--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/52/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/52/foundations" issue: 52 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Sable Whitford","Sevda Polat"] published: 2026-10-26 updated: 2026-10-24 articles: 28 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 52 — Foundations Conceptual clarity earned from building at scale ### Architecture Choices - [Compared With What? Checking Whether Agent Memory and Skill Libraries Earn Their Tokens]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Core Concepts Agent frameworks keep bolting on memory, self-reflection, and libraries of saved skills, and the benchmark numbers usually go up. Before you credit the add-on, ask what the plain agent was allowed to spend. When researchers gave a basic web agent a few extra steps instead, it kept pace with the enhanced versions and cost less to run. A cancer-records study found the same skill library worked about as well with the agent's planning and tool-calling stripped away. Then there are tasks spanning several sessions, where memory should finally earn its keep. ### Practical Walkthrough - [The Other Agent Got the Message. Did It Change Anything?]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Practical Walkthrough Wire AI agents together and every hand-off lands in a transcript, which people tend to read as proof the messages mattered. It's a delivery receipt. To find out whether Agent B actually used what Agent A told it, change one fact in one message and see whether B's next move shifts. One study ran that test 793 times. Depending on where the noise bar sat, 39% to 75% of tests found no message driving the decision. And for the notes agents share, saving everything did worse than saving nothing. ### Further Reading - **Ironies of Automation, Reread for AI** — [Source]() — Published 2026-10-23 Bainbridge's 1983 plant-control paper, applied to AI: machines take routine work, people get the hard cases with less practice. - **When the Job Shrinks to Watching** — [Source]() — Published 2026-10-23 Groups Bainbridge's ironies into lost skills, monitoring strain and worker attitudes, including the status lost when work becomes watching. - **How Often a Person Steps In** — [Source]() — Published 2026-10-23 A survey of deployed agents: 68% run ten steps or fewer before needing a human. It doesn't measure how hard those handoffs are. - **Finishing the Task Without Learning the Library** — [Source]() — Published 2026-10-23 In Anthropic's own trial, developers learning a library with AI scored 50% on a quiz, versus 67% without. Conceptual questioners kept more. - **What Students Kept Once the Chatbot Left** — [Source]() — Published 2026-10-23 High schoolers with open GPT-4 did better on practice, then 17% worse on exams without it. A tutor-style version mostly avoided that. - **Cutting the Referral Out of the Journey** — [Source]() — Published 2026-10-23 AI eye exams done during routine diabetes visits, with no separate specialist trip, lifted screening near 99%. Industry-supported; tracks completion only. ### Tool Convention Mismatches Fluent but unexecutable. That describes a tool call that's miserable to debug, because the transcript looks fine. The model understood the user, picked the right tool and chose a sensible value. It wrote that value in the user's language or the user's format. The API either rejects it or, worse, accepts it and does the wrong thing. Standards bodies have spent decades documenting how people write place names, personal names, dates, numbers and money. Each card covers one mismatch and where you could catch it: schema, validator, parser, intake or model. So far, researchers have measured only place-name failures in agents. The other cards draw on the standards themselves. - **Right tool, right intent, wrong language** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Tag: Anchor study Lost in Execution (ACL 2026) translated benchmark queries into Chinese, Hindi and Igbo but left every tool schema in English. Models usually understood the request and picked the right function. Then they filled the city field with 纽约市 instead of "New York City." The authors put the fix at the interface between model and tool. - **One city, several valid names, one accepted** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Tag: Place names UN naming guidance separates a place's local-script name, its official romanization and any traditional English name. For one city that gives 北京, Beijing, and the older Peking. A `location` parameter should state which form it expects. Catch this in the schema description, or normalize with a place-name lookup before the call. - **Translating arguments back can quietly change them** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Tag: Mitigation risk The paper tested three fixes: tell the model to use English, translate the query first, or translate the values afterward. All three reduced mismatches, and none reached English-level accuracy. One round trip through Chinese turned a queen-size bed into `roomType="suite with a king-size bed"`. An enum keeps values legal. Catching the swap means checking the value against what the user asked for. - **Which name comes first is a locale setting** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Tag: Name order Unicode's name-formatting data renders Hayao Miyazaki as "MIYAZAKI Hayao" when the name is Japanese, even in Latin letters, because the name's own locale sets the order. An agent that treats whatever comes first as the "first name" files it backwards. W3C advises against forcing the split. A single full-name field avoids the problem at the schema. - **The issuing state owns the passport spelling** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Tag: Passport names ICAO's passport standard requires a Latin transliteration of non-Latin names. The machine-readable strip at the bottom allows only A to Z plus the "<" filler. The issuing country's rules fix that spelling, so the model's own transliteration can look right and still fail. Catch this at intake by copying the string from the document. Don't let the model regenerate it. - **A valid date can still be the wrong day** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Tag: Date formats RFC 3339 defines how systems exchange dates: 1990-07-15. Users type Hebrew-calendar dates, non-Latin digits, or 03/04, which is March in the US and April in much of Europe. JSON Schema only rejects "07/15/1990" if format checking is switched on. Once converted, a swapped 03/04 passes either way. Validators catch malformed strings. Reading the date back to the user catches the wrong day. - **1.234 means different numbers in different places** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Tag: Number formats Unicode's locale data documents the trap. Many European locales swap the decimal point and the thousands separator. India groups digits as 12,34,56,789. The digits themselves come in Devanagari, Thai and other scripts. Type the parameter as a JSON number so the model can't send a localized string, and parse user input with their locale in hand. - **An amount needs its currency and its decimals** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Tag: Currency amounts Unicode's guidance says an amount like 3.5 should never travel without its currency code. The number of decimal places belongs to the currency, so the locale doesn't decide it. Under ISO 4217 the yen has no minor unit and the Kuwaiti dinar has three. Keep value and code together in the schema, and look up minor units instead of assuming everything has cents. ### Lessons From Other Fields Some problems agent builders face now have older relatives. A slot promised to one party gets requested by another. A model's context picks up information it shouldn't have seen. Or a chain of tool calls stops halfway and can't be cleanly unwound. Operating rooms, machine shops, banks, law firms and bridge clubs have dealt with versions of these for decades, and their fixes still work. Each fix relies on something its home field quietly supplies: a declared quantity, a named holder, a fixed moment for the check, or someone with standing to object. The cards are grouped by that dependency. The sources rarely mention agents, so the comparisons are our own reading. Each card notes where borrowing gets harder. - **Slurm backfill fills gaps without delaying earlier commitments** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Tag: Declared quantity Slurm starts a lower-priority job on idle nodes only if no higher-priority job's expected start slips. The math works because every job declares a time limit, and Slurm kills jobs that overrun it. An agent task holding a shared quota rarely states how long it needs, and cutting it off midway can leave work half-done. - **Sagas unwind long work with paired compensating steps** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Tag: Declared quantity A long transaction is broken into short steps, and each step is paired with an inverse. For example, a booking is cancelled using the ID it returned. One agent adaptation treats any tool without a declared inverse as side-effect free. Compensation repairs system state. It cannot reverse what people already did in response to the first step. - **Lockout/tagout: each worker removes only their own lock** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Tag: Named holder Under OSHA's standard, everyone servicing a machine attaches a personal, labeled lock. The machine stays de-energized until each of them has removed their own. Exceptions require procedures written in advance. Agent systems rarely let each affected party place a hold that only that party can lift. - **Chain of custody records who held evidence, why** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Tag: Named holder NIST describes custody as documenting each person who handled a piece of evidence, when it changed hands, and for what purpose. The opposing side can then test that record. The method assumes a single item passing between people. A fact in persistent agent memory gets copied and blended into later outputs, and its origin rarely comes along. - **Surgical time-out halts the team before incision** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Tag: Fixed moment The Joint Commission's protocol stops the team just before the invasive step. They confirm the patient, site and procedure against a mark made while the patient was still awake. It works best when anyone in the room feels free to speak up. Agent workflows often have no recognizable moment just before the irreversible step. - **Ethical walls screen a lawyer before access begins** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Tag: Fixed moment Model Rule 1.10 lets a firm keep a matter despite a lateral hire's conflict. The lawyer must be screened promptly and take no share of the fee, and the former client must get written notice. A screen put up after the lawyer has already had access is harder to defend. Shared agent memory rarely has per-matter boundaries that can go up in time. - **Bridge Law 16 limits play after improper hints** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Tag: Standing challenger Bridge doesn't ask players to forget a partner's improper hint. Under Law 16, a player may not choose an action the hint demonstrably suggested if a logical alternative existed. The director can also adjust the score. All of this relies on agreed meanings for "logical alternative" and "damage," which contaminated agent context rarely has. - **Maker-checker splits a transaction between independent people** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Tag: Standing challenger FDIC guidance says no one person should handle a transaction from start to finish. Whoever signs official checks shouldn't also reconcile them. The control works only if the reviewer checks the source evidence independently. A checker agent that reads the maker's own context looks like a review, but it rests on the same evidence as the maker. ### Past Articles - [What a Website Tells an Agent About Itself]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Walking Through WebMCP When an AI agent uses a website today, it reads the page much the way you would, scanning buttons, labels, and form fields to infer what it can do. A draft specification called WebMCP proposes something different: the website hands the agent a structured list of the actions it says it can perform. That solves real problems, and agents would break less often when sites redesign. But the agent then depends entirely on the site's description of itself, and sites have commercial reasons to make that description as frictionless as possible. The specification is candid about this gap. Whether builders will be is another question. - ["User Agent" Is Becoming an Accountability Claim]() — By [Sable Whitford]() · Published 2026-10-16 · Format: Core Concepts For thirty years, "user agent" meant one thing: software that fetches web pages. Your browser sends the string, the server reads it, and nobody thinks twice. Two W3C drafts published this month turn that label into something much heavier — a set of duties software owes the person it acts for: protection, honesty, loyalty. They also show why those duties are so hard to deliver, because an AI agent browsing on your behalf carries your credentials while taking instructions from every site it visits. - [Tool Descriptions Are Contracts for a Reader That Cannot Ask Questions]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Core Concepts Developers who write great API documentation often write poor tool descriptions for LLMs, and the reason is the reader. A human who hits a gap in your docs tries something, reads the error, comes back. A model fills the gap from training data and acts on it immediately. What you leave out, it invents. The instincts that make documentation generous and readable — narrative context, implicit constraints, learning by example — are the ones that get you in trouble when the reader can't ask a follow-up question. - [Read Your Tool Descriptions Like a Model Would]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Practical Walkthrough You named a parameter `query` and described it as "Search query." You know it means a natural-language place search, not SQL. The model doesn't. It gets the tool name, the description, and the input schema, and every gap you left gets filled from token probabilities instead of project context. A 2026 study rewrote descriptions across 856 MCP tools without touching code and measured real shifts in task success. Here are three broken patterns from real MCP servers, and how to find the same bugs in yours. ## Other sections in Issue 52 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()