TinyFish | Foundations

Trace Anatomy

The OTel GenAI Spec Has an Implicit Reader

By Rina Takahashi— June 25, 2026

Feature image for article: The OTel GenAI Spec Has an Implicit Reader

The OpenTelemetry GenAI semantic conventions define how to trace agent workflows: which agent ran, what tools it called, how many tokens it consumed. Read closely, the spec's attributes reveal a consistent design choice about who's looking at the data. It's a developer, diagnosing failures. The conventions are genuinely useful for that purpose. When the reader shifts to an auditor tracing authorization chains, an operator enforcing cost boundaries, or a compliance team documenting human oversight, the attributes that exist start outlining the shape of the ones that don't.

Trace Anatomy

The OTel GenAI Spec Has an Implicit Reader

By Rina Takahashi— June 25, 2026

The OpenTelemetry GenAI semantic conventions define how to trace agent workflows: which agent ran, what tools it called, how many tokens it consumed. Read closely, the spec's attributes reveal a consistent design choice about who's looking at the data. It's a developer, diagnosing failures. The conventions are genuinely useful for that purpose. When the reader shifts to an auditor tracing authorization chains, an operator enforcing cost boundaries, or a compliance team documenting human oversight, the attributes that exist start outlining the shape of the ones that don't.

Legibility Gap

Four Stories About the Same Purchase

By Nora Kaplan— June 25, 2026

Feature image for article: Four Stories About the Same Purchase

Visa's integration with OpenAI brings real payment infrastructure to AI agents: tokenized credentials, spending controls, merchant restrictions. The interesting problem starts when a purchase goes wrong. A chargeback forces every party to independently explain the same event, and an agent-initiated transaction must be legible to four audiences with incompatible evidence needs. Recording what happened is straightforward. Making it understandable to everyone who has to adjudicate demands something a comprehensive log can't provide on its own.

Legibility Gap

Four Stories About the Same Purchase

By Nora Kaplan— June 25, 2026

Visa's integration with OpenAI brings real payment infrastructure to AI agents: tokenized credentials, spending controls, merchant restrictions. The interesting problem starts when a purchase goes wrong. A chargeback forces every party to independently explain the same event, and an agent-initiated transaction must be legible to four audiences with incompatible evidence needs. Recording what happened is straightforward. Making it understandable to everyone who has to adjudicate demands something a comprehensive log can't provide on its own.

Evidence From Every Angle

OWASP Top 10 for Agentic Applications 2026

Agent risk scales with authority and side effects, not just model vulnerability.

EU AI Act: Regulatory Framework for Artificial Intelligence

High-risk AI systems must log actions, document decisions, and guarantee human oversight.

NIST SP 800-63B: Digital Identity Guidelines for Authentication

OWASP Non-Human Identities Top 10

MCP 2025-06-18 Authorization Specification

Evidence From Every Angle

OWASP Top 10 for Agentic Applications 2026Agent risk scales with authority and side effects, not just model vulnerability.

EU AI Act: Regulatory Framework for Artificial IntelligenceHigh-risk AI systems must log actions, document decisions, and guarantee human oversight.

Quick links

NIST SP 800-63B: Digital Identity Guidelines for Authentication

OWASP Non-Human Identities Top 10

MCP 2025-06-18 Authorization Specification

The Audiences

A single agent action generates questions for six different audiences. The user wants confirmation their intent was honored. The developer wants to know what broke. The service on the receiving end wants to know if the session is even legitimate. And the auditor, regulator, and merchant each need evidence the others never thought to produce.

The pattern underneath all six is worth sitting with. The records that current agent systems generate were designed for developers and quietly repurposed for everyone else. A debugging trace does not become an accountability record just because someone hands it to an auditor. A polished summary does not become oversight just because the user reads it. Each stakeholder looks at the same action through a different lens, and most of them find the page blank.

The Audiences

A single agent action generates questions for six different audiences. The user wants confirmation their intent was honored. The developer wants to know what broke. The service on the receiving end wants to know if the session is even legitimate. And the auditor, regulator, and merchant each need evidence the others never thought to produce.

The pattern underneath all six is worth sitting with. The records that current agent systems generate were designed for developers and quietly repurposed for everyone else. A debugging trace does not become an accountability record just because someone hands it to an auditor. A polished summary does not become oversight just because the user reads it. Each stakeholder looks at the same action through a different lens, and most of them find the page blank.

User Oversight

Users Deserve More Than the Agent's Own Story

The person who delegated the task needs to confirm their intent was followed, constraints held, and the outcome actually matches what they asked for. Instead, they get the agent's self-reported summary. Step-by-step visibility, constraint status at each decision point, and a binding link between what was approved and what was executed? Almost never there.

Developer Tooling

Developers Are Best Served, but Gaps Remain

Developers have the richest tooling today. OpenTelemetry's GenAI conventions cover model calls, tool invocations, latency, and errors. Still, production reveals blind spots: replay capability, final-state verification against the systems the agent actually touched, cost attribution at workflow granularity, and records that tie approvals to specific executions.

Relying Party

Service Providers Can't Tell Who Sent the Request

When a service receives a request from an agent, the fundamental question is simple: is this session legitimately delegated, and should we treat it as authorized? No standard mechanism lets a browser-based agent declare its identity or delegation chain in a way the receiving service can verify. Most anti-abuse systems just flag automation as suspicious.

Audit Evidence

Auditors Keep Getting Logs Built for Debugging

Auditors need reproducible evidence: who authorized what, whether policies were followed, and whether final states are correct across every system the agent touched. What they actually receive are engineering traces built to diagnose failures. Separation of principals, constraint records at action boundaries, delegation-chain evidence? These are rarely captured in any structured form.

Regulatory Readiness

Regulators Need Records That Don't Exist Yet

Regulators want documentation of oversight mechanisms, risk controls, incident definitions, and operating boundaries. Reasonable asks. But current agent systems produce neither regulator-legible records nor governance artifacts. Proving interruptibility, demonstrating human oversight design, reporting incident rates against exposure denominators: these require records most deployments never generate in the first place.

Commerce Evidence

Payment Rails Are Ahead of Every Other Channel

Commerce counterparties need transaction-level proof of consumer intent, spending limits, and agent identity for fraud scoring and dispute resolution. Visa and Mastercard are building agent-recognition rails, which puts them ahead of the curve. Generic web automation for procurement, benefits enrollment, and vendor management has nothing comparable for binding a mandate to a transaction.

Evidence Standards

When an agent acts on someone's behalf, "it worked" is the beginning of the conversation, not the end. The action needs to be provable. Not just to the user who triggered it, but to the merchant who processed it, the compliance team that reviews it next quarter, the regulator who shows up with questions.

That proof fragments into distinct evidence types, each answering a different question with its own characteristic failure mode. Who authorized this? Through what chain? Under what rules? Did the other system actually land in the right state? Where did the data come from? And can the record itself be trusted after the fact?

These six categories are a way of seeing where gaps hide before a dispute or an incident forces the question into the open.

Evidence Standards

When an agent acts on someone's behalf, "it worked" is the beginning of the conversation, not the end. The action needs to be provable. Not just to the user who triggered it, but to the merchant who processed it, the compliance team that reviews it next quarter, the regulator who shows up with questions.

That proof fragments into distinct evidence types, each answering a different question with its own characteristic failure mode. Who authorized this? Through what chain? Under what rules? Did the other system actually land in the right state? Where did the data come from? And can the record itself be trusted after the fact?

These six categories are a way of seeing where gaps hide before a dispute or an incident forces the question into the open.

Intent Proof

A Login Is Not a Mandate to Act

Session cookies prove someone authenticated. They say nothing about whether that person wanted this particular agent to book this particular flight at this particular price. Sufficient intent proof ties approval to the specific execution target, page state, and consequences. Approving a plan and authorizing what actually happened are different things entirely.

Authorization Chain

Seven Links Between a User and a Receipt

Robust delegation keeps seven elements distinct: human requester, agent identity, runtime identity, tool authorization, resource audience, approval binding, and audit record. Collapse any one of them and disputes become a fog. Token audience validation matters here because without it, credentials drift silently across service boundaries.

Policy Compliance

Rules in Someone's Head Produce Zero Evidence

If spending limits and vendor restrictions live only in policy documents nobody reads, agents can't demonstrate they stayed within bounds. Compliance that holds up requires versioned, machine-readable rules referenced in the execution trace, with per-action assertions computed before the action runs. Not claimed after.

Final State

The Agent Said It Worked. Did It?