Agent harness
The software environment around a model that supplies it with context, memory, tools, permissions and an execution loop, and that constrains what its choices are able to affect.
Updated 15 September 2026
In practice
A model proposes updating a customer record. The harness validates the arguments, checks the request against current policy, calls the CRM through an approved credential, and records what happened.
The distinction
The model chooses; the harness decides what a choice can do. Security, authority and evidence live in the harness, so evaluating the model alone leaves most of the operating risk unexamined.
What sits in the harness
| Layer | Job in the system | Typical failure if it is missing |
|---|---|---|
| Context and memory | Supply current information and retain relevant state | The system acts on missing, stale or unauthorised information |
| Runtime and orchestration | Manage execution, state, retries and long-running work | The process stalls, repeats or loses its place |
| Tools and service access | Perform actions in software and the world | The agent can recommend but cannot complete the job |
| Identity, authority and policy | Establish the principal and constrain permitted action | The system overreaches or cannot prove permission |
| Evaluation and observability | Test quality and record what happened | Failures stay invisible or cannot be explained |
| Security and recovery | Contain hostile input, data loss and operational failure | A small error becomes a business incident |
Why the boundary matters
Retrieved web pages, emails and documents can contain text shaped like instructions. When a model can act, a hostile instruction inside retrieved content can try to redirect the task or invoke a tool.
Australia's cyber-security guidance is direct about the consequence: no harness is inherently secure, and prompt injection has no fully reliable mitigation at the model layer. The recommended response is defence in depth — least privilege, controlled tools and data, validation, human oversight, monitoring and phased deployment.
Screening a prompt may identify a hostile instruction. A separate policy gate is what prevents the proposed database write. The first control explains the threat; the second limits the effect.
The commercial reading
A customer buys a dependable result, not a model in isolation. Two businesses can run the same model and get very different outcomes because one gave it narrow tools, current data and an approval step, and the other gave it broad credentials and hope.
That makes the harness the part worth inspecting during procurement. Ask which tools the model can select, which actions need approval, where the policy is enforced, what evidence is retained and how access is revoked.
Sources & context
Agentic AI harnesses
Australian Signals Directorate · September 2026
Defines the harness as the layer connecting a model with context, memory, tools, permissions and the execution loop, and states that no harness is inherently secure.
Source checked 2026-09-13
Lessons learned from a consortium on tool use in agent systems
NIST · August 2025
Describes the leading pattern as a general-purpose model embedded in software scaffolding that lets it manipulate tools beyond text output.
Source checked 2026-09-13