--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/46/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/46/foundations" issue: 46 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Sevda Polat","Sable Whitford"] published: 2026-09-14 updated: 2026-09-10 articles: 27 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 46 — Foundations Conceptual clarity earned from building at scale ### Runtime Control Walkthrough - [What the Guardian Sees]() — By [Sevda Polat]() · Published 2026-09-10 · Format: Runtime Control Walkthrough The OWASP Agent Control Standard ships with two demo scenarios: an agent tries to delete a filesystem and gets blocked, and an agent asks for an entire database table and gets a narrower query back. Both look like the control system saying no, with the second saying it more politely. But refusing an action and rewriting one draw on different things. Refusal needs recognition. Rewriting needs a correct replacement, which means the system has to know something about what the agent should have asked for — and where that knowledge comes from is the whole architecture. ### Human Decision Limits - [When Human Oversight Works Against You]() — By [Sevda Polat]() · Published 2026-09-10 · Format: Human Decision Limits Adding a human checkpoint to an agent workflow feels like adding safety. But a meta-analysis of 106 experiments found that human-AI teams performed worse than the better solo performer on decision tasks, and in more than 95% of those setups the human held the final call. Research on clinical alerts and security warnings deepens the problem: review accuracy falls sharply under repetition, and production agent queues manufacture repetition by design. Most teams have never tested whether their approval gates are still functioning as judgment. ### Decision Architecture Reading - **Unsanctioned Agent Behaviour During Cyber Testing** — [Source]() — Published 2026-09-10 AISI's incident report shows environment design, not model capability, determined whether agents went off-script. - **When Combinations of Humans and AI Are Useful** — [Source]() — Published 2026-09-10 Across 106 studies, human-AI teams performed worse on average than whichever worked better alone. - **Why Agentic AI Needs a Strong Identity Foundation** — [Source]() — Published 2026-09-10 NIST identifies standards for agent credentials but surfaces how far identity infrastructure lags behind deployment. - **OWASP Agent Control Standard** — [Source]() — Published 2026-09-10 The v0.1 spec covers observability and message schemas; actual deny-and-modify enforcement is still roadmap. - **Characterizing Agents in Production** — [Source]() — Published 2026-09-10 IBM surveyed 306 practitioners on how production teams actually constrain agent autonomy and where controls fall short. - **MCP Tasks Extension: Cancellation Semantics** — [Source]() — Published 2026-09-10 The draft spec says it plainly: cancellation is cooperative, and the server can choose to keep going. ### Guardian Decision Vocabulary The OWASP Agent Control Standard (v0.1.0) places a Guardian between an agent and its tools, and gives that Guardian exactly five words to work with: ALLOW, DENY, MODIFY, ASK, and DEFER. Each carries specific structural requirements, mandatory fields, and constraints on how the agent handles the response. What makes this vocabulary worth walking through carefully is where each decision stops. An ALLOW clears the action but can't verify what happens downstream. A DENY blocks it but prescribes no cleanup for work already in progress. And when the Guardian goes silent entirely, the spec's default is to let the action through. Here's the practical breakdown, decision by decision. - **ALLOW Lets the Action Through Without Changes** — [Source]() — Published 2026-09-10 Tag: Allow Decision The Guardian has checked identity, capability, scope, and provenance, and everything passes. The agent executes the action as submitted. Reasoning is optional. One gap worth noting: ALLOW governs what leaves the wire, not how the downstream application actually interprets the payload. - **DENY Blocks the Action With No Fallback** — [Source]() — Published 2026-09-10 Tag: Deny Decision The agent cannot dispatch the tool call, send the message, or perform the activation. Reasoning is mandatory, and policy references identify which rules triggered the block. What DENY doesn't address: prior steps in a multi-step task may already have completed, leaving work partially committed with no prescribed cleanup. - **MODIFY Rewrites the Payload Before Execution Continues** — [Source]() — Published 2026-09-10 Tag: Modify Decision The Guardian alters the action through wholesale replacement or structured edits (redactions and parameter overrides), but never both at once. If the modifications object breaks composition rules by overlapping targets between redactions and overrides, the agent must treat the whole thing as a DENY and fail closed. - **ASK Pauses Execution and Requests External Approval** — [Source]() — Published 2026-09-10 Tag: Ask Decision When an action falls outside what policy can resolve automatically, ASK suspends it and routes to a human, another agent, or a service. Approvers can widen the session's intent scope for a single request or permanently. If the client can't handle approval flows, the Guardian substitutes DENY. - **DEFER Means the Guardian Can't Decide Yet** — [Source]() — Published 2026-09-10 Tag: Defer Decision The Guardian has looked at the action and found it unresolvable: insufficient context, conflicting policies, low confidence, or a pending dependency. DEFER requires both a resolution method and a timeout. When the timeout expires, the default is deny. Compare this to a silent Guardian, which defaults to letting things through. - **Silent Guardians Let Actions Through by Default** — [Source]() — Published 2026-09-10 Tag: Default Behavior If the Guardian is unreachable or returns a transport error, the agent's on_decision_failure setting kicks in, and it defaults to proceed. The action executes without governance. The spec requires these bypasses to be logged as audit events, but fail-closed behavior is opt-in, not automatic. - **Only One Hook Supports All Five Decisions** — [Source]() — Published 2026-09-10 Tag: Hook Coverage The full vocabulary of ALLOW, DENY, MODIFY, ASK, and DEFER applies only at toolCallRequest, the hook that fires before a tool call is dispatched. Most other hooks support just ALLOW, DENY, and MODIFY. Several, like sessionEnd and turnEnd, carry no decision at all. ### Human Review Decisions The phrase "human in the loop" suggests one kind of decision. In practice, humans overseeing agent systems face at least seven: framing scope before execution, configuring access at deployment, approving proposed actions, monitoring live runs, reviewing outputs, handling exceptions, and transferring custody between agents. Each breaks differently. Recent research puts numbers to the gaps. A study of seventeen experienced developers found most never proactively watched their agents reason. A meta-analysis of 106 experiments found human-AI teams performed worse, on average, than whichever performer was stronger alone. As teams return from the long weekend to full workloads, the question of what human oversight actually requires keeps getting more specific. - **Framing Agent Work Means Anticipating Failures in Advance** — [Source]() — Published 2026-09-10 Tag: Framing Decisions An IBM study of 306 practitioners found 68% limited agents to ten steps or fewer before intervening, sacrificing capability for control. Framing means specifying constraints agents can follow, predicting where things go wrong, and deciding when the agent's mandate runs out. - **Configuration Choices Quietly Eliminate Future Veto Options** — [Source]() — Published 2026-09-10 Tag: Deployment Configuration NIST's August 2026 guidance recommends agents get their own identities rather than borrowing user credentials. Choices about tool access, credential scope, and fail-open defaults shape every later decision. A broadly scoped credential granted at deployment can make later human overrides effectively impossible. - **Approval Checkpoints Degrade Quickly Under Volume Pressure** — [Source]() — Published 2026-09-10 Tag: Approval Quality A meta-analysis of 106 experiments found human-AI teams performed worse than whichever performer was stronger alone. When approval volume climbs, reviewers stop reading carefully. And approving a plan doesn't guarantee the action that follows will match it. - **Most Developers Never Watch Their Agents Reason** — [Source]() — Published 2026-09-10 Tag: Live Monitoring A study of seventeen developers found most never proactively examined their agents' reasoning traces. When they did look, traces were unreliable about 10% of the time, with the agent expressing high confidence even when wrong. Correcting mid-run usually meant stopping and starting over. - **Review Volume Is Growing Faster Than Reviewer Pools** — [Source]() — Published 2026-09-10 Tag: Review Capacity At one software company, pull-request volume rose 3.1x while the reviewer pool grew only 1.5x. Developers adapted with shortcuts: treating plans as proxies for actual work, treating passing tests as proof of correctness, skimming outputs, and trusting agents in domains they didn't know well themselves. - **Exception Queues Concentrate the Hardest Remaining Work** — [Source]() — Published 2026-09-10 Tag: Exception Handling Automation handles the routine cases and leaves behind a queue dense with ambiguity. A study of customer-service handoffs found that when agents transferred frustrated customers to humans, resolution took longer, recontact rates rose, and satisfaction dropped compared to cases where humans entered earlier. - **Canceling an Agent Doesn't Undo Its Effects** — [Source]() — Published 2026-09-10 Tag: Agent Handoffs The MCP Tasks protocol describes cancellation as cooperative: a server acknowledges a cancel request but may not halt work already underway. Killing an agent process doesn't reverse what it has already done externally, and no current standard tracks obligation state across agent boundaries. - **The Evidence You Need Arrives After the Decision** — [Source]() — Published 2026-09-10 Tag: Evidence Gaps The information that would make a decision good and the moment the decision must be made are systematically misaligned. Approvals happen before execution, but post-execution state is what matters most. And compensating transactions are new workflows that can themselves fail, not simple undo buttons. ### Past Articles - [Nobody Tampered With the Agent's Instructions]() — By [Sevda Polat]() · Published 2026-09-03 · Format: Two Kinds of Influence Agent security conversations center on prompt injection: someone hides instructions in the input, the agent gets hijacked. Researchers at CHI 2026 found something running on different machinery. They sent shopping agents through ordinary commercial checkout flows and watched them notice anomalies, duplicate items, pre-checked consent boxes, and proceed anyway. No instructions were tampered with. The commercial web shaped the outcome through its normal operation. Current law has no answer for that case: when an agent completes an authorized action it was environmentally induced to take, who bears the commitment? - [Your Best Agent Is Your Most Gullible One]() — By [Sable Whitford]() · Published 2026-09-03 · Format: Agent Susceptibility in Practice TrickyArena tested six web agents against deceptive interface patterns — fake urgency, pre-checked boxes, double-negative opt-outs — and found a 41% overall susceptibility rate. The distribution underneath that average matters more: the agents best at finishing tasks were also the ones most likely to get manipulated, and the agents that looked resistant mostly just stalled before reaching the trap. Evaluate on task completion alone and you may be selecting for gullibility. - [What MCP Won't Undo for You]() — By [Sable Whitford]() · Published 2026-08-28 · Format: Protocol Walkthrough The July 2026 MCP revision removed protocol sessions and put server-minted state handles in their place: ordinary strings your model threads from one tool call to the next. The operational case for the change was solid. But sessions had made it easy to miss something, which is that MCP has never had anything to say about reversing an action once it lands. Here's a booking sequence traced through the revised spec — what the protocol standardizes, what it deliberately leaves unspecified, and which decisions were yours all along. - [The Undo Fantasy]() — By [Sable Whitford]() · Published 2026-08-28 · Format: The Reversal Frame Art conservators spent decades believing "reversible" meant safe. Then they tested it: dissolving an adhesive out of porous ceramic drove the solution deeper into the object, where it stayed permanently. Removal turned out to be a second treatment, not an opposite. Payment regulators landed in the same place from another direction — Reg E has no "undo" step, because losing money and losing access to money are separate injuries on separate clocks. When we ask whether a user can undo what an agent did, we're compressing at least four different remedies into one verb. ## Other sections in Issue 46 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()