A model in a browser tab answers questions. A desktop app with access to one folder does a bit more, but that's only the start. An agent harness is the whole environment the agents work in. They know what they are allowed to do, remember what was agreed, learn from their own mistakes, and get checked before anything leaves the building.

The best part of a harness is that you build it yourself, for your own company. It doesn't have to be big on day one. It has to grow and never slide back. The closest analogy is creating a role. You don't hire "artificial intelligence." You create a position with a scope, access to knowledge, a manager and a probation period, and then you staff it with a model. That worker grows with the company, because its environment grows with it. This is the difference between a company that uses AI as a chat window and a company that runs a team of AI agents.

This is how we work every day. We have agents with standing roles in several teams, and dozens of one-off agents spun up for a single task. On a bigger job, more than ten of them run at once.

What is an agent harness?

An agent harness, or AI agent harness, is everything that surrounds the model and decides how the agent works: where it gets its knowledge of the company, what it's allowed to do, who checks its output and what it learns from mistakes. The model supplies the reasoning. The harness supplies context, memory, permissions, rules that fire automatically, a work log, judges and a learning loop. One model in two different harnesses is two different employees.

In our company, several teams of agents work under one harness. One team builds websites. Another writes content and measures how Google and AI chats see the site. Others keep the company's knowledge in order, run social media, and look after clients after delivery.

Above them sits an orchestrator. It's an agent that takes a task and lays it out as a graph: who does what, in which order, and who judges the result. Then it spins up subagents for the work. A subagent gets a narrow brief and returns a short report, not its whole output. Designing these graphs is a skill of its own. We call it graph engineering, and it deserves a separate article.

Company-wide rules for AI, meaning policy and oversight, are a different topic. We covered them in our article on an AI governance framework.

What does an agent harness consist of?

Five parts. Each answers one question a business owner asks. Permissions, meaning what the agent may do, live in the hooks.

Part The question What it gives you
Context and memory Where does the agent get its knowledge? the agent knows your company, not just the world
Hooks What will the agent never do, even when it badly wants to? a rule that stops instead of asking
Logs What happened, and why? every mistake can be replayed
Judges Who checks the work before it goes out? a second agent scores the result against criteria
Learning loop What happens to a mistake after you notice it? the mistake becomes a rule with evidence

Two words need a definition. A hook is a small program that runs by itself at a set moment in the agent's work. For example, right before a file is saved or a message is sent. A log is the journal where the agent records what it did, when, and why.

Where does an AI agent get its knowledge of the company?

An agent needs two things. Context, which is the knowledge about the company handed over at the start of a task: prices, client agreements, procedures, who is responsible for what. And memory, which is what the agent writes down between tasks: decisions, open issues, lessons. We described context in detail in our article on the context layer. This section is about memory, because memory is what breaks quietly first.

Memory is a responsibility, not a file. Every entry in our agents' memory carries two labels. The first says what it is: for example an owner's decision, a fact with evidence, or a note from a session. The second says where it came from: a person, research, or the agent's own work. A hook stops any entry without labels and makes the agent fix it on the spot. Open issues get a review date, after which the agent asks about them itself instead of carrying them forever. Three months later, you still know which line in memory is the boss's decision and which is a note from one conversation.

This isn't the same as "memory" in a browser chat. The chat saves recollections from your conversations and decides on its own which ones to bring back. You don't know what it remembered, where it got it, or when it will forget. Memory in a harness has a schema. Every entry has an author and a type, and open issues have a review date, so you can review it, correct it and clean it out. The first is convenient for one person. The second is fit for a company.

What to do in your company: don't do this by hand, because nobody keeps it up. Give the agent your memory, even if it's a single document. Ask it to interview you about it: is this a decision, a fact or a note? Who said it? Until when does it hold? The agent adds the labels itself and asks only where it doesn't know. Sentences with no answer get cut. After that interview, a support agent that "remembers" a 12% discount for client X can tell you where that came from and when it started.

What are hooks in an AI agent?

A hook is a rule written in code that stops the agent before a forbidden action on its own. An instruction is a request. A hook is a guarantee. An agent can ignore an instruction. Not out of bad faith: every rule written in an instruction works until the model decides that this time is different. And sooner or later, it will. So everything the agent must always do, or never do, moves out of the instruction and into a hook. A hook doesn't read the instruction and has no opinion. It checks a condition and either lets the action through or stops it. It also holds when someone tricks the model with planted text, known as prompt injection: the model may give in, the hook won't.

We keep a list of conditions every website we ship has to meet. One of them: animations must switch off when the user has turned on "reduce motion" on their phone. The agent that fixes the site has that list in front of it. When a fix won't work, it can take a shortcut: instead of repairing the code, remove the condition from the list. Its report then looks clean, because the condition is gone.

So a hook inspects every code change and checks two things. Did anything the list requires disappear from the code? And did the agent touch the list in the same change as the code? If so, the change doesn't go in. The list may be changed, but separately, with its own description, so that a person sees it in the change history. The agent can keep fixing as much as it likes. It can no longer hide a lowered bar inside a fix.

Hooks work in both directions. Elev, our agent on X, publishes on its own because hooks watch its daily limits and the topics it must not touch. It started with a narrow scope and close control, and autonomy came later. Where an agent should stop and wait for a person is the subject of our article on human in the loop.

What to do in your company: ask the agent to list every sentence in its own instructions that contains "always" or "never". Each one is a candidate for a hook. Start with the one that costs the most when broken: sending anything outside the company, changing a price, deleting data.

Why does an AI agent need logs?

The log is the record of every action an agent takes, so you can see what it did and why. It's the cheapest part of the harness and the easiest to skip. Each entry has a date, a purpose and a result. Every hook that fires goes in too: which rule, in which file, what it stopped. Since June, our hooks alone have written more than 1,100 such entries.

Every few weeks we read the entries and ask two questions. When a rule stops the agent often, we ask whether the problem lies somewhere else: maybe in the instruction, maybe in the context. When a rule has never fired, we ask whether it's still needed, because a harness that only grows eventually gets in the way. When a client asks "why did the agent write that," the answer comes from the log. For high-risk systems, a log like this becomes mandatory under the EU AI Act (Articles 12 and 26(6)) from December 2, 2027, at the earliest (as of October 2026).

What to do in your company: one file or one table where the agent records every action that leaves the company. Read it in full once a month. The first time takes an hour.

Who checks the work of an AI agent?

A finished piece of agent work, meaning a proposal, a report or a change to a website, is scored by a judge. The judge is a separate subagent that receives only the result and a list of criteria. It didn't see how the work came about, so it defends nobody's choices. For work that goes to a client there are two judges, and they are deliberately two different models, because each has its own blind spots.

In the end a person reads it anyway, no matter how many judges came before. The judges don't replace that reading. They make sure the person gets work with the simple mistakes already caught, and can focus on what the model doesn't know.

We also check the checkers. In October we reviewed 23 pairs of verdicts from our own work. In 11 pairs the judges disagreed, and in 10 of those 11 the stricter one was the same model. That means that under the rule "one no is enough", one judge decided the outcome in practice and the other mostly confirmed it. We also saw that the judges passed texts that were correct and dull, because nobody had written dullness into the criteria. A judge checks only what's on its list. So for articles, a person now reads the raw draft before the judges do, and every miss goes into the criteria.

What to do in your company: ask the agent to propose five criteria for a good answer, and correct them. Once a month, give it 20 real questions from the previous month. Read the results yourself. After a model change, run the exam again.

How do you develop an agent harness?

You need a loop in which every mistake leaves a trace, and every significant change has to prove it's better than the one before.

An agent that discovers something new during a task doesn't write a rule into its knowledge right away. For example, that a certain tool fails in a specific situation. It records a candidate lesson. After the task, a separate review checks whether the candidate is a real lesson or a one-off coincidence.

Only then does a separate agent, the one that keeps our knowledge in order, merge the lesson with the rest. It goes in with its evidence: the file and the version where it can be seen. An entry without evidence stays a note and doesn't pose as a fact. When we reworked our lessons file this way in September 2026, 140 loose entries became 64. They carry 138 references to files and versions, because one lesson often has several pieces of evidence.

The second principle: a change to the harness must not break what already worked. We test that on real tasks from the past. Before we change an agent's instructions, we take requests from the last few weeks for which we know what a good answer looked like. We split them into two halves. On the first half we write and tune the new instruction. The second half stays unseen until the work is done. At the end we run the old and the new instruction on that hidden half and count the hits. The new one has to score more. If it scores less, the old one comes back.

An instruction is easy to fit to the tasks you have seen. The agent has to work on tasks nobody has seen yet, and only the hidden half tests that.

The same month we improved the hint that tells an agent which tool to reach for. We took 84 requests, 42 in each half. On the hidden half, the old version picked the right tool 39% of the time, the new one 68%.

What to do in your company: have the agent keep a "lessons" file with three columns: what happened, what follows from it, where the evidence is. You only answer when it asks whether something was a one-off or will come back. An entry without the third column doesn't go in. Before you change the agent's instructions, run the old and the new version on the same 20 questions from last month.

What does a harness cost, and what will it not fix?

A harness has three costs. First, every piece of work a judge reviews goes through a model twice, so the model cost for that one piece roughly doubles. That's still a fraction of what it costs to have a person check the work from scratch. Second, an hour a month to read the log and act on it. Third, the time for the interviews in which the agent asks and you answer. That last cost is highest at the start and nearly disappears after a few weeks, because the agent only asks about new things.

A harness won't fix three things. It won't repair a process that doesn't work without the agent either. If nobody in the company knows who approves a discount, a hook won't settle it. It won't replace the decision about who is responsible for the agent. The log and the judges show the mistake, but someone has to read it. And it won't turn the model into a specialist in a task the model can't do.

What is the best agent harness right now?

There's no single best one. There are several ready-made environments, and they differ in how much they give you on day one and how much they leave to you. That means permissions, company context, hooks and a choice of model.

These tools differ in model, license and how many parts of a harness they ship with. Comparing two of them, or two models, works the same way as the test in the previous section. The same set of tasks, the same hidden half, count the hits. You don't have to trust rankings from the web.

What to do in your company: start with a ready-made harness, not a library. Pick one with built-in human approval points and hooks, because those are the two things you don't want to write from scratch. Change the model only once you have a task set to compare the old one with the new one.

Where do you start building an agent harness?

Start with the log, then put one hook on the step that can't be undone. Not with everything at once, and not by hand. An agent does each of these steps: it runs the interview, you answer, the agent writes it down and enforces it. The order we recommend goes from cheapest to hardest:

  1. Log. One file, every outbound action of the agent with a date. A day of work.
  2. First hook. At the step that can't be undone: sending, paying, deleting. Before the agent does it, a person says yes.
  3. Memory with labels. Who said it, until when it holds. Everything else gets cut.
  4. Exam. 20 real questions once a month, and a person who reads the results.
  5. Lessons file with evidence. Every agent mistake ends in an entry, and an entry that repeats becomes a hook or a fix to the context.

The harness is good enough when every step that can't be undone has a hook or a person. Every mistake can be replayed from the log. Every significant change to the harness has passed the test on old tasks. Once you have that, you can add agents and give them more freedom without the system quietly sliding back.

We build agents with human-in-the-loop approval from day one. An internal agent with human approval starts at $4,600 upfront, then from $350 a month (prices as of October 2026), with team onboarding included. If you already have an agent, our AI Trust Layer audit checks its security: permissions, prompt injection, GDPR and EU AI Act compliance. You get a report with a fix list in 5 days.

Frequently asked questions

What is a harness in agentic AI?

The same thing as an agent harness: the environment around the model that gives it context, permissions, memory, a log and quality checks. "Agentic AI" is the umbrella term for systems where the model carries out tasks in the company's tools instead of only answering questions.

Is Claude Code an agent harness?

Yes. Claude Code, Anthropic's tool for developers, has built-in permissions, project memory, hooks and points where the agent asks a person for approval. The model is the same one as in the chat window. The difference is everything around it.

What is a harness engineer?

The person who designs and develops the agent's environment: what it sees, what it may do, who checks it, how it learns. The work itself is called harness engineering. In a 20-person company, the person who deploys the agent does this work, and rightly so, because they know the processes the agent has to respect.

Does an agent built in ChatGPT or Gemini have a harness?

It does, but one set by the vendor: limits, filters, account memory. The company is responsible for the rest: what the agent gets as context, who has access to it, and what happens to its answers. Such an agent usually has no log and no exam, so those two need to be built alongside it.

Why build your own agent harness?

A ready-made harness gives you the mechanics: permissions, memory, hooks, subagents. It doesn't give you the content: your rules, your company memory, your judges and your log. That's what you build yourself, on top of a ready-made tool. A harness from scratch, built from a library, makes sense only when the agent is going into your product rather than working alongside your team.

How much does an AI agent with a harness cost?

Our internal agent with human-in-the-loop approval starts at $4,600 upfront, then from $350 a month (prices as of October 2026). For the wider picture, see our article on how much AI costs for a small business.

An AI agent with human oversight in your company

We build internal agents with human-in-the-loop approval. Team onboarding is included: we use your own process to show you how to approve, correct and reject the agent's work. We start with one conversation about the one process your agent should run.

Let's talk
Read us regularly? Add as preferred source