Harness Engineering: Designing the System Around the Model

In brief

What this examines

The article argues that the durable enterprise advantage in agentic AI sits in the harness around the foundation model rather than in the model alone. The harness combines system prompts, context loading, retrieval, tools, sandboxing, skills, subagents, and loop control. Those components carry the organization's knowledge, permissions, evaluation criteria, stopping rules, and operational evidence.

Why it matters

The architecture makes model choice more portable but not trivial. A model swap still requires prompt and tool-call adaptation plus regression testing against the real workload. The strategic asset is therefore the governed system an organization owns and can evaluate, not a direct dependency on one vendor endpoint.

Key ideas

• A language model becomes an operational agent only through the surrounding harness.
• Controls should precede capabilities: prompts, loop limits, and tool permissions come before broader autonomy.
• Context loading is deliberate curation under a finite token and attention budget.
• Retrieval is useful only when outputs retain auditable provenance.
• Tool access is simultaneously a capability, permission grant, attack surface, and logging obligation.
• Sandboxes, reusable skills, evaluator subagents, and explicit stopping conditions make agent work safer and more repeatable.
• Model portability is real only when the same evaluation suite is rerun against each candidate.

The eight components around the model

A language model becomes an operational agent through the harness around it. The field guide separates that harness into system prompts, context loading, retrieval, third-party tools, a code sandbox, reusable skills, subagents, and loop control. Each component carries part of the organization’s knowledge, permissions, evaluation criteria, stopping rules, and evidence.

• System prompts encode role, boundaries, approvals, and conflict-handling rules.
• Context loading curates the minimum relevant state under a finite attention budget.
• Retrieval grounds answers in current, attributable sources.
• Tools convert text into action and therefore require permissions, approvals, and logs.
• Sandboxes contain generated code while returning observable execution results.
• Skills make reviewed procedures reusable, versioned, and governable.
• Subagents separate specialized work and independent evaluation.
• Loop control defines when to continue, retry, stop, or hand work to a person.

Controls before capabilities

The guide proposes building the control plane first: system instructions, loop limits, and tool permissions. Context loading and retrieval come next so the agent is grounded in current, auditable information before it receives consequential work. Sandboxes, skills, and subagents then extend capability on a base that can already be governed.

Why the harness supports model portability

The model still performs the reasoning, but the surrounding system owns the context, retrieval, tools, permissions, containment, and evaluation. A model change remains engineering work: prompts and tool adapters may need adjustment, and the full evaluation suite must be rerun against the real workload. The harness makes alternatives evaluable rather than making migration free.

Where the argument has limits

Models are interchangeable only within a sufficient capability range. The strongest model may still be necessary for novel reasoning, long-horizon tool use, structured output, or work that must be right on the first attempt. Self-hosting also replaces a usage bill with infrastructure and operational responsibility rather than removing cost.

The readiness test

A production-ready harness should answer a short set of questions before an agent receives authority.

• Can the agent see the right context without seeing too much?
• Can it use tools without bypassing approval?
• Can every material answer be traced to an auditable source?
• Can a separate evaluator challenge the work?
• Can a person reconstruct the run after failure?
• Can the system be evaluated against another model without being rebuilt?