conversation can judge whether an exchange came out right. TCP/IP took the advice. What we got is a network that moves a purchase, a regulatory disclosure, and a video of somebody's dog through the same machinery, which is precisely why anyone could build anything on it without asking permission first. The paper also asked a question it declined to answer: where are the ends? Agents now sit there, checking outcomes against a standard held by a principal who never saw the choice being made. - [The Signature Has an Expiry. The Mandate Has No Field.]() — By [Sable Whitford]() · Published 2026-07-30 · Format: Signal and Absence A signed agent request will tell you which key signed it, when, and when that signature stops counting. It will not tell you the errand: no spending ceiling, no prohibition, nothing about whether the authority gets handed down to software you'll never see. The signature has an expiry field. The mandate doesn't have a field at all. Thirty-two competing IETF drafts say the absence is felt. Not one of them agrees on where a limit should be written. ## Other sections in Issue 42 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Practitioner's Corner]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()