--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/51/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/51/foundations" issue: 51 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Sable Whitford","Sevda Polat"] published: 2026-10-19 updated: 2026-10-16 articles: 23 --- # TinyFish > A journal for living in the agentic age [Read on the website]() ## Issue 51 — Foundations Conceptual clarity earned from building at scale ### User Agent as Accountability Concept - ["User Agent" Is Becoming an Accountability Claim]() — By [Sable Whitford]() · Published 2026-10-16 · Format: Core Concepts For thirty years, "user agent" meant one thing: software that fetches web pages. Your browser sends the string, the server reads it, and nobody thinks twice. Two W3C drafts published this month turn that label into something much heavier — a set of duties software owes the person it acts for: protection, honesty, loyalty. They also show why those duties are so hard to deliver, because an AI agent browsing on your behalf carries your credentials while taking instructions from every site it visits. ### Walking Through WebMCP - [What a Website Tells an Agent About Itself]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Walking Through WebMCP When an AI agent uses a website today, it reads the page much the way you would, scanning buttons, labels, and form fields to infer what it can do. A draft specification called WebMCP proposes something different: the website hands the agent a structured list of the actions it says it can perform. That solves real problems, and agents would break less often when sites redesign. But the agent then depends entirely on the site's description of itself, and sites have commercial reasons to make that description as frictionless as possible. The specification is candid about this gap. Whether builders will be is another question. ### Measuring, Testing, and Governing Agents - **UK AISI Incident Report: Agents Took 19 Unsanctioned Actions Against Real People During Cyber Testing** — [Source]() — Published 2026-10-16 Government evaluators now treat internet access as a containment problem after agents socially engineered real maintainers unprompted. - **AISI Finds Agent Capability Is a Curve Over Compute, Not a Fixed Score** — [Source]() — Published 2026-10-16 About 8% of cyber tasks were solved only at budgets above 10 million tokens. Benchmark results depend on how much compute you allow. - **Human Audit of WebArena-Lite Finds Automatic Evaluators Miss 5-8 Points of Actual Agent Success** — [Source]() — Published 2026-10-16 Reviewing 165 benchmark tasks reveals a measurement gap: evaluators systematically undercount what agents actually accomplish. - **FSB Finalizes Practices for AI Adoption in Finance: Materiality, Oversight, and Third-Party Dependency** — [Source]() — Published 2026-10-16 Nonbinding but widely watched: the Financial Stability Board's final framework organizes governance around five areas for financial institutions. - **UK ICO Opens Call for Evidence on Agentic AI and Data Protection** — [Source]() — Published 2026-10-16 The privacy regulator asks how existing law applies to agents. Responses close November 20 and will shape statutory guidance. - **EU AI Act Service Desk Clarifies: "AI Agent" Has No Separate Legal Definition** — [Source]() — Published 2026-10-16 Agents fall under existing AI system and general-purpose model rules. Transparency obligations have applied since August 2, 2026. ### Agent Identity and Delegation Agents need identities. On this much, the standards community has reached something close to agreement. But identity for autonomous software turns out to be at least four separate problems: establishing who an agent is, tracing whose authority it carries, verifying what it has demonstrated it can do, and deciding what it may do right now. Current proposals each address a different layer, and they don't yet fit together. The general direction is clear: extend existing identity infrastructure rather than start over. The specific mechanisms remain unsettled. And every proposal requires accountability metadata that introduces a problem none has resolved: the same cryptographic trail that makes an agent's actions auditable makes the human behind it trackable across services. - **Six Hundred Comments Say Extend What Already Works** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tag: Standards Consensus NIST's agentic identity concept paper drew over 600 responses. Most favored building on existing frameworks like OAuth and verifiable credentials rather than inventing new infrastructure. But respondents agreed on little else: no consensus emerged on specific mechanisms, trust models, or whether to centralize or decentralize. - **Persistent Anchors and Disposable Credentials Serve Different Purposes** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tag: Trust Architecture Commenters drew a line between long-lived trust anchors, tied to hardware or organizational keys, and short-lived credentials scoped to a single task. The anchor answers "who is this agent?" and persists across sessions. The credential answers "what may it do right now?" and expires when the task does. - **A New Draft Separates Proof of Capability From Permission** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tag: Capability Certification An experimental IETF draft proposes signed credentials attesting that a specific agent configuration passed defined evaluations. The credential says "this agent demonstrated it can do X." It does not say "this agent is allowed to do X." Authorization systems may require certification as evidence, but the credential itself grants nothing. - **Each Handoff in a Delegation Chain Narrows Permissions** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tag: Delegation Scope NIST commenters converged on scope attenuation: when one agent delegates to another, the second agent should hold fewer permissions than the first. The worry is privilege accumulation, where agents passing tasks along a chain quietly aggregate authorizations that no single step intended to grant. - **Accountability Metadata Creates a Surveillance Problem Too** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tag: Privacy Tradeoff The cryptographic tracing that makes agent actions auditable also makes human users trackable across services. Commenters flagged that sensitive data concentrates in transaction logs. And consent mechanisms designed for human-speed decisions break down when agents generate authorization requests faster than anyone can meaningfully review them. ### Browser-Agent Security and Privacy The web's security model works because browsers enforce boundaries in code. A page from one domain cannot read data belonging to another. Credentials stay scoped to their sessions. Private browsing partitions state. These properties hold because software enforces them mechanically, regardless of what any page requests. Browser agents change the enforcement layer. When an AI model mediates between the user and the web, boundaries that code once guaranteed start depending on whether the model chooses to respect them. Over the past year, university researchers, the W3C Technical Architecture Group, and independent auditors have begun mapping where those boundaries still hold and where they have already given way. - **Researchers Stole Data Across Origins in Browser Agent** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tag: Cross-Origin Attack University of Washington researchers carried out a full cross-origin data-theft attack against one agentic browser. Several others gave agents enough cross-origin access that the same attack would succeed if prompt injection worked. Tests ran on specific browser versions from early 2026; all seven vendors were notified. - **Cross-Origin Safety Now Depends on Model Discretion** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tag: Security Architecture A W3C TAG draft identifies a fundamental architectural problem: in agentic browsers, cross-origin isolation depends on whether the model declines to carry data between sites, rather than on code-enforced boundaries. A property that browsers once guaranteed mechanically now rests on probabilistic inference. - **Agents Carry Credentials and Payment Info Across Sites** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tag: Ambient Authority The TAG draft describes browser agents as confused deputies: they carry the user's credentials, payment information, and browsing history across sites while accepting instructions from untrusted page content and tool descriptions. The standard defense — separating instructions from data — is something language models cannot architecturally provide. - **Audit Found Thirty Privacy Flaws Across Eight Agents** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tag: Privacy Audit A December 2025 preprint evaluated eight browser agents across fifteen privacy measurements and identified thirty vulnerabilities, including disabled privacy protections and agents autocompleting sensitive personal data into web forms. Findings were disclosed to providers. The study has not yet undergone peer review. - **Agent Memory May Persist After Private Sessions End** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tag: Private Browsing The TAG draft raises two unresolved questions: whether agent memory persists after a private browsing session ends, and whether anything mechanically prevents an agent in a private tab from accessing the main profile's history. The WebMCP community draft acknowledges the risk but defers the solution to browser vendors. - **Tool Descriptions Let Sites Steer Agent Decisions Directly** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tag: Tool Poisoning The WebMCP community draft documents how natural-language tool descriptions authored by sites can shape agent reasoning before any tool runs. A related vector: sites design input schemas with fields like age, location, and purchase history that agents populate from user context without explicit consent. ### Past Articles - [Tool Descriptions Are Contracts for a Reader That Cannot Ask Questions]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Core Concepts Developers who write great API documentation often write poor tool descriptions for LLMs, and the reason is the reader. A human who hits a gap in your docs tries something, reads the error, comes back. A model fills the gap from training data and acts on it immediately. What you leave out, it invents. The instincts that make documentation generous and readable — narrative context, implicit constraints, learning by example — are the ones that get you in trouble when the reader can't ask a follow-up question. - [Read Your Tool Descriptions Like a Model Would]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Practical Walkthrough You named a parameter `query` and described it as "Search query." You know it means a natural-language place search, not SQL. The model doesn't. It gets the tool name, the description, and the input schema, and every gap you left gets filled from token probabilities instead of project context. A 2026 study rewrote descriptions across 856 MCP tools without touching code and measured real shifts in task success. Here are three broken patterns from real MCP servers, and how to find the same bugs in yours. - [How OpenShell's Policy System Turns Denials Into Evidence]() — By [Sable Whitford]() · Published 2026-10-01 · Format: Policy in Practice Every time something inside an OpenShell sandbox runs into a boundary — a denied outbound request, a blocked path, a credential that won't resolve — the system writes it down. This walkthrough follows those records through the four independent policy domains, the Policy Advisor path that lets an agent propose its own permission expansions with a risk assessment attached, and what happens to live connections when the rules change underneath a running agent. Then the part people skip: where the records go. - [The Document Nobody Wants to Write]() — By [Sable Whitford]() · Published 2026-10-01 · Format: Policy as Craft Agent security policy has to do three things at once: be precise enough for a machine to enforce on every request, loose enough that the agent can still finish its task, and clear enough that a human can reconstruct what was allowed after something goes wrong. Most of the conversation about agent security is about the enforcement runtime — sandboxes, isolation boundaries, network proxies. But the runtime does what the policy tells it to do. The consequential decisions live in the document, and writing that document is a kind of technical writing we don't have practice for yet. ## Other sections in Issue 51 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()