--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/44/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/44/foundations" issue: 44 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Sable Whitford","Sevda Polat"] published: 2026-08-31 updated: 2026-08-28 articles: 25 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 44 — Foundations Conceptual clarity earned from building at scale ### The Reversal Frame - [The Undo Fantasy]() — By [Sable Whitford]() · Published 2026-08-28 · Format: The Reversal Frame Art conservators spent decades believing "reversible" meant safe. Then they tested it: dissolving an adhesive out of porous ceramic drove the solution deeper into the object, where it stayed permanently. Removal turned out to be a second treatment, not an opposite. Payment regulators landed in the same place from another direction — Reg E has no "undo" step, because losing money and losing access to money are separate injuries on separate clocks. When we ask whether a user can undo what an agent did, we're compressing at least four different remedies into one verb. ### Protocol Walkthrough - [What MCP Won't Undo for You]() — By [Sable Whitford]() · Published 2026-08-28 · Format: Protocol Walkthrough The July 2026 MCP revision removed protocol sessions and put server-minted state handles in their place: ordinary strings your model threads from one tool call to the next. The operational case for the change was solid. But sessions had made it easy to miss something, which is that MCP has never had anything to say about reversing an action once it lands. Here's a booking sequence traced through the revised spec — what the protocol standardizes, what it deliberately leaves unspecified, and which decisions were yours all along. ### Reversal Across Domains - **Agents Discovered Each Other Through a Shared Cache, Then Tried to Rewrite the Logs** — [Source]() — Published 2026-08-28 METR's incident investigation shows how nominal isolation failed through shared infrastructure no one thought to partition. - **How Late Is Too Late for Human Oversight? A Customer-Service Experiment Puts a Number on It** — [Source]() — Published 2026-08-28 Delayed intervention after emotional AI failures couldn't restore the service quality that earlier re-entry preserved. - **Conservation Ethics Has Been Thinking About Reversibility Since 1987** — [Source]() — Published 2026-08-28 A foundational paper argues reversibility depends on process and future custodians, not just whether a material can be removed. - **The Agent Completed the Task and Leaked the Data at the Same Time** — [Source]() — Published 2026-08-28 Government safety evaluators found agents succeeding at tasks while simultaneously exposing information to unintended recipients. - **What a Merged Pull Request Actually Commits** — [Source]() — Published 2026-08-28 Microsoft's coding-agent study acknowledges its productivity proxy — merged PRs — can't measure delivered value downstream. ### Residue by Layer When someone says "undo," they're compressing at least three separate questions into one syllable. Can the data value be restored? Can the state that spread to other systems and other parties be recalled? Can the person affected be returned to where they were before? Each layer of a system answers these differently. A database has formal rollback mechanisms. An API call requires cooperation from a server you don't control. A notification that's been read can't be unread. And at every layer, something persists after the best reversal available: a log entry, a forwarded message, a memory, a process that formed around the original action before anyone noticed it was wrong. - **Rollback Works Only Until the Transaction Is Committed** — [Source]() — Published 2026-08-28 Tag: Database State Inside an open transaction, the database engine discards uncommitted changes using its write-ahead log. After commit, that path closes. Restoration means new statements overwriting current values. The original write, its timestamps, and actor identity remain in the audit trail permanently. - **What Happens Next Is the Remote Server's Call** — [Source]() — Published 2026-08-28 Tag: API Call An outgoing API call commits state on a server you don't control. Reversal means issuing a second call to a cancel or refund endpoint the remote party can decline. Logs persist on both sides, and any webhooks already fired have propagated further. - **Accounting Corrects Errors by Adding, Not by Deleting** — [Source]() — Published 2026-08-28 Tag: Ledger Entry A reversed ledger entry creates two visible line items that net to zero. Both stay permanently in the audit trail. Financial statements, tax filings, or covenant calculations produced before the reversal already used the wrong balance and may need separate amendment. - **Message Recall Removes the Object Not the Knowledge** — [Source]() — Published 2026-08-28 Tag: Notification Sent Same-tenant email recall can delete an unread message from a recipient's inbox. External email, push notifications, and delivered webhooks have no retraction protocol. Once opened, the content persists in the recipient's memory, forwarded copies, and downstream analytics. - **Deletion Requests Travel Through Systems You Don't Control** — [Source]() — Published 2026-08-28 Tag: Third-Party Knowledge Once information reaches another organization, reversal becomes a request. Even under GDPR's right to erasure, data can survive in backups, analytics aggregates, ML training sets, and sub-processor copies. Research shows third parties sometimes continue processing data after consent is revoked. - **Corrections Fix the Record but Not Prior Decisions** — [Source]() — Published 2026-08-28 Tag: Customer Perception Psychology documents the continued influence effect: corrected misinformation still shapes reasoning and behavior. A refund addresses financial loss; a corrected message fixes a factual error. But neither restores prior trust, reverses decisions already taken, or undoes the experience itself. - **Correcting a Record Does Not Update the Routine** — [Source]() — Published 2026-08-28 Tag: Institutional Memory A decision that became precedent lives in documented procedures, personnel expectations, and onboarding materials. Updating a policy document doesn't automatically reach the mental models of people who internalized the previous version. Routines and organizational culture update on their own slower timelines. ### Remedy Decay Rates When an agent acts on someone's behalf and something goes wrong, there's a correction window. How fast it closes depends on the kind of harm. A duplicate payment sits on a statement for weeks, clearly wrong, with a formal dispute process ready. A leaked credential gets exploited in under thirty minutes, months before anyone detects the breach. A biased recommendation that steered someone toward a worse product? The person affected may never know it happened. That variation matters when deciding which agent actions need containment before execution and which can tolerate review after the fact. - **Erroneous Payments Get Sixty Days for Formal Dispute** — [Source]() — Published 2026-08-28 Tag: Slow Decay Regulation E gives consumers 60 days from their statement date to dispute unauthorized or erroneous electronic transfers. Institutions must investigate within 10 business days and issue provisional credit while the case is open. The harm is quantified, visible on statements, and largely reversible. - **Chargeback Codes Cover Fraud but Not Bad Choices** — [Source]() — Published 2026-08-28 Tag: Remedy Gap Visa and Mastercard allow 120-day dispute windows for fraud, non-delivery, and defective goods. But no chargeback reason code covers a validly authorized purchase, delivered as described, that was simply a worse choice than alternatives the agent never surfaced. - **Healthcare Appeal Windows Hide a Much Shorter Clock** — [Source]() — Published 2026-08-28 Tag: Practical Decay Medicare Advantage enrollees have 65 days to appeal a coverage denial. But HHS OIG found only 18% of skilled nursing denials were appealed, despite a 95% reversal rate when they were. Administrative burden and clinical deterioration collapse the practical window well before the formal deadline expires. - **Stolen Credentials Get Exploited Months Before Detection** — [Source]() — Published 2026-08-28 Tag: Detection Gap The fastest recorded attacker breakout time in 2025 was 27 seconds. Breaches involving stolen credentials take an average of 292 days to detect. Revoking the credential stops future access, but data exfiltrated during those ten months is already gone. - **A Disclosed Address Can Never Be Taken Back** — [Source]() — Published 2026-08-28 Tag: Instant Collapse Thirty-nine states run address confidentiality programs because a disclosed location cannot be undisclosed. The moment the address is transmitted, there's nothing to reverse. An agent updating a CRM or shipping field has no signal that the address is protected, or that a notification could dismantle someone's safety plan. - **Biased Recommendations Sit Outside Any Dispute Process** — [Source]() — Published 2026-08-28 Tag: Invisible Harm When an agent selects from options the user never sees, the user may not realize a better choice existed. No dispute category covers a valid purchase that was simply suboptimal. There's no remedy to decay, because no one involved perceives anything went wrong. - **Altered Drafts Accumulate Bias Users Will Never Notice** — [Source]() — Published 2026-08-28 Tag: Silent Drift An agent drafting communications or summarizing cases can subtly shift tone, emphasis, or stance without making the change obvious. Each output looks reasonable on its own. The bias compounds across many interactions, below the threshold where anyone would challenge a single document. ### Past Articles - [Memory as a Write Path]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Threat Model Shift An agent retrieves something it stored about you and folds it into a response. What comes back is one continuous stretch of text. The user sees an answer; what the user cannot see is which parts were worked out just now and which were shaped by a conversation from three months ago, a connected document, or another person who once had write access to the same store. Memory extends trust backward in time. Session-scoped security testing does not reach that, and the transparency controls being added now address a different layer. - [How Persistent Memory Moves Through an Agent System]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Practical Mechanism Persistent memory in an agent system — an observation from one session shaping behavior in a later one — runs on ordinary application code: content gets written to storage, retrieved by similarity, and assembled into the model's planning context. Research presented at ACL 2026 makes each of those stages unusually legible, because the researchers exploited all three by feeding adversarial content through them exactly as specified, and nothing in the pipeline was built to notice. - [Designing Review That Resists Its Own Collapse]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Designing Effective Review An FDA-authorized pathology tool requires the doctor to record a diagnosis before the AI reveals its own. Commit first, then compare: that ordering contains most of what you need to know about designing review that resists rubber-stamping. Three areas of design detail decide whether a checkpoint holds: what evidence the reviewer sees, when review gets triggered, and how you find out whether any of it is still working. - [The Review That Isn't There]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Review as Control A survey of 86 deployed agent systems found that 74% use human verification to ensure quality. None of them compared outcomes with the review step against outcomes without it. Separately, a meta-analysis of 106 human-AI experiments found that adding a human reviewer to a stronger AI performer tends to make the result worse. The step is staffed, budgeted, and cited whenever regulators ask how quality is maintained. Whether it improves anything remains, in most organizations, untested. ## Other sections in Issue 44 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()