Writing

What are the types of agentic harness?

Hard problem
"Agentic harness" names multiple different systems that share a shape and little else. Which one is meant decides who operates it, what it may touch, and what happens when the model is wrong.
Approach
Separate them by what the model acts on — code, domain work, or a product surface — then judge each by what it stops when the model is wrong, which differs far more than what any of them can do.

What separates one harness from another is what the model is pointed at.

1. Acting on code

The model writes code and the harness is what that code has to survive: lint, formatter, typecheck, tests, and hooks that refuse destructive commands.

2. Acting on the work

Our moat here was our understanding of our internal processes, the tacit knowledge that you need to run successful AI — and this is true no matter how good AI gets, how good models get.

— Your Moat Is Your Data Model, Mike Phipps, Gates Foundation

Domain work arrives as evidence no schema anticipated, and reading that mess is what models are good at, so the model reads and proposes while a deterministic engine decides and records.

inputproposalpasses both gatesfails a gate → rebuild
NON-DETERMINISTIC — THE MODELDETERMINISTIC — THE ENGINEMessy evidencestatements, PDFs, screen recordings,on-chain eventsMulti-modal parseWhisper · Qwen3-VL · OCR — localmodels, end to endModel proposesclassified transactions, matchedsources, extracted entriesRules + raw eventsthe immutable inputsRegenerate ledgerderived from inputs, never hand-editedGatesdouble-entry balances · every figuretraces to an event and a ruleCommitted ledgeraudit-grade by constructionthe model never writes to the ledgerdeleted and rebuilt, not patched
The model proposes; the deterministic engine decides. A proposal that fails either gate is discarded and the ledger regenerated from inputs and rules — never patched in place. That is how non-deterministic reasoning coexists with books that have to survive an audit. The same harness pattern, pointed at web development instead of accounting, built this site.

3. Acting on a shipped surface

It's better to fail predictably than it is to succeed unpredictably.

— Anthropic Workshop: Build Agents That Run for Hours

The same engine behind something other people run. The agent gets a public surface — the tools it exposes, the container it runs in — and the goal stops being throughput and becomes trust: that it does what it says and no more.

4. Acting on the harness

A model request is not permission. Authority should bind to one pending action.

— Your Agent Didn't Fail. Your Harness Did., Vinoth Govindarajan, OpenAI

A model pointed at the session itself: noticing that the operator is doing by hand what the harness already automates, explaining when asked, blocking the calls that would destroy someone else's work. Notice, explain, block — the input, the question, the action. It produces nothing, and that is the point.

The interesting question about any harness is not what it can do, since models are capable now, but what it is stopped from doing when it is wrong.