Harness Engineering Fundamentals

I keep writing about harnesses for people who already build them. This one is for people who don’t yet. If you’re new to agents, or you’ve shipped one and it scares you a little, start here. No prior posts required.

Most of the attention in AI goes to the model. Which model, how big, how smart. That’s the part you didn’t build and can’t really change.

The part you do build is the harness. It’s everything you wrap around the model to make it work in the real world: the environment and context you feed it, the tools you hand it, the memory it keeps between tasks, the feedback loops that let it fix its own mistakes, and the guardrails that decide what it’s allowed to do. The model is the engine. The harness is the road, the fuel, the steering, and the brakes. When an agent does something you didn’t want, it’s almost never the engine’s fault. It’s that nobody built the brakes.

That full list is a big topic, and it’s the reason changing the harness — not the model — is often what makes an agent suddenly reliable. This post is the fundamentals of one part of it: the brakes. The part that decides what the agent is allowed to do and stops a bad move before it happens. Get this part wrong and nothing else you build matters. Three ideas, in order.

1. A harness wraps one small line

Strip an agent down to its core and you find a single step: it takes what it knows, and it produces a response.

response = model_fn(context)

That’s the model doing its job. One line. Everything smart the agent does starts there.

The problem is what sits right next to that line. The model’s response often turns into an action — it runs a command, edits a file, sends a message. And by default there is nothing between the response and the action. The agent thinks, and the thing happens. Same instant.

Your job is to build the space between them. That’s the harness.

2. The dangerous spot is where thinking becomes doing

Here’s the moment that taught me this.

I left an agent running on its own. Partway through a task it decided the cleanest fix was to delete a folder and start fresh. Reasonable plan. It ran the delete. The folder held another agent’s unsaved work, and it was gone.

Nothing stopped it. Not because I turned off a safety check, but because there was no place for one to sit. The decision and the deletion were the same step.

I call that spot the seam: the point where the agent’s intent turns into a real action. A seam is any place the agent reaches out and changes something — a model call, a tool call, a commit, a file write, a deploy.

The whole trick of a harness is simple to say: find your seams, and put a decision at each one before the action runs.

Once you see agents this way, the work stops being vague. You’re not “making the AI safe” in the abstract. You’re finding a short list of specific spots and putting a check at each one.

3. The four things you attach at a seam

At every seam, you attach the same four things. Learn these four and you have the fundamentals. Everything fancier is a variation on them.

Verdict — decide, don’t guess. At the seam, the check returns a clear answer: allow it, allow it with a warning, deny it, ask a human, or clean it up first. The one rule that matters: if the check itself fails or you’re not sure, the answer is no. A safety check that opens the door when it’s confused isn’t a safety check.

Grounding — show your source. When the agent states a fact or takes a big action, it should point to where that came from — a document, a file, a real source. If it can’t, it says so plainly instead of dressing a guess up as a fact. In practice this is one habit: cite it, or mark it unknown. It kills the most common failure, which is an agent saying something false with total confidence.

Receipt — keep an honest record. Every decision gets written down in a way that can’t be quietly edited afterward. Not a debug log you throw away — a record you can come back to and trust. When you return to an agent that ran for an hour without you, the receipt is how you know what it actually did.

Gate — one human yes for anything you can’t undo. Some actions can’t be taken back: deleting data, sending money, pushing to production. Those wait for a person to approve them. And the approval is for that one specific action, not a blanket “this agent is allowed to push.” A single, specific yes.

That’s the whole toolkit. Verdict, grounding, receipt, gate. Four checks, applied at the spots where the agent touches the real world.

The rest of the harness

The four attachments are the brakes. A full harness has more moving parts, and it’s worth knowing their names so you know where to go next:

• Context and environment — what the agent can see, and where it runs. A short instructions file (many tools call it AGENTS.md), a clean and repeatable workspace, and good context are what make an agent competent instead of lost.
• Tools — the specific things the agent is allowed to call, and nothing more. A few sharp tools beat a giant pile of them.
• Memory — what carries over between tasks, so the agent doesn’t start from zero every time.
• Feedback loops — letting the agent run its own tests and fix what it broke before it says it’s done. This one alone can turn a mediocre agent into a reliable one without touching the model at all.

The brakes come first here because they’re the part that hurts most when it’s missing. But once your worst seam has a check on it, these are where the rest of the work lives.

Where to start

You don’t need a framework or a big rewrite to begin. You need one honest hour with a pen.

1. List the seams. Write down every place your agent takes a real action. Be specific. Most agents have fewer than ten.
2. Find the scariest one. Which action would hurt most if it went wrong? Usually it’s something you can’t undo.
3. Put one check there. Just one. Add a verdict, or a gate, at that single worst spot. Don’t try to cover everything at once.
4. Write it down. Give that one check a receipt, so you can see it working.

Then do the next seam. A harness is never finished — every new thing your agent can do is a new seam to cover — but it doesn’t have to be finished to help. One check at the worst spot is already more safety than most agents have.

The model is the part you didn’t build. The harness is the part with your fingerprints on it. Start with one seam, put one honest check in the gap, and you’ve begun.

---

New to this? Pick the one action your agent takes that scares you most, and add a single check in front of it this week. If you want a hand thinking it through, tell me what you’re building — I read every one.