Regulated financial services
Audit-ready run ledger
Each automated decision writes an immutable trace of the plan, the evidence, the model tier, and the approver. Examiners receive a reconstructed run rather than an explanation of one.
AI Engineering · 02
The harness is the product. The model is a dependency.
An agent harness is the runtime that decides what the model may see, what it may do, when it must stop, and what evidence it leaves behind. Swapping model providers should be a configuration change; the harness is where the durable engineering — and the compliance posture — actually lives.
The layers
A harness is conventionally drawn as a stack because each layer constrains the one beneath it. The orchestrator never calls a provider directly; it calls the router, which calls a model under a budget. The model never touches a system of record; it emits a tool intent that the registry validates, the policy engine authorises, and the sandbox executes under an allow-list.
┌──────────────────────────────────────────────────────────────┐ │ ORCHESTRATOR plan · step scheduler · stop rules │ ├──────────────────────────────────────────────────────────────┤ │ POLICY ENGINE autonomy tier · approval gates │ │ data-residency · redaction │ ├──────────────────────────────────────────────────────────────┤ │ CONTEXT ASSEMBLY retrieval · compaction · pinning │ ├───────────────────────────────┬──────────────────────────────┤ │ MODEL ROUTER │ TOOL REGISTRY │ │ tier selection · fallback │ typed schemas · scopes │ │ budget accounting │ idempotency · rate limits │ ├───────────────────────────────┴──────────────────────────────┤ │ EXECUTION SANDBOX network allow-list · timeouts │ │ credential broker · egress control │ ├──────────────────────────────────────────────────────────────┤ │ OBSERVABILITY span trace · token ledger · replay │ └──────────────────────────────────────────────────────────────┘
Where the engineering effort goes
Teams new to agent work expect prompt engineering to dominate. In delivered systems it is the smallest line item. The bulk of the work is in the surrounding runtime — the parts that make behaviour repeatable, bounded, recoverable, and reviewable.
Figure 1
Distribution of build effort across harness layers
Representative allocation on an enterprise agent engagement. Prompting is real work, but it is a fraction of what a production runtime requires.
Illustrative reference data — engagement figures vary by environment.
Non-negotiable harness properties
- Idempotent tools
- Every mutating tool accepts an idempotency key. Retries after a timeout must not duplicate a payment, a ticket, or an ERP posting.
- Credential brokering
- The model never sees a secret. Tools request short-lived, narrowly scoped credentials from a broker that logs each issuance.
- Deterministic replay
- Every run stores its inputs, tool results, and model selections so it can be replayed exactly — the basis of both debugging and audit response.
- Budget accounting
- Tokens, tool calls, wall clock, and spend are metered per run and enforced as hard ceilings, not monitored after the fact.
- Graded autonomy
- Autonomy is configured per tool and per environment. The same workflow can run read-only in staging and gated in production.
- Continuous evaluation
- A fixed case suite runs against every prompt, model, and tool change, so provider updates surface as a failed check rather than a customer complaint.
Use cases
Multi-vendor enterprise IT
Provider-agnostic runtime
A common tool registry and router sit in front of several model providers, so procurement, pricing, and residency decisions do not require re-engineering workflows.
Manufacturing operations
Sandboxed control-adjacent automation
Agents read from plant systems freely and write only through gated, idempotent tools with an explicit allow-list and hard timeouts.