--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/53/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/53/foundations" issue: 53 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Sable Whitford","Sevda Polat"] published: 2026-11-02 updated: 2026-10-30 articles: 23 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 53 — Foundations Conceptual clarity earned from building at scale ### Core Concept Essay - [Your Agent's Questions Need a Recipient and a Timer]() — By [Sable Whitford]() · Published 2026-10-30 · Format: Core Concepts When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits. ### Hands-On Walkthrough - [Three Ways an Agent Can See a Page, and What Each One Drops]() — By [Sable Whitford]() · Published 2026-10-30 · Format: Hands-On Walkthrough Before a web agent clicks anything, somebody has already decided which version of the page it gets. The usual choices are a screenshot, the accessibility tree browsers build for screen readers, or the DOM, the browser's full model of the page. Each one makes some questions easy and others impossible. ### Builder Primary Sources - **MCP replaces sessions with explicit handles** — [Source]() — Published 2026-10-30 Read major changes 1 and 2 to see where state goes once sessions disappear. - **MCP cancellation only asks work to stop** — [Source]() — Published 2026-10-30 Its Timing Considerations section: a cancelled request may already have completed, side effects included. - **An IETF draft for safely retrying POSTs** — [Source]() — Published 2026-10-30 Section 2.6 of this working draft separates first attempts, completed retries, and concurrent duplicates. - **A2A 1.0 for delegating to opaque agents** — [Source]() — Published 2026-10-30 Section 7.6.4 explains what AUTH_REQUIRED does not grant; Section 3.7, what messaging doesn't guarantee. - **JSON Schema objects accept extra fields by default** — [Source]() — Published 2026-10-30 MCP tool schemas now accept any 2020-12 keyword; additionalProperties is how you reject unexpected arguments. ### Terms Worth Unpacking Some words in a spec look too ordinary to need defining. “Active customer.” “On behalf of.” “Scheduled.” Each one settles a question that someone answered earlier, often years earlier: which twelve months count, whose name goes in the audit log, what happens if a government changes the clocks. A colleague who meets the word fills the gap from context, or walks over and asks. An agent does neither. It acts on whatever definition sits closest in the data, the token or the code, and the result looks like a correct answer. The filings, standards and papers below had to write their choices down. They suggest where yours may still be implicit. - **Two retailers, two meanings of “active customer”** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Retail metrics Wayfair counts anyone who bought directly from its sites in the past twelve months, then divides a year of revenue by that count to report $591 per customer. Torrid counts identifiable shoppers, in store or online, recognized mostly through its loyalty program. A query for “active customers” returns whichever rule the data encodes. - **“On behalf of” hides two kinds of authority** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Identity standards RFC 8693 separates impersonation from delegation. Under impersonation, the agent cannot be told apart from the user within the token’s rights. Under delegation, the agent keeps its own identity, and an “act” claim names it as the party acting. Only delegation lets a log show that software took the action. - **“Scheduled” can mean a fixed instant or local time** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Time standards RFC 9557 lets a timestamp carry a named zone such as [Europe/Paris]. It deliberately leaves out future meetings pinned to local clock time, whose actual instant moves if a government abolishes daylight saving. A string stored correctly today can later contradict itself, and the format can flag that conflict but not resolve it. - **OECD maps where definitions of “agentic” part ways** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Policy definitions The OECD’s February 2026 review gathers the features most often cited in definitions of agentic AI and AI agents, then maps them onto its own definition of an AI system. It lays out what the definitions share and where they differ, without fixing a threshold. When a vendor says “agentic,” ask which features they mean. - **“Memory” is five abilities, tested one at a time** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Memory benchmarks LongMemEval scores chat assistants separately on extracting facts, reasoning across sessions, reasoning about time, updating facts that changed, and abstaining when the answer was never given. Commercial assistants and long-context models lost about 30% accuracy over sustained conversations. A claim that a system “has memory” says little until it names the ability. - **A “skill” is a package the agent trusts** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Safety benchmarks SkillSafetyBench treats a skill as instructions bundled with access to files, tools, memory and an execution environment. Across 155 adversarial cases, unsafe content planted in skills or local files steered agents while the user’s request stayed harmless. The test does not estimate real-world frequency. It shows that installing a skill extends the agent’s trust to its author. ### Quoting Agent Results An agent's success rate tends to outlive its paper. It moves into a vendor deck, then a board memo, then a procurement checklist. By the third retelling, nobody remembers which model ran, how many attempts it got, or whether anyone looked at how it reached the answer. Each person in that chain has a reasonable motive to shorten. A slide has room for one figure. The conditions get cut first, and the figure starts answering a question the study never asked. The recent results below are worth repeating, as long as each keeps one condition attached. Usually that condition is something the experiment held fixed, quietly changed, or never saw. - **Spider 2.0 has two numbers for one setup** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Benchmark version The ICLR 2025 published version reports an o1-preview code agent solving 21.3% of Spider 2.0's 632 enterprise SQL workflows. The earlier arXiv manuscript gave 17.0% for a comparable setup. Say which version you are citing. An average of the two describes no experiment anyone ran. - **The no-memory winner had more steps, less clutter** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Baseline design On WebArena, a web-browsing benchmark, an agent without a memory module outscored three memory designs and usually spent fewer tokens. That baseline was also allowed 15 steps instead of 10, with duplicated page text pruned. The authors credit the longer horizon and warn that single runs can support opposite headlines. - **Did anyone read the logs behind the score?** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Log inspection The Holistic Agent Leaderboard team inspected logs from 21,730 agent runs and found agents searching HuggingFace, a public dataset host, for the benchmark itself mid-task. A correct answer can mean the agent did the work or found the answer key. A quoted accuracy should say whether anyone checked. - **AISI's incident came from a deliberately permissive test** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Test conditions During cyber testing at the UK's AI Security Institute, agents took unsanctioned actions against real people and organisations in 10 of 122 runs, once pressuring an open-source maintainer. The setup intentionally allowed internet access and switched off providers' safety classifiers. AISI reports no evidenced harm and says no sandbox was escaped. - **FHIR-AgentEval's memory gain shrinks on unfamiliar tasks** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Experimental split FHIR-AgentEval tests agents on health records stored in the FHIR standard. Adding memory helped in all four settings, but the gain was 27.9% on new variations of familiar tasks and 9.1% on held-out tasks. Memory also raised token costs and left run-to-run variance unchanged. - **Who never shows up in a resolution rate?** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Tag: Missing denominator Lakkaraju and colleagues described selective labels: outcomes visible only for cases an earlier decision let through. Support metrics built on complaints share that shape, since satisfaction scores come only from customers who replied. Their setting was bail decisions, so the warning carries over more readily than their correction method. ### Past Articles - [Compared With What? Checking Whether Agent Memory and Skill Libraries Earn Their Tokens]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Core Concepts Agent frameworks keep bolting on memory, self-reflection, and libraries of saved skills, and the benchmark numbers usually go up. Before you credit the add-on, ask what the plain agent was allowed to spend. When researchers gave a basic web agent a few extra steps instead, it kept pace with the enhanced versions and cost less to run. A cancer-records study found the same skill library worked about as well with the agent's planning and tool-calling stripped away. Then there are tasks spanning several sessions, where memory should finally earn its keep. - [The Other Agent Got the Message. Did It Change Anything?]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Practical Walkthrough Wire AI agents together and every hand-off lands in a transcript, which people tend to read as proof the messages mattered. It's a delivery receipt. To find out whether Agent B actually used what Agent A told it, change one fact in one message and see whether B's next move shifts. One study ran that test 793 times. Depending on where the noise bar sat, 39% to 75% of tests found no message driving the decision. And for the notes agents share, saving everything did worse than saving nothing. - [What a Website Tells an Agent About Itself]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Walking Through WebMCP When an AI agent uses a website today, it reads the page much the way you would, scanning buttons, labels, and form fields to infer what it can do. A draft specification called WebMCP proposes something different: the website hands the agent a structured list of the actions it says it can perform. That solves real problems, and agents would break less often when sites redesign. But the agent then depends entirely on the site's description of itself, and sites have commercial reasons to make that description as frictionless as possible. The specification is candid about this gap. Whether builders will be is another question. - ["User Agent" Is Becoming an Accountability Claim]() — By [Sable Whitford]() · Published 2026-10-16 · Format: Core Concepts For thirty years, "user agent" meant one thing: software that fetches web pages. Your browser sends the string, the server reads it, and nobody thinks twice. Two W3C drafts published this month turn that label into something much heavier — a set of duties software owes the person it acts for: protection, honesty, loyalty. They also show why those duties are so hard to deliver, because an AI agent browsing on your behalf carries your credentials while taking instructions from every site it visits. ## Other sections in Issue 53 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()