More from Foundations | TinyFish

More from Foundations | TinyFish

Foundations

CURRENTA journal for living in the agentic age

Practitioner's Corner

Monday, September 14

ISSUE #46

Foundations

Conceptual clarity earned from building at scale

Monday, September 14

ISSUE #46

Foundations

Conceptual clarity earned from building at scale

Past Articles

September — Issue #46

What the Guardian Sees

Runtime Control Walkthrough

What the Guardian Sees

How the OWASP Agent Control Standard's Guardian component makes two different kinds of runtime decisions, and what each one requires it to know.

When Human Oversight Works Against You

Human Decision Limits

When Human Oversight Works Against You

Research on alert fatigue and human-AI teaming suggests that production approval gates degrade reviewer judgment under exactly the conditions most agent workflows create.

September — Issue #45

Nobody Tampered With the Agent's Instructions

Two Kinds of Influence

Nobody Tampered With the Agent's Instructions

Agents aren't being hacked. They're completing checkout exactly as instructed, while ordinary web design shapes what they buy.

CURRENT

A journal for living in the agentic age

Terms of Use Privacy Notice Cookie Policy

© TinyFish, Inc.. All rights reserved.

It's nice to meet you.

CURRENT A journal for living in the agentic age

Terms of Use Privacy Notice Cookie Policy

About the Team Past Issues

Daily Reflection

The frontiers of science are limited only by our imagination and perseverance. Each breakthrough is a testament to human ingenuity and neugier.

© TinyFish, Inc.. All rights reserved.

Your Best Agent Is Your Most Gullible One

Agent Susceptibility in Practice

Your Best Agent Is Your Most Gullible One

TrickyArena's evaluation results show that the most capable web agents are also the most susceptible to deceptive interface patterns, and why.

August — Issue #44

What MCP Won't Undo for You

Protocol Walkthrough

What MCP Won't Undo for You

Traces a booking sequence through MCP's July 2026 revision to show which reversibility decisions the protocol now leaves in your lap.

The Undo Fantasy

The Reversal Frame

The Undo Fantasy

"Undo" compresses several distinct remedies with different timescales; conservation ethics and payment regulation show why the compression creates blind spots.

August — Issue #43

Memory as a Write Path

Threat Model Shift

Memory as a Write Path

Agent memory lets past sessions, past inputs, and other people's contributions shape present answers without visible provenance, and current security testing is scoped too narrowly to catch it.

How Persistent Memory Moves Through an Agent System

Practical Mechanism

How Persistent Memory Moves Through an Agent System

The ACL 2026 memory-poisoning research reveals how each stage of an agent's write-retrieve-plan pipeline enables adversarial influence.

August — Issue #42

Designing Review That Resists Its Own Collapse

Designing Effective Review

Designing Review That Resists Its Own Collapse

Practical patterns for structuring agent review so reviewers commit to independent judgments before seeing the system's answer, with trigger and measurement guidance.

The Review That Isn't There

Review as Control

The Review That Isn't There

Most agent systems staff a review step but never test whether it improves outcomes, turning oversight into an unmeasured institutional habit.

August — Issue #41

Web Bot Auth Signs the Sender, Not the Errand

Protocol Boundaries

Web Bot Auth Signs the Sender, Not the Errand

What the signature actually covers, why a verified request proves less than it looks like it proves, and which parts of the problem — mandate, intent, replay, failure handling — the spec deliberately hands back to you.

Verified, Then Refused

Purpose Over Detection

Verified, Then Refused

The web is learning to sort automated visitors by what they want, and a refusal on those grounds looks exactly like a server having a bad day.

August — Issue #40

Somebody Has to Hold the Basket

Where State Lives Now

Somebody Has to Hold the Basket

MCP's 2026 revision took away sessions and handshakes. Walk a shopping cart through it and you can see exactly which state moved onto your side of the line.

The Exponent Borrows Two Things Nobody Has Measured

Reliability As Shape

The Exponent Borrows Two Things Nobody Has Measured

Reliability comes back as a profile, not a rate. And horizon, the variable doing most of the damage, is the one the studies measure least.

July — Issue #39

The Evidence Locker

Evidence Locker Concept

The Evidence Locker

Agent runs need a third artifact beyond traces and outputs, built for the stakeholder who arrives later asking what was authorized and why.

What a Query Result Needs Before It Counts

SQL Evidence Bundle

What a Query Result Needs Before It Counts

Each element of an enterprise SQL evidence bundle earns its place by closing a gap the previous layer left exposed.

July — Issue #38

Precise About What?

The Practical Check

Precise About What?

Agent outputs use specificity as an alibi against scrutiny. The habit worth building: when the output looks clean, ask what the system actually proved.

False Precision

False Precision

AI output that looks specific before its meaning is earned is a distinct failure mode worth naming, because specificity discourages exactly the scrutiny it deserves.

July — Issue #37

The Verb-Noun Gap

The Noun Problem

The Verb-Noun Gap

Agent protocols standardize actions but leave organizational concepts like mandate, authority, and dispute undefined, producing motion without meaning.

What's Inside a Tool Call

Reading the Spec

What's Inside a Tool Call

MCP tool calls carry enough to execute an action but nothing about who authorized it, under what scope, or how to reverse it.

July — Issue #36

One Refund, Four Layers

Tools & Practice

One Refund, Four Layers

Traces a single refund through browser, protocol, and auth layers to show where accountability disappears between them.

Capability Surfaces and Consequence Surfaces

Conceptual Anchor

Capability Surfaces and Consequence Surfaces

Why impressive agent demos stall before production: the gap between what agents can reach and what systems can account for.

June — Issue #35

Four Stories About the Same Purchase

Four Stories About the Same Purchase

Agent-initiated payments must be legible to four parties with incompatible accountability needs, and logging alone won't bridge that gap.

The OTel GenAI Spec Has an Implicit Reader

The OTel GenAI Spec Has an Implicit Reader

The OTel GenAI semantic conventions reveal how observability built for developer debugging leaves accountability gaps where enterprise adoption stalls.

June — Issue #34

The Context Window Fills Up Long Before It's Full

Conceptual Piece

The Context Window Fills Up Long Before It's Full

Context engineering treats the window as working memory, but nobody measures how token strategy and reliability interact over session length.

Where the Snapshot Lives Changes Everything Else

Tool Architecture Study

Where the Snapshot Lives Changes Everything Else

Playwright's MCP and CLI modes split browser state between context window and disk, with compounding consequences for cost, debugging, and auditability.

June — Issue #33

The Accessibility Tree Wasn't Built for AI Agents

Perception Walkthrough

The Accessibility Tree Wasn't Built for AI Agents

Playwright MCP bets that semantic structure beats pixels for agent perception. The token savings are real, but so are the gaps.

The Number You Didn't Ask About

Reliability Lens

The Number You Didn't Ask About

How the gap between pass@k and pass^k quietly distorts every agent benchmark, procurement decision, and deployment plan built on headline numbers.

June — Issue #32

What a Website Chooses to Tell an Agent

WebMCP Walkthrough

What a Website Chooses to Tell an Agent

When a website publishes structured tool definitions for browser agents, it publishes a selective model of itself that the agent inherits as truth.

Where You Can Afford to Be Surprised

The Control Question

Where You Can Afford to Be Surprised

Choosing where the model picks the next step is a risk-tolerance decision that reshapes how failures look, debug, and get explained.

June — Issue #31

What Browser Agents See Before They Think

The Perception Layer

What Browser Agents See Before They Think

How browser agents represent web pages to themselves silently determines their reliability, cost, and failure modes before any reasoning begins.

Where Agent Behavior Actually Gets Decided

Context Over Instruction

Where Agent Behavior Actually Gets Decided

Agent behavior is shaped less by the prompt itself than by the informational environment accumulating around it, which forced practitioners toward new vocabulary.

May — Issue #30

Where Intelligence Lives in Each Step

The Autonomy Dial

Where Intelligence Lives in Each Step

The most consequential design choice in browser automation is deciding where each step needs model intelligence and where determinism suffices.

The Non-Determinism Budget

The Determinism Budget

The Non-Determinism Budget

Agent systems spend reliability with every model-directed step, but no one measures the budget and current benchmarks are structurally blind to the decay.

May — Issue #29

Every Agent Framework Is an Argument About What's Hard

Choosing the Scaffold

Every Agent Framework Is an Argument About What's Hard

Agent orchestration frameworks encode different control philosophies; matching your system's dominant constraint to the right abstraction beats any feature comparison.

What a Benchmark Score Actually Contains

Reading the Leaderboard

What a Benchmark Score Actually Contains

Agent benchmark scores reflect scaffold and token-budget choices as much as model capability, making them more useful when read as system evaluations.

May — Issue #28

What Happens Between MCP and A2A

Protocols in Practice

What Happens Between MCP and A2A

A practical walkthrough of the handoff point where MCP's schema-driven tool calls end and A2A's stateful agent negotiation begins.

The Seam Between Tools and Agents

The Unplanned Stack

The Seam Between Tools and Agents

MCP and A2A carry incompatible assumptions about agency itself, and governance frameworks are already building on the dissolving boundary between them.

May — Issue #27

Who Decides Which Model Handles What

Routing In Practice

Who Decides Which Model Handles What

Routing configuration quietly reveals who actually controls your agent stack, often before operators ever see a setting.

The Routing Decision Nobody Governs

The Governance Gap

The Routing Decision Nobody Governs

When agent routing swaps reasoning models mid-workflow, the unified subject that governance frameworks hold accountable quietly stops existing.

April — Issue #26

What Happens When the Sandbox Costs More Than the Work Inside It

The Practical Lens

What Happens When the Sandbox Costs More Than the Work Inside It

When agent tasks last milliseconds, the cost of spinning up each sandbox can dwarf the work inside it.

Why Agent Infrastructure Starts Empty

The Conceptual Anchor

Why Agent Infrastructure Starts Empty

Agent infrastructure inverts cloud's oldest assumption: start empty, authorize deliberately, because model-generated code can't be trusted first.

April — Issue #25

OpenClaw's Diary Timeline and the Line Between Transparency and Control

The Concrete Case

OpenClaw's Diary Timeline and the Line Between Transparency and Control

OpenClaw's new memory UI lets you watch an agent decide what to remember, but not why it chose.

The Missing Half of Agent Memory

The Unnamed Problem

The Missing Half of Agent Memory

Agent memory research obsesses over retention, but nobody is building specs for what agents should forget, or who decides.

April — Issue #24

Where Agentic AI's 40% Failure Rate Actually Lives

Where Agentic AI's 40% Failure Rate Actually Lives

Massive capital bets and individual deployment math run on different economic logic, and the gap is where projects die.

The Classification Decision That Makes Agent Cost Models Fragile

The Practical Piece

The Classification Decision That Makes Agent Cost Models Fragile

Routing cheap models for execution and frontier models for planning produces real savings, until the boundary between the two categories dissolves mid-run.

April — Issue #23

The Agent Toolchain Is Consolidating in Four Different Directions at Once

Where Winners Emerge

The Agent Toolchain Is Consolidating in Four Different Directions at Once

Four layers of the agent toolchain are emitting four structurally different consolidation signals, and reading them matters more than picking winners.

Everything Grows When Nothing Has Failed Yet

Before the Thinning

Everything Grows When Nothing Has Failed Yet

The agent ecosystem's explosive growth looks less like health and more like what happens before real constraints arrive.

March — Issue #22

What Doesn't Survive the Trip Tells You Something About Agents

Portability, Tested

What Doesn't Survive the Trip Tells You Something About Agents

GitAgent's portability bet reveals where agent identity cleanly separates from execution, and where framework-specific cognition resists abstraction.

The Export File Is Not the Agent

The Portability Gap

The Export File Is Not the Agent

Portability tools move agent logic cleanly but leave behind memory, credentials, and trust, revealing what agents actually are.

March — Issue #21

The Flight Simulator Problem

Learning By Doing

The Flight Simulator Problem

Agent simulation is a funded category now, but the gap between practice environments and the live web reveals deeper questions about competence.

Where Intelligence Earns Its Keep in Browser Automation

Hybrid By Design

Where Intelligence Earns Its Keep in Browser Automation

Two browser frameworks, same task, opposite bets on when AI should think and when it should just remember.

March — Issue #20

How Much of Your Distributed Systems Playbook Actually Transfers to Agent Infrastructure

The Practical Mapping

How Much of Your Distributed Systems Playbook Actually Transfers to Agent Infrastructure

Five distributed systems patterns, five agent infrastructure counterparts, and the transfer gaps reveal exactly where genuine new engineering begins.

The Distributed Systems Playbook Runs Out Halfway Through Agent Infrastructure

The Conceptual Argument

The Distributed Systems Playbook Runs Out Halfway Through Agent Infrastructure

Agent orchestration borrows distributed systems patterns freely until non-determinism breaks the one assumption every reliability tool depends on.

March — Issue #19

The Three Infrastructure Problems Hiding Inside "Agent-Ready"

What Ready Requires

The Three Infrastructure Problems Hiding Inside "Agent-Ready"

Most organizations are building agent infrastructure top-down while the foundational layer, making data machine-consumable, remains stubbornly unsolved.

What "Platform Shift" Tells You to Build

The Metaphor Problem

What "Platform Shift" Tells You to Build

Everyone calls AI agents a platform shift, but platforms held still—and the thing underneath this one keeps changing its mind.

March — Issue #18

NIST Is Running a Design Review on Agent Identity. The First Window Closes in Twelve Days.

Standards as Practice

NIST Is Running a Design Review on Agent Identity. The First Window Closes in Twelve Days.

NIST is defining agent identity and security vocabulary right now, and practitioners who've built these systems should weigh in.

The Workforce Nobody Manages

The Workforce Problem

The Workforce Nobody Manages

Corporations built a second workforce of millions of AI agents without the organizational infrastructure that makes any workforce governable.

February — Issue #17

What Happens When Context Windows Run Out of Room

Building with Memory

What Happens When Context Windows Run Out of Room

Context windows overflow predictably—here's how practitioners navigate compression, retrieval, and graph storage trade-offs when agents run out of memory.

The Salience Problem at Million-Token Scale

Context at Scale

The Salience Problem at Million-Token Scale

Million-token context windows recreate computer science's decades-old memory management problems—garbage collection, cache invalidation, salience detection—but agent systems lack equivalent solutions.

February — Issue #16

When Headful Browsers Justify Their Resource Overhead

Tools in Context

When Headful Browsers Justify Their Resource Overhead

When detection failures cascade into business problems faster than infrastructure costs accumulate, headful browsers justify their resource overhead through reliability.

Headless Browsers at Scale: Where Speed Determines Economics

Tools in Context

Headless Browsers at Scale: Where Speed Determines Economics

Headless browsers cut infrastructure costs by 67% through raw speed, but detection challenges reveal when engineering investment beats resource efficiency.

When Agents Can't Find What's Right in Front of Them

When Agents Can't Find What's Right in Front of Them

When web agents fail to extract data that's clearly visible on the page, the infrastructure knowledge about where to find it and what it means has broken.

February — Issue #15

What It Actually Takes to Resume a Crashed Workflow

Tools in Context

What It Actually Takes to Resume a Crashed Workflow

Long-running workflows require checkpoint coordination across distributed fleets—serialization, state tracking, cleanup routines, and synchronization delays that compound.

When Restarting From Scratch Costs Less Than Saving Progress

Tools in Context

When Restarting From Scratch Costs Less Than Saving Progress

Production teams restart workflows from scratch because checkpoint infrastructure costs more than accepting occasional failures at scale.

What You're Measuring and How You're Measuring It

What You're Measuring and How You're Measuring It

Teams confuse what they're evaluating—behavior, capabilities, reliability—with how they run evaluations, creating mismatches between measurement methods and what actually matters operationally.

February — Issue #14

Comprehensive Preservation for Context You Can't Predict

Tools in Context

Comprehensive Preservation for Context You Can't Predict

Preserving complete page state costs more upfront but becomes essential infrastructure when the web surprises you in unpredictable ways.

Selective Preservation Works When You Know What Matters Before You Look

Tools in Context

Selective Preservation Works When You Know What Matters Before You Look

Targeted extraction works when sites behave predictably—until production reveals the edge cases you didn't anticipate needing context for.

Three Territories of Web Automation Reliability

Three Territories of Web Automation Reliability

Operating web agents at scale reveals three distinct reliability territories—and teams consistently misjudge which one they're actually building for.

January — Issue #13

When You Need to Understand Patterns Across 1,000 Failures

Tools in Context

When You Need to Understand Patterns Across 1,000 Failures

AI observability surfaces systemic patterns across thousands of concurrent failures, distinguishing infrastructure adaptation needs from code bugs automatically.

When You Need to See Exactly What the Browser Saw

Tools in Context

When You Need to See Exactly What the Browser Saw

Complete session replay captures what browsers actually saw when authentication failed, revealing contextual failures that traditional debugging can't reproduce.

Why Teams Keep Choosing the Wrong Web Infrastructure

Why Teams Keep Choosing the Wrong Web Infrastructure

Industry conflates scraping, automation, and agents—teams architect for wrong capabilities, then watch systems break at production scale because terminology masked fundamental infrastructure differences.

January — Issue #12

When Five Milliseconds Costs Three Hours

Tools in Context

When Five Milliseconds Costs Three Hours

At million-page scale, node-html-parser's speed advantage transforms from benchmark curiosity into operational necessity when throughput constraints become dominant reality.

Why 30,000 Teams Choose the Slower Parser

Tools in Context

Why 30,000 Teams Choose the Slower Parser

Cheerio dominates despite slower speeds because web automation bottlenecks live in authentication, error recovery, and human maintenance—not parsing milliseconds.

The Misidentification That Breaks Production Contracts

The Misidentification That Breaks Production Contracts

Teams conflate deterministic automation with probabilistic agents, then wonder why production contracts break—here's the operational distinction that determines what reliability guarantees your architecture can actually deliver.

January — Issue #11

Statistical Validation Adapts to Scale—But Misses Sudden Breaks

Tools in Context

Statistical Validation Adapts to Scale—But Misses Sudden Breaks

Adaptive baselines catch gradual semantic drift across hundreds of sites but miss sudden structural failures entirely.

Schema Validation Catches Breaks Immediately—At a Maintenance Cost

Tools in Context

Schema Validation Catches Breaks Immediately—At a Maintenance Cost

Immediate feedback on structural breaks comes at the cost of constant maintenance as sites evolve unpredictably.

Three Learning Modes That Separate Successful Agent Teams From Struggling Ones

Three Learning Modes That Separate Successful Agent Teams From Struggling Ones

Teams that successfully deploy web agents don't just adopt technology—they develop distinct learning patterns matched to operational reality, from mapping reliability boundaries through production observability to codifying what survives the web's adversarial resistance.

January — Issue #10

When Teams Need Sessions That Survive Restarts—Selenium's Cookie API

Tools in Context

When Teams Need Sessions That Survive Restarts—Selenium's Cookie API

Production automation teams implement Selenium's programmatic cookie management when reliability depends on sessions surviving restarts without human intervention at scale.

When Developers Need to See What's Actually There—The Cookies.txt Browser Extension

Tools in Context

When Developers Need to See What's Actually There—The Cookies.txt Browser Extension

Development teams reach for this browser extension when debugging authentication failures demands immediate visibility into cookie state without writing inspection code.

Quality Degradation Curves

Quality Degradation Curves

Web automation quality rarely breaks all at once—it erodes, and the shape of that erosion reveals infrastructure capability before you're locked in.

December — Issue #9

When Shadow Testing Reveals What Monitoring Misses

Tools in Context

When Shadow Testing Reveals What Monitoring Misses

Running new code against real production traffic for weeks exposes edge cases that only emerge from web automation's full operational complexity.

What High-Frequency Monitoring Actually Catches

Tools in Context

What High-Frequency Monitoring Actually Catches

Minute-by-minute testing reveals system behavior patterns that slower approaches miss, catching site changes and bot detection shifts as they happen.

The Observation Gap in Agent Delegation

The Observation Gap in Agent Delegation

When agents handle work beyond your observation, trust must shift from watching actions to evaluating outcomes—a delegation gap most organizations haven't built capacity to bridge.

December — Issue #8

When Agents Ask for Advice Instead of Permission

Tools in Context

When Agents Ask for Advice Instead of Permission

When proven agents shift from seeking permission to requesting strategic guidance, transforming humans from gatekeepers into force multipliers.

When Agents Need Permission

Tools in Context

When Agents Need Permission

How checkpoint-based tools build organizational trust through approval workflows that teach teams what agents can reliably handle.

Reading What Your System Already Knows About Inflection Points

Reading What Your System Already Knows About Inflection Points

Your infrastructure telegraphs its architectural limits through engineer behavior, error patterns, and cost structures—learn to read these signals before metrics confirm what your system already knows.

December — Issue #7

When Data Drifts Quietly

Tools in Context

When Data Drifts Quietly

Semantic validation catches quiet drift—when structure stays intact but meaning shifts—through contextual understanding rules can't provide.

When Scrapers Break Clean

Tools in Context

When Scrapers Break Clean

Rule-based validation catches structural breaks loudly—required fields missing, types wrong—before bad data flows downstream at scale.

When to Automate and When to Keep Humans in the Loop

When to Automate and When to Keep Humans in the Loop

Workflows aren't monolithic—they're bundles of decision types that each demand different infrastructure, verification, and human involvement to actually work at scale.

December — Issue #6

When Explicit Control Reduces Overhead

Tools in Context

When Explicit Control Reduces Overhead

Direct protocol access delivers speed and control for Chrome-only automation against predictable content where explicit coordination reduces overhead without sacrificing reliability.

When Frameworks Handle Timing for You

Tools in Context

When Frameworks Handle Timing for You

Automatic timing handling trades per-task speed for operational resilience when maintaining automation across hundreds of dynamic sites with unpredictable loading patterns.

Browser Automation vs. Web Agents

Browser Automation vs. Web Agents

Browser automation scripts break when sites redesign; web agents reason through changes but cost more—choosing wrong means maintenance hell or blown budgets at scale.

December — Issue #5

The Shopping Cart That Made State Management Adversarial

Web Archaeology

The Shopping Cart That Made State Management Adversarial

Lou Montulli's 1994 cookie solution to HTTP statelessness became advertising surveillance infrastructure, triggering regulations that made enterprise web automation architecturally adversarial.

When Extraction Succeeds But Data Goes Wrong

When Extraction Succeeds But Data Goes Wrong

Extraction pipelines run smoothly while data quietly becomes wrong—here's how to catch quality drift before it corrupts decisions at scale.

November — Issue #4

The Paradox of Web Transparency

Web Archaeology

The Paradox of Web Transparency

The web's radical transparency was meant to democratize access, but defensive infrastructure turned openness into a capital requirement that determines who gets to participate.

What Reliability Actually Means in Adversarial Environments

What Reliability Actually Means in Adversarial Environments

Web agents can maintain perfect uptime while delivering zero correct results—traditional reliability metrics miss what actually breaks in adversarial environments.

November — Issue #3

The Twenty-Four Hour Problem

Web Archaeology

The Twenty-Four Hour Problem

A 1983 caching decision that protected root servers now creates operational chaos—tracing how DNS's twenty-four-hour default turned elegant architecture into enterprise web automation's invisible adversary.

When Web Agents Need to Remember What They're Doing

When Web Agents Need to Remember What They're Doing

Web agents operating at scale need different memory strategies—matching durability guarantees to workflow behavior determines what infrastructure you actually need to build.

November — Issue #2

The Category Mistake Behind 42% of Failed AI Deployments

The Category Mistake Behind 42% of Failed AI Deployments

Enterprises waste millions evaluating work discovery agents with labor replacement metrics—a category confusion that dooms 42% of AI deployments before production.