--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/49/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/49/foundations" issue: 49 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Sable Whitford","Sevda Polat"] published: 2026-10-05 updated: 2026-10-01 articles: 24 --- # TinyFish > A journal for living in the agentic age [Read on the website]() ## Issue 49 — Foundations Conceptual clarity earned from building at scale ### Policy as Craft - [The Document Nobody Wants to Write]() — By [Sable Whitford]() · Published 2026-10-01 · Format: Policy as Craft Agent security policy has to do three things at once: be precise enough for a machine to enforce on every request, loose enough that the agent can still finish its task, and clear enough that a human can reconstruct what was allowed after something goes wrong. Most of the conversation about agent security is about the enforcement runtime — sandboxes, isolation boundaries, network proxies. But the runtime does what the policy tells it to do. The consequential decisions live in the document, and writing that document is a kind of technical writing we don't have practice for yet. ### Policy in Practice - [How OpenShell's Policy System Turns Denials Into Evidence]() — By [Sable Whitford]() · Published 2026-10-01 · Format: Policy in Practice Every time something inside an OpenShell sandbox runs into a boundary — a denied outbound request, a blocked path, a credential that won't resolve — the system writes it down. This walkthrough follows those records through the four independent policy domains, the Policy Advisor path that lets an agent propose its own permission expansions with a risk assessment attached, and what happens to live connections when the rules change underneath a running agent. Then the part people skip: where the records go. ### Further Reading - **The NCSC's Seven Considerations for Agentic AI: Maturity Models, Sandbox Design, and the Pull-the-Plug Problem** — [Source]() — Published 2026-10-01 The UK's cyber authority lays out an operational security framework for agent deployments, with real specificity. - **If You Cannot Contain It, Do Not Deploy It: The NCSC's Joint Guidance on Agentic AI Adoption** — [Source]() — Published 2026-10-01 Six-nation guidance on least privilege, temporary credentials, and human accountability for autonomous agents. - **Reading the NCSC Guidelines as an Enterprise Practitioner** — [Source]() — Published 2026-10-01 A third-party walkthrough of what the NCSC's agentic AI guidance actually asks of enterprise teams. ### Policy Dimensions A sandbox that only controls one surface — say, network access — leaves every other surface wide open. Filesystem traversal, credential leakage, privilege escalation, unauthorized model routing: each is a distinct failure mode that requires distinct enforcement and has distinct blind spots. NVIDIA's OpenShell, open-sourced in late September 2026, publishes a five-dimension policy architecture that makes these boundaries explicit. The interesting details are operational: which controls are locked at startup versus reloadable live, where credentials actually live relative to the agent process, and what happens when an agent hits a wall. The gaps between dimensions matter as much as the dimensions themselves. - **Path Restrictions Lock at Startup and Stay Locked** — [Source]() — By [Sable Whitford]() — Published 2026-10-01 Tag: Filesystem Controls OpenShell uses Linux Landlock to restrict which paths an agent can read or write. Rules apply at sandbox startup and are immutable after that. If someone later mounts sensitive data into an allowed path, Landlock has no opinion — the rules were already set. - **Default-Deny Proxy Inspects Every Outbound Request** — [Source]() — By [Sable Whitford]() — Published 2026-10-01 Tag: Network Controls All outbound traffic routes through a proxy that checks destination, port, calling binary, and optional HTTP-level rules. Cloud metadata endpoints are unconditionally blocked. Unmatched requests get denied. Unlike filesystem policy, network rules can be hot-reloaded without restarting the sandbox. - **Agents Run Unprivileged With Stripped Linux Capabilities** — [Source]() — By [Sable Whitford]() — Published 2026-10-01 Tag: Process Controls The supervisor starts agents as unprivileged users with reduced capability sets, blocking privilege escalation and privileged child processes. The UK NCSC points out that kernel-level process isolation still carries residual breakout risk — higher-risk workloads may need VM or hardware boundaries. - **Raw Secrets Never Enter the Agent Process** — [Source]() — By [Sable Whitford]() — Published 2026-10-01 Tag: Credential Controls The proxy injects credentials into outbound requests so the agent never sees raw secrets. When a policy change would expand authenticated reach to new endpoints, a formal prover flags it and routes the proposal to a human review queue before anything activates. - **Model Endpoints Live Outside Normal Network Policy** — [Source]() — By [Sable Whitford]() — Published 2026-10-01 Tag: Provider Access Inference provider access is configured at the gateway level, architecturally separate from the network rules the sandbox enforces. This prevents agents from treating model endpoints as ordinary destinations subject to agent-authored policy proposals or sandbox-scoped overrides. - **Denied Requests Become Proposals Awaiting Human Approval** — [Source]() — By [Sable Whitford]() — Published 2026-10-01 Tag: Policy Expansion When an agent hits a denial, the system drafts a rule expansion and a Z3-based prover computes the security delta against current policy. Every proposal lands in a pending queue for human approval by default. Least privilege becomes an ongoing negotiation rather than a one-time configuration. - **Technical Permission Does Not Equal Business Authorization** — [Source]() — By [Sable Whitford]() — Published 2026-10-01 Tag: Shared Limits Across all five dimensions, a consistent boundary holds: these controls govern what an agent can do computationally, not whether the action is authorized by the people it affects. And stopping an action in progress does nothing about effects already produced downstream. ### Policy Failure Modes Agent policy fails in three directions, each with its own causal structure and observable signature. Restrict too aggressively and the agent cannot do its job. Operators discover this when legitimate workflows stall, and they respond the way people always respond to controls that block real work: they route around them. Grant too much scope and the agent completes tasks through actions that violate the policies you thought governed it. Get the balance right at deployment and watch it drift as the environment changes beneath rules that were never designed to adapt. These failure modes interact. Tightening to prevent overreach blocks legitimate work. Loosening to restore utility widens the surface for unintended action. Leaving policy fixed lets it go stale while the system it governs keeps evolving. - **Enforcement Rules Block Three in Ten Legitimate Actions** — [Source]() — By [Sevda Polat]() — Published 2026-10-01 Tag: Over-Restriction AgentSpec, evaluated at ICSE 2026, auto-generated enforcement rules that correctly identified 95.56% of violations but caught only 70.96% of legitimate action variations. Roughly three in ten valid operations got flagged as policy breaches. The rules worked well at catching bad actions and poorly at recognizing good ones. - **Broad Rules Produced Nearly All the False Positives** — [Source]() — By [Sevda Polat]() — Published 2026-10-01 Tag: Rule Design In ActPlane's OS-level enforcement evaluation, overly broad rules caused 17 of 18 false positives. The tradeoff is structural: write narrow rules and you miss boundary violations; write broad rules and you match compliant actions. Both directions produce failures, with different signatures and different costs. - **Skip Observation and Controls Get Circumvented in Practice** — [Source]() — By [Sevda Polat]() — Published 2026-10-01 Tag: Operational Friction Security practitioners report that organizations deploying enforcement without first running shadow-mode observation discover high false-positive rates only after legitimate workflows stall. What follows is predictable: manual override queues grow, exception lists expand, and controls that exist on paper get routinely bypassed by the people they govern. - **Agents Reach Operations Their Designers Never Anticipated** — [Source]() — By [Sevda Polat]() — Published 2026-10-01 Tag: Excess Agency OWASP's 2026 agentic security guidance identifies excessive agency as a core risk. Least privilege is the standard prescription, but agents make "least" difficult to define. A fixed program with broad permissions reaches only its coded operations. An agent with the same permissions may reach operations no one considered granting. - **Users Approve the Overreach Their Policies Forbid** — [Source]() — By [Sevda Polat]() — Published 2026-10-01 Tag: Approval Failure A 2026 study found user-authored permission policies blocked overreach 20.1 percentage points less effectively than human-in-the-loop controls. Of the overreach actions that got through under the policy condition, 89.9% had received explicit human approval at runtime. People wrote rules against specific behaviors, then approved those same behaviors when asked. - **Four in Five Agent Failures Start at Specification** — [Source]() — By [Sevda Polat]() — Published 2026-10-01 Tag: Specification Gap The MAST taxonomy, built from 1,642 execution traces across seven agent frameworks, found that specification and coordination problems — task misinterpretation, ambiguous roles, missing termination conditions — account for roughly 79% of multi-agent failures. The infrastructure and model layers, where most attention goes, are the minority of the problem. - **Controls Must Change as Agent Autonomy Levels Shift** — [Source]() — By [Sevda Polat]() — Published 2026-10-01 Tag: Policy Evolution The UK's NCSC August 2026 guidance states that controls "should be applied proportionately based on the level of autonomy" and that organizations must "continue to review their controls and assumptions" as capabilities evolve. Proportionality is a moving target. A policy calibrated for today's agent capabilities may be wrong for next quarter's. - **Static Rules Cannot Judge a Changing Authorization Environment** — [Source]() — By [Sevda Polat]() — Published 2026-10-01 Tag: Runtime Context Runtime enforcement evaluates actions against who is acting, where, and within which workflow — context that static rules cannot encode. An identical action can be legitimate in one workflow and a violation in another. Policy that evaluates actions without their surrounding context produces false verdicts in both directions. ### Past Articles - [What Gets Lost When a Paper Becomes Callable]() — By [Sevda Polat]() · Published 2026-09-24 · Format: Callable Knowledge A research paper carries its findings, and it also carries the conditions under which those findings can be challenged: methods, assumptions, stated limitations. Paper2Agent, published in *Nature* this month, turns papers into callable servers you can point at your own data to run a paper's methods on it. The system keeps more than you might expect. But when findings move out of a container built for scrutiny and into one built for invocation, certain things get harder to see: version history, the seam between sourced results and the agent's own inference, and the surface a second party would push against. - [What a Paper Becomes When You Make It Callable]() — By [Sevda Polat]() · Published 2026-09-24 · Format: Paper to Server Paper2Agent, published in *Nature* this month, takes an academic paper together with its code repository and turns them into an MCP server whose methods you can call on new inputs. The conversion requires sorting the paper's contents into MCP's categories: tools, resources, prompts. A hard-coded threshold becomes a typed parameter. A workflow described in prose becomes a prompt template. The protocol forces a decision about what each piece of a method actually *is*, and those decisions show which parts of a paper sort cleanly into executable form and which resist it. - [The Score Is Not the Agent]() — By [Sable Whitford]() · Published 2026-09-17 · Format: Evaluation Thesis Six models, a hundred enterprise problems, one evaluation harness — and the top-ranked agent changed depending on whether it faced scripted opponents or other agents. The rank correlation between the two conditions was 0.182, barely better than ranking them by coin flip. Three recent studies converge on the same finding: an agent's benchmark score is not a property of the agent. It's a property of the agent and everything around it while the test ran. That distinction changes what any benchmark result can tell you. - [The Agent Clicked Save. Check the Database Anyway.]() — By [Sable Whitford]() · Published 2026-09-17 · Format: Postcondition Walkthrough An agent navigates to the right page, types into the right-looking field, clicks save, and gets a confirmation. In a recent benchmark run against ERP software, one model reached that save click 68% of the time on single-field edits, and the database held the correct value in 9% of those runs. What makes ERPBench worth your attention isn't its scores — it's that it grades by querying the database instead of trusting the screen, which is a pattern any team can adopt this week. ## Other sections in Issue 49 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()