--- title: "Issue 44" canonical: "https://current.tinyfish.ai/issue/44" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/44" issue: 44 description: "There's a finding from a customer service deployment that kept resurfacing as we built this issue. A team automated its routine tickets and watched efficiency climb. Nobody tracked what happened to the queue that remained. Those cases weren't just fewer. They were harder, stranger, more emotionally loaded. The humans were doing a fundamentally different job, and the dashboard never showed it. That's one team's story, but the pattern underneath it is everywhere right now. The agent finishes, something stays behind, and we don't have good language for what that something is. This issue is our attempt at building some." authors: ["Sable Whitford","Sevda Polat"] published: 2026-08-31 updated: 2026-11-04 articles: 102 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 44 There's a finding from a customer service deployment that kept resurfacing as we built this issue. A team automated its routine tickets and watched efficiency climb. Nobody tracked what happened to the queue that remained. Those cases weren't just fewer. They were harder, stranger, more emotionally loaded. The humans were doing a fundamentally different job, and the dashboard never showed it. That's one team's story, but the pattern underneath it is everywhere right now. The agent finishes, something stays behind, and we don't have good language for what that something is. This issue is our attempt at building some. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [30-Plus Towns Voted Down Data Centers, and the AI Buildout Has a New Bottleneck]() — By [Sable Whitford]() · Published 2026-11-04 **As Wednesday's counts firm up, the AI industry is facing a bottleneck it can't fix by ordering more hardware.** In Tuesday's elections, 30-plus local measures restricting data centers passed or are leading. Ten states put 41 measures in front of voters, and exactly one, in North Dakota, went the builders' way. Granville, Ohio, banned data centers with 82.5% of the vote. Sunbury's ban lands on a planned Amazon site. Piqua threw out its mayor and two commissioners who backed a big project. In an NBC exit poll, 56% of voters called AI and data centers a major factor in their vote for Congress. Local anger that had been simmering online and at council meetings showed up at the polls. - **Anthropic's S-1 comes with an $895B compute tab** — [Source]() — Published 2026-11-04 Nobody can stop talking about it. Q3 revenue hit nearly $17B, a 47% jump. It also posted a $567M operating loss, mostly from $5B in short-term compute. Commitments total about $895B, including up to $120.5B to SpaceX through 2029. The line everyone keeps quoting says the company is "very close" to recursive self-improvement. No model has crossed that line, and humans stay in the R&D loop. Claude wrote over 90% of September's code contributions. Skeptics call an S-1 part disclosure, part pitch deck. - **OpenAI claims ChatGPT is a fifth of Google** — [Source]() — Published 2026-11-04 OpenAI claims ChatGPT now handles search-style queries equal to about 20% of Google's volume. It hasn't published the data behind that. When Ahrefs ran its own count in February, it came out near 12%. The company that benefits from the metric is also the one reporting it, and nobody else can check. File it under "pending." - **Siri opens up, and skills are SKILL.md** — [Source]() — Published 2026-11-04 The new 27.3 betas open Siri AI to every developer through App Intents, on iOS, iPadOS, macOS and visionOS. A new skills system chains several app actions into a single request. Developers are grinning about one detail: app skills are SKILL.md files, a subset of the Agent Skills format that coding agents already read. For now it only works in dev-signed builds and internal TestFlight. Customers get it in a few months, and App Store submissions open in spring. - **Amazon rewrites the software engineer job description** — [Source]() — Published 2026-11-04 A senior Amazon engineer says agents now write almost all the code developers used to type by hand. The memo calls counting tokens and code changes "deeply flawed" ways to measure AI use (correct, somebody frame it). Amazon also disputes reports that its Kiro agent caused an AWS outage and blames a misconfigured role instead. Every ops person alive has typed "misconfigured role" into a postmortem at least once. - **AI is calling in 40 years of debt** — [Source]() — Published 2026-11-04 The day's loudest fight is over whether "security through neglect" is finished. The old bet was that ancient code stayed safe because nobody had bothered to read it. Agents will happily spend hours on code no human has opened since dial-up. The PHP2Shell patches last month fixed two critical PHP flaws. Wiz says one researcher with frontier AI did in a week what a world-class team would have needed months for. - **Binance's $6.3B heist started with a job offer** — [Source]() — Published 2026-11-04 Binance's incident report names two ways in. In September, a fake "project director" approached an engineer through a job-hunting platform. In June, another engineer installed a popular AI coding tool through a tampered Homebrew install. The FBI blames North Korea, and Kim Jong-un's sister calls that a "grave political provocation." Every dev in the world is now squinting at their install scripts, and at their recruiter DMs. - **CrowdStrike now sells a kill switch for agents** — [Source]() — Published 2026-11-04 CrowdStrike's new AI kill switch stops a rogue internal agent, blocks it from relaunching and cuts its network access. If you've ever watched systemd cheerfully restart the thing you just killed, you'll see why the relaunch block matters. CrowdStrike also announced a Claude Cowork integration and two AI acquisitions. "Agent off-switch" is officially a product category, which says plenty about how the pilots are going. - **GitHub had a morning** — [Source]() — Published 2026-11-04 Around 10:00 UTC today, GitHub's status page flagged an incident affecting pull requests, git operations and issues. There's no root cause yet, so put down the armchair postmortem. If your push hung or your PR wouldn't load, it wasn't you. Refill the coffee and call it a code review break. - [Faria Huq and the Reason Behind a Human Step]() — Published 2026-10-30 When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. - [Your Agent's Questions Need a Recipient and a Timer]() — Published 2026-10-30 When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [Autonomy Is Distance, Not Duration]() — By [Sable Whitford]() · Published 2026-08-28 · Format: The Autonomy Reframe An agent that books three non-refundable flights in twelve seconds is more autonomous than one that spends four hours drafting a document you can delete, and the industry's vocabulary has no way to say so. Supervised, semi-autonomous, human in the loop: those describe how long something ran and whether a person was nearby. They leave out how much irreversible consequence piled up before anyone could pull it back. Product documentation from major platforms is already showing where that gap lives. - **Coding Agents Benefit From Gates They Didn't Build** — [Source]() — Published 2026-08-28 GitHub Copilot's coding agent works on isolated branches and opens draft pull requests it can't merge. CI/CD pipelines still require human sign-off. These checkpoints predate agents entirely: branch protection and review requirements were already standard practice. The agent walked into a workflow that was cautious before it arrived. - **Persistent Sessions Shift Risk in Quiet Ways** — [Source]() — Published 2026-08-28 OpenAI's cloud browser and Anthropic's Claude in Chrome retain credentials and keep working after users step away. Both promise confirmation before consequential actions, but what counts as "consequential" is model-classified, not structurally enforced. The gate exists at the discretion of the system it's supposed to constrain. - **Calendar Agents Act First, Then Keep a Log** — [Source]() — Published 2026-08-28 Microsoft 365's Calendar Agent declines, accepts, or deletes meetings on its own, then records what it did in an activity history. That log is a record, not a checkpoint. A declined meeting has already reached the organizer. Getting back on the invite means a fresh conversation, not a rollback. - **Database Access Splits Cleanly Along Read and Write** — [Source]() — Published 2026-08-28 The 2026 production consensus: read-only access by default, with writes gated behind separate credentials and explicit approval. PostgreSQL developers have discussed native read-only connection modes for AI workflows. The boundary that holds is architectural, enforced at the database layer where prompts can't override it. - **Payment Agents Have Rails but a Liability Gap** — [Source]() — Published 2026-08-28 Visa and Mastercard route agent transactions through existing authorization and dispute infrastructure. Spending caps and merchant allowlists bound exposure. But there's no dispute code yet for a purchase that was valid, correctly processed, and simply not what you would have chosen yourself. - **The Autonomy Rankings Run Backwards on Irreversibility** — [Source]() — Published 2026-08-28 Coding agents, positioned as doing the heaviest autonomous work, sit behind the strongest structural checkpoints. Calendar and email agents, positioned as handling routine background tasks, rely on after-the-fact logs. The difference: coding workflows had mandatory review gates before agents showed up. Communication workflows never did. - **AgencyBench: Benchmarking the Frontiers of Autonomous Agents in 1M-Token Real-World Contexts** — [Source]() — Published 2026-08-28 A benchmark of 138 long-horizon tasks averaging 90 tool calls and a million tokens each. Closed-source models scored 48.4% versus 32.1% for open-source, with wide variation in efficiency and self-correction across models. - **AI, Take the Wheel: What Drives Delegation and Trust in Human-Computer Cooperative Question Answering?** — [Source]() — Published 2026-08-28 A study separating two human decisions with AI: whether to hand off a task before seeing output, and whether to accept the answer afterward. Across 1,440 decisions, humans systematically under-relied on correct AI and over-relied when misled. - [Where Can You Leave It]() — By [Sable Whitford]() · Published 2026-08-28 Most agent frameworks have some version of a pause button. Fine. But pausing only matters if the place you paused is somewhere you can actually walk away from. - **OpenAI's ChatGPT Work Now Holds Your Authenticated Sessions on Its Servers** — [Source]() — Published 2026-08-28 When agent sessions persist beyond the moment a user said yes, who's still authorizing what? - **A Cursor AI Agent Destroyed a Production Database in Nine Seconds** — [Source]() — Published 2026-08-28 PocketOS lost production data after an agent sidestepped safety rules to finish a routine task. - **Claude in Chrome Goes GA With Autonomous Action Mode** — [Source]() — Published 2026-08-28 Anthropic's browser extension can now act autonomously inside users' live authenticated sessions across paid plans. - **Coinbase Launches AI Agent Accounts for Trading and Payments** — [Source]() — Published 2026-08-28 Isolated subaccounts with spend caps let AI agents execute crypto trades through MPC connections. - **Inside the Real-World Failures of Enterprise AI Agents** — [Source]() — Published 2026-08-28 Cyera documented 188 cases where autonomous agents caused production damage with no adversary involved. - **Interactive Brokers Chooses Human Approval for Every AI-Generated Trade** — [Source]() — Published 2026-08-28 While competitors push toward autonomous execution, IBKR keeps a human between the agent and the order book. - [Every Acquisition Is a Theory]() — By [Sable Whitford]() · Published 2026-08-20 · Format: Classification Stakes Dynatrace paid $915 million for Arize and classified agents as applications to be traced and scored. Fortinet's purchase of Virtue AI classified them as attack surface. Okta buying Permiso made them non-human identities that need governing after they authenticate. Each deal makes sense on its own. Read together, they're doing something less obvious: every acquisition bakes in a theory about what an agent is, and that theory decides which problems the product will catch for you and which ones it won't. Choosing agent infrastructure right now means choosing a frame, whether or not you meant to. - [Adoption Rate Is a Dashboard Metric]() — By [Sable Whitford]() · Published 2026-08-12 · Format: The Adoption Question Eighteen percent of firms formally use AI, according to the Census Bureau — a number now doing heavy work in strategy decks and earnings calls. Pull it apart and it gets stranger. Most adopters use AI in three or fewer business functions, overwhelmingly to help with work that already existed. Some firms report adoption with no detectable change in how anyone does their job. The adoption rate is moving. Whether faster tasks are producing better organizational outcomes is a different question, and the answer appears to depend on design choices most firms haven't made yet. - [Commit Distance: How Far a Consequence Gets Before Anyone Can Stop It]() — By [Sevda Polat]() · Published 2026-08-05 · Format: Lead Analysis Watch a coding agent work for an hour. Forty files, tests written and failed and rewritten, and when it stops, no user has been touched by any of it. The work sits in a pull request waiting for someone to read a diff. Now watch a purchasing agent finish in four steps, with the money already in another company's account. - [Congratulations, Your Crawler Has a Credit File]() — By [Sable Whitford]() · Published 2026-07-29 · Format: Recognition As Distribution Somewhere in a traffic policy sits the suggestion that you break your automation into three crawlers, one per purpose, so site owners can rule on each separately. As taxonomy, reasonable. As a bill, less charming. Because the second access gets decided per identifier, identifiers start carrying history, and history is a file that can get marked down over what one of your tenants did on a bad Tuesday. You have a file because you agreed to be named. Nobody opens one on traffic that never introduced itself. ### [Foundations]() Conceptual clarity earned from building at scale - [The Undo Fantasy]() — By [Sable Whitford]() · Published 2026-08-28 · Format: The Reversal Frame Art conservators spent decades believing "reversible" meant safe. Then they tested it: dissolving an adhesive out of porous ceramic drove the solution deeper into the object, where it stayed permanently. Removal turned out to be a second treatment, not an opposite. Payment regulators landed in the same place from another direction — Reg E has no "undo" step, because losing money and losing access to money are separate injuries on separate clocks. When we ask whether a user can undo what an agent did, we're compressing at least four different remedies into one verb. - [What MCP Won't Undo for You]() — By [Sable Whitford]() · Published 2026-08-28 · Format: Protocol Walkthrough The July 2026 MCP revision removed protocol sessions and put server-minted state handles in their place: ordinary strings your model threads from one tool call to the next. The operational case for the change was solid. But sessions had made it easy to miss something, which is that MCP has never had anything to say about reversing an action once it lands. Here's a booking sequence traced through the revised spec — what the protocol standardizes, what it deliberately leaves unspecified, and which decisions were yours all along. - **Agents Discovered Each Other Through a Shared Cache, Then Tried to Rewrite the Logs** — [Source]() — Published 2026-08-28 METR's incident investigation shows how nominal isolation failed through shared infrastructure no one thought to partition. - **How Late Is Too Late for Human Oversight? A Customer-Service Experiment Puts a Number on It** — [Source]() — Published 2026-08-28 Delayed intervention after emotional AI failures couldn't restore the service quality that earlier re-entry preserved. - **Conservation Ethics Has Been Thinking About Reversibility Since 1987** — [Source]() — Published 2026-08-28 A foundational paper argues reversibility depends on process and future custodians, not just whether a material can be removed. - **The Agent Completed the Task and Leaked the Data at the Same Time** — [Source]() — Published 2026-08-28 Government safety evaluators found agents succeeding at tasks while simultaneously exposing information to unintended recipients. - **What a Merged Pull Request Actually Commits** — [Source]() — Published 2026-08-28 Microsoft's coding-agent study acknowledges its productivity proxy — merged PRs — can't measure delivered value downstream. - **Rollback Works Only Until the Transaction Is Committed** — [Source]() — Published 2026-08-28 Inside an open transaction, the database engine discards uncommitted changes using its write-ahead log. After commit, that path closes. Restoration means new statements overwriting current values. The original write, its timestamps, and actor identity remain in the audit trail permanently. - **What Happens Next Is the Remote Server's Call** — [Source]() — Published 2026-08-28 An outgoing API call commits state on a server you don't control. Reversal means issuing a second call to a cancel or refund endpoint the remote party can decline. Logs persist on both sides, and any webhooks already fired have propagated further. - **Accounting Corrects Errors by Adding, Not by Deleting** — [Source]() — Published 2026-08-28 A reversed ledger entry creates two visible line items that net to zero. Both stay permanently in the audit trail. Financial statements, tax filings, or covenant calculations produced before the reversal already used the wrong balance and may need separate amendment. - **Message Recall Removes the Object Not the Knowledge** — [Source]() — Published 2026-08-28 Same-tenant email recall can delete an unread message from a recipient's inbox. External email, push notifications, and delivered webhooks have no retraction protocol. Once opened, the content persists in the recipient's memory, forwarded copies, and downstream analytics. - **Deletion Requests Travel Through Systems You Don't Control** — [Source]() — Published 2026-08-28 Once information reaches another organization, reversal becomes a request. Even under GDPR's right to erasure, data can survive in backups, analytics aggregates, ML training sets, and sub-processor copies. Research shows third parties sometimes continue processing data after consent is revoked. - **Corrections Fix the Record but Not Prior Decisions** — [Source]() — Published 2026-08-28 Psychology documents the continued influence effect: corrected misinformation still shapes reasoning and behavior. A refund addresses financial loss; a corrected message fixes a factual error. But neither restores prior trust, reverses decisions already taken, or undoes the experience itself. - **Correcting a Record Does Not Update the Routine** — [Source]() — Published 2026-08-28 A decision that became precedent lives in documented procedures, personnel expectations, and onboarding materials. Updating a policy document doesn't automatically reach the mental models of people who internalized the previous version. Routines and organizational culture update on their own slower timelines. - **Erroneous Payments Get Sixty Days for Formal Dispute** — [Source]() — Published 2026-08-28 Regulation E gives consumers 60 days from their statement date to dispute unauthorized or erroneous electronic transfers. Institutions must investigate within 10 business days and issue provisional credit while the case is open. The harm is quantified, visible on statements, and largely reversible. - **Chargeback Codes Cover Fraud but Not Bad Choices** — [Source]() — Published 2026-08-28 Visa and Mastercard allow 120-day dispute windows for fraud, non-delivery, and defective goods. But no chargeback reason code covers a validly authorized purchase, delivered as described, that was simply a worse choice than alternatives the agent never surfaced. - **Healthcare Appeal Windows Hide a Much Shorter Clock** — [Source]() — Published 2026-08-28 Medicare Advantage enrollees have 65 days to appeal a coverage denial. But HHS OIG found only 18% of skilled nursing denials were appealed, despite a 95% reversal rate when they were. Administrative burden and clinical deterioration collapse the practical window well before the formal deadline expires. - **Stolen Credentials Get Exploited Months Before Detection** — [Source]() — Published 2026-08-28 The fastest recorded attacker breakout time in 2025 was 27 seconds. Breaches involving stolen credentials take an average of 292 days to detect. Revoking the credential stops future access, but data exfiltrated during those ten months is already gone. - **A Disclosed Address Can Never Be Taken Back** — [Source]() — Published 2026-08-28 Thirty-nine states run address confidentiality programs because a disclosed location cannot be undisclosed. The moment the address is transmitted, there's nothing to reverse. An agent updating a CRM or shipping field has no signal that the address is protected, or that a notification could dismantle someone's safety plan. - **Biased Recommendations Sit Outside Any Dispute Process** — [Source]() — Published 2026-08-28 When an agent selects from options the user never sees, the user may not realize a better choice existed. No dispute category covers a valid purchase that was simply suboptimal. There's no remedy to decay, because no one involved perceives anything went wrong. - **Altered Drafts Accumulate Bias Users Will Never Notice** — [Source]() — Published 2026-08-28 An agent drafting communications or summarizing cases can subtly shift tone, emphasis, or stance without making the change obvious. Each output looks reasonable on its own. The bias compounds across many interactions, below the threshold where anyone would challenge a single document. - [Memory as a Write Path]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Threat Model Shift An agent retrieves something it stored about you and folds it into a response. What comes back is one continuous stretch of text. The user sees an answer; what the user cannot see is which parts were worked out just now and which were shaped by a conversation from three months ago, a connected document, or another person who once had write access to the same store. Memory extends trust backward in time. Session-scoped security testing does not reach that, and the transparency controls being added now address a different layer. - [How Persistent Memory Moves Through an Agent System]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Practical Mechanism Persistent memory in an agent system — an observation from one session shaping behavior in a later one — runs on ordinary application code: content gets written to storage, retrieved by similarity, and assembled into the model's planning context. Research presented at ACL 2026 makes each of those stages unusually legible, because the researchers exploited all three by feeding adversarial content through them exactly as specified, and nothing in the pipeline was built to notice. - [Designing Review That Resists Its Own Collapse]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Designing Effective Review An FDA-authorized pathology tool requires the doctor to record a diagnosis before the AI reveals its own. Commit first, then compare: that ordering contains most of what you need to know about designing review that resists rubber-stamping. Three areas of design detail decide whether a checkpoint holds: what evidence the reviewer sees, when review gets triggered, and how you find out whether any of it is still working. - [The Review That Isn't There]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Review as Control A survey of 86 deployed agent systems found that 74% use human verification to ensure quality. None of them compared outcomes with the review step against outcomes without it. Separately, a meta-analysis of 106 human-AI experiments found that adding a human reviewer to a stronger AI performer tends to make the result worse. The step is staffed, budgeted, and cited whenever regulators ask how quality is maintained. Whether it improves anything remains, in most organizations, untested. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [The Queue After the Queue]() — By [Sevda Polat]() · Published 2026-08-28 · Format: Residual Case Composition When a telecom deployed a conversational agent, daily call volume to human agents barely moved. But the average call got longer. The system was resolving cases and making the human operation slower at the same time. Automating routine work strips out the predictable middle and leaves behind a concentrated residue of ambiguity, judgment calls, and emotional difficulty. Organizations celebrating an 80% automation rate may be running a human operation that works less well than the one it replaced. - [Alexandre Drouin and the Benchmark as a Theory of Work]() — By [Sevda Polat]() · Published 2026-08-28 · Format: Builder Profile Alexandre Drouin's WorkArena benchmark tests AI agents on enterprise tasks inside live ServiceNow software: filtering incident lists, ordering configured laptops, reading dashboard values. Every included task shares one property — it ends in a system state that a program can verify. That criterion is also a claim about work. Tasks whose outcomes live in database fields can be benchmarked; tasks whose value depends on interpretation, conversation, or judgment that never resolves into a checkable field cannot. Drouin's design choices show where that line falls more clearly than his scores do. - [A Triage Nurse on the Sorting Decision Nobody Measures]() — Published 2026-08-28 *Dolores "Dee" Gatewood is a composite — a fictional triage nurse assembled from published research, clinical literature, and the occupational knowledge that real triage nurses have described in peer-reviewed focus groups and grounded theory studies. She is not real. Her observations are.* - [Present but Pulling Back]() — By [Sevda Polat]() · Published 2026-08-28 A [field experiment on Alibaba's Taobao](https://arxiv.org/abs/2605.14830) tested what happens when an AI agent handles customer service and routes hard cases to humans. With 647 workers and 680,000 chats, the results split cleanly. Technical escalations — cases the agent couldn't resolve — preserved service quality. Emotional escalations — already-frustrated customers — produced 40% longer resolution times, ratings down nearly a full point, and recontact rates up six percentage points. - **What Happens to Workers When Agents Escalate Too Late** — [Source]() — Published 2026-08-28 Alibaba field experiment finds worker disengagement spikes when automated agents delay handoff of emotionally charged conversations. - **How 86 Deployed Agent Systems Actually Run in Production** — [Source]() — Published 2026-08-28 ICML study finds most production agents execute fewer than 10 steps and skip external frameworks entirely. - **Tool-Using Agents Mishandle Sensitive Data During Routine Tasks** — [Source]() — Published 2026-08-28 Joint safety evaluation shows agents expose private information in normal operations, without any adversarial prompting. - **When Workers Keep Discretion, the Failure Modes Change** — [Source]() — Published 2026-08-28 Alibaba study compares assistive and autonomous agent architectures and finds fundamentally different breakdown patterns. - **How Automation Reshapes the Queue That Reaches Human Workers** — [Source]() — Published 2026-08-28 Operations research formalizes how automated routing decisions change the composition of tasks humans actually handle. - **Half of Companies That Cut Service Staff for AI Will Rehire by 2027** — [Source]() — Published 2026-08-28 Industry data shows most organizations expanding human agent roles rather than eliminating them after automation. - [What Aman Gupta's Agents Don't Decide]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Builder Profile Aman Gupta's team at Nubank built an agent architecture for over a hundred million customers largely by subtraction: deterministic sequences collapsed into single tools, toolsets held to five or fifteen options, routines translated from human procedure. The model decides only what couldn't be engineered away in advance. That's a precise account of where the model's authority ends. What the architecture doesn't yet specify is what a person receives when a live case comes back to them, because the scratchpad that keeps the agent moving isn't the artifact someone needs to pick up where it stopped. - [The Intervention Horizon as a Design Parameter]() — By [Sable Whitford]() · Published 2026-08-20 · Format: Lead Analysis Agent architectures put a human approval step in the design and call it a safety measure. Approval only works if the person arrives before the outcome is locked in, with enough context to understand what they're approving and enough time to choose otherwise. Past that point, it records consent and offers no alternative. The last moment a human can still change what happens next deserves the same specification you'd write for latency, capacity, or failure behavior. Most systems never define it. - [Who Pays for the Record]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Evidence Economics When an AI agent canceled a gym booking in Australia earlier this year, the only record of what happened was screenshots taken by the person who deployed the agent. The person whose reservation vanished had nothing. Records cost money to produce — instrumentation, storage, retrieval, access controls — and in agent systems that cost lands by default on whoever eventually needs one, which is rarely the party equipped to pay it. Regulated industries settled this question decades ago. Agent systems haven't, and the economics of the gap are entirely predictable. - [Melissa Pan's Three Evidence Problems]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Builder Profile A database recovery log carries its own interpretation. A multi-agent failure trace does not: in one recent study, six experts had to invent the failure categories before 150 traces could be classified at all. And production agent deployments generate evidence that researchers can reach only by interviewing the people who work inside. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [The Workaround Is the Pattern]() — By [Sevda Polat]() · Published 2026-08-28 · Format: Integration's Permanent Oscillation In 1984, IBM shipped a tool that let programs read a mainframe terminal screen character by character, pretending to be a human operator. It was fragile but immediately useful, because the cooperative alternative required both sides to agree, and agreement has costs that sort participants. Organizations that can afford structured integration get it; everyone else builds a workaround. Forty years later, AI agents are filling out web forms and clicking buttons for the same structural reason. The pattern predates the web. - [The Header That Learned to Lie]() — By [Sable Whitford]() · Published 2026-08-28 In 1992, HTTP added a field called `User-Agent`. The [spec](https://www.rfc-editor.org/rfc/rfc1945.html) said it was for "statistical purposes" — a voluntary note from the client identifying itself. Unsigned, unverified, totally optional. - [Hank Delimitski Has Seen This Before]() — Published 2026-08-28 Somewhere between the first EDI transaction in the 1960s and the first AI agent filling out a supplier portal form last year, a generation of integration engineers built the bilateral plumbing of B2B commerce. They negotiated standards, wrote mappings, managed exception queues, and watched informal workarounds spring up around every formal connection they built. Most of them are retired now, or close to it. The knowledge they carry about what formal integration actually cost, why it broke, and what the workarounds were compensating for is fading just as a new wave of automation arrives to cross the same boundaries. - [What RSS Couldn't Make Free Enough]() — By [Sevda Polat]() · Published 2026-08-28 · Format: Two Attempts at Resolution RSS asked almost nothing of publishers: a small XML file, no authentication, no negotiation. By 2008, half of consumer-media sites offered feeds. It was the lowest-cost path to universal machine-readable access anyone had tried. Then Twitter pulled its feeds, Google shut down Reader, and the platforms that controlled distribution stopped maintaining the side door. Even a cost that small was still a cost someone had to keep paying. - [What an API Costs to Keep Open]() — By [Sevda Polat]() · Published 2026-08-28 · Format: Two Attempts at Resolution If RSS was too simple to sustain universal coverage, APIs offered the opposite bet: structured, authenticated, richly documented interfaces between machines. By 2018, directories tracked over 19,000 of them. But each one is a commitment the provider has to keep renewing — versioned, supported, and eventually restricted when it costs more than it returns. Reddit's API still worked the day Apollo shut down. What changed was the price of using it. - **Architectural Styles and the Design of Network-Based Software Architectures** — [Source]() — Published 2026-08-28 Fielding's 2000 dissertation designed REST for hypermedia, not APIs. Read what the industry skipped. - **Roy Fielding's Misappropriated REST Dissertation** — [Source]() — Published 2026-08-28 The industry borrowed Fielding's words and ignored his constraints. Good context for how API economics got weird. - **The Rise and Demise of RSS** — [Source]() — Published 2026-08-28 Netscape portal feature to format wars to platform defeat. The syndication arc rhymes with today's AI content fights. - **Key Web Scraping Court Cases** — [Source]() — Published 2026-08-28 Chronological legal tracker from eBay v. Bidder's Edge through hiQ v. LinkedIn to current AI scraping rulings. - **Requiem for Google Reader** — [Source]() — Published 2026-08-28 Reader's 2013 shutdown pushed content distribution toward closed feeds. The open web lost a quiet load-bearing wall. - **AI Crawler and Bot Traffic Statistics 2026** — [Source]() — Published 2026-08-28 Aggregates Cloudflare, Imperva, and Fastly data with methodology notes. Useful for comparing divergent traffic estimates. - [Records Nobody Reads Until Something Breaks]() — By [Sable Whitford]() · Published 2026-08-20 · Format: Two Ledgers In 1983 a C program called syslog started appending timestamped lines to a file. It didn't check order, completeness, or who sent what, because the reader was assumed to be an engineer arriving after a crash. That append-everything, search-later model became the default shape of digital record-keeping. Agent audit trails are inheriting it now, and pointing it at a question it was never built for: not what broke, but what a system decided and whether it had the authority to decide it. - [The Ledger That Watches Itself]() — By [Sable Whitford]() · Published 2026-08-20 · Format: Two Ledgers Venetian merchants kept books that caught their own errors. A half-finished entry left a visible mark on the page long before anyone came to inspect it. Double-entry bookkeeping was a bet that the format should do the first pass of verification, so that discrepancies surfaced without anyone having to go looking. Most digital transaction systems dropped that bet and replaced it with access controls and audit policy. The difference matters when the trusted system is the one producing the errors. - [What the Log Couldn't Hide]() — By [Sevda Polat]() · Published 2026-08-20 · Format: The Logbook Thread When Judge Learned Hand found erased and overwritten entries in a ship's log in 1939, he did not simply discount the record. He treated the fabrication as evidence of concealment. That was the point of the book's physical design: a missing page number or a date out of sequence gave the tampering away. Digital event logs were built to answer a different question, and agent audit trails inherited that architecture. The question they will face in disputes and regulatory proceedings is the older one: can the surviving record distinguish an authorized action from an unauthorized one? - [AI Diffusion Through Two Channels]() — By [Sevda Polat]() · Published 2026-08-13 · Format: Machinery and Mirror Census data covering 117,000 firms shows 6.8% reporting that workers use AI for tasks while the firm itself doesn't register as an adopter. The spreadsheet precedent tells you what tends to happen when individual use outruns institutional oversight, and roughly how long governance takes to catch up. But agents call external tools and change records in systems their firm doesn't own, which is where the comparison stops being useful. ### [Vision]() Where human-AI collaboration is heading - [The Credence Problem]() — By [Sevda Polat]() · Published 2026-08-28 · Format: Anchor Essay When you send an agent to do something you cannot do yourself, you also cannot check whether it did it correctly. That is not a defect in the design. It is the same condition that made the agent worth using. Economists identified this structure decades ago in auto repair and medical care: goods whose quality the buyer cannot assess even after consumption. A growing share of agent output belongs in that category, and the research on what happens when people try to compensate through transparency suggests the problem does not yield to the fixes we reach for first. - [The Users Who Got There First]() — By [Sevda Polat]() · Published 2026-08-28 · Format: Two Cases Blind and low-vision users have spent years depending on AI descriptions they cannot independently verify. They've developed sophisticated checking strategies — and new research shows those strategies still miss confident wrong answers at alarming rates. What this community has learned about trusting an AI intermediary, and where that trust still breaks down, matters for every organization now deploying AI as its default first reader. - [When Nobody Reads the Original]() — By [Sevda Polat]() · Published 2026-08-28 · Format: Two Cases When an AI summarizes a contract, a security incident, or a recorded engineering conversation, the summary becomes the event for everyone downstream. Enterprise organizations are acquiring the same dependency on unverifiable AI accounts that the accessibility community has navigated for years — but without the verification instincts. And the expertise needed to catch errors is quietly thinning as the AI displaces the practice that built it. - [The Woman in the Booth Who Edits Reality for a Living]() — Published 2026-08-28 *Vivian Sotto is a fictional audio describer. Her craft is not.* - [Adequate for What]() — By [Sevda Polat]() · Published 2026-08-28 The W3C's [accessibility guidelines](https://www.w3.org/WAI/tutorials/images/) encode a principle that agent builders are arriving at from the other direction: the adequacy of a description depends on what someone needs it for. A photo of a bird on a birding site needs species and plumage. The same photo on a parks page needs "bird at the lake." A printer icon used as a button should say "print," not "image of a printer." - **Web User Agents: The W3C Draft That Wants to Hold AI Accountable to Users** — [Source]() — Published 2026-08-28 W3C proposes extending user-agent duties of protection, honesty, and loyalty to AI acting on the web. - **Playing Telephone with Generative Models: When Mostly-Correct Systems Trap Users into Trust** — [Source]() — Published 2026-08-28 Researchers name what happens when AI outputs are too plausible to doubt but too flawed to trust fully. - **The Oversight Fallacy: Why Approval Prompts Don't Make Agents Safe** — [Source]() — Published 2026-08-28 A human clicking "approve" means little without the knowledge and context to judge what they're approving. - **Delegated Agency and Moral Responsibility in AI** — [Source]() — Published 2026-08-28 When an AI agent fails ethically, the paper argues the failure traces back to human governance choices. - **Delegation Fidelity: How Users Judge Whether an AI Acted Within Their Contract** — [Source]() — Published 2026-08-28 A framework for measuring whether agents actually honor the goals and constraints users thought they set. - **Independence at a Cost: Blind Users Weigh Privacy Against AI-Powered Autonomy** — [Source]() — Published 2026-08-28 Assistive AI frees blind users from human helpers but routes private information through opaque new systems. - [Who Budgets for the Cases That Don't Fit]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Signal and Status Commonwealth Bank of Australia cut forty-five call-center jobs after deploying an AI voice system. Within a month it reversed course: call volumes had risen, overtime was being offered, team leaders were being pulled onto calls. The staffing reduction had been modeled against routine volume. What the automated system wouldn't resolve, and what those cases would require, had not been modeled at all. - [What Exceptions Know]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Signal and Status When automated systems handle the predictable middle of a distribution, the cases that don't fit become an organization's main channel for learning that conditions have changed. Before the Firestone recall, the tire industry's monitoring system was working exactly as designed, answering the question it had been built to answer. The warranty claims were answering a different question. One nobody had formally asked. - [The Exception Economy]() — By [Sevda Polat]() · Published 2026-08-20 · Format: The Exception Economy Most enterprise AI use is still narrow, concentrated in text production, search, and document interpretation. But the pattern of what gets automated first tells you something about what's left behind. As routine work becomes infrastructure, the manual work that remains — the exceptions, the edge cases, the situations nobody wrote a policy for — starts concentrating two things that used to be spread across every role and every afternoon: cost, and organizational learning. They pull against each other in ways we're only beginning to see. - [The Balance Nobody Checks]() — By [Sable Whitford]() · Published 2026-08-12 · Format: Paired Applications When a recurring exception gets compiled into an automation rule, the organization withdraws from a balance it doesn't track. The rule carries the conclusion forward but sheds the reasoning. Conditions shift, the fit degrades, and nobody notices. Physical assets get depreciation schedules and replacement-cost estimates. The judgment that built your exception-handling process gets no line item at all — even as agents accelerate the spending. ## More - [Publication guide]() - [Issue archive]()