Agent harness architecture is the design of the runtime around a model: who owns the loop, how tools run, what context is injected, which hooks can refuse, which identity the tools use, and how “done” is checked without taking the model’s word.

LangChain’s anatomy is the public parts list: prompts, tools and MCP, bundled infrastructure (filesystem, sandbox, browser), orchestration (subagents, routing), hooks and middleware (compaction, lint, continuation). Databricks groups the same into tools, memory, workspace, guardrails. This article is that list as an architecture you can inspect — then the mapping onto company jobs: workstreams, agent teams, connectors, write-back.

It is not a novel about kernels. It is not multi-agent protocol (hand-offs between specialists) and not HITL state machines (quote → sign → execute), though a complete outer harness contains both. Start from what is an agent harness. Use how to evaluate as the test of this diagram.

Words you’ll hear

Control plane vs data plane. Control: grants, budgets, gates, routing policy — known independently of the model. Data: tokens, tool results, artefacts. If the orchestrator is only a system prompt, a jailbreak is a privilege escalation. Multi-agent architecture already said this; it is a harness invariant.
Workspace. Inner: checkout / sandbox. Outer: workstream. Inner vs outer.
Tool plane vs write plane. Reads default on. Mutations fail-closed. MCP may implement both; architecture must split them. MCP spec.
Compaction. Harness-owned context management so the window does not become the only memory. Anthropic’s long-running harness offloads state to files and git.
Routing. Model class per step, not a user-picked mascot. Model routing architecture.

Nimbus maps this architecture onto product objects rather than asking operators to draw LangGraph: wiki (guides), integrations (tool plane), agent teams (orchestration contract), workstreams (workspace), governance (write plane), Lifecycle Graph (eval and memory), models (routing). Other vendors map the same boxes differently. Score the boxes.

Why architecture (not a bigger prompt)

A prompt cannot own tool execution, identity, or a stop that survives a tired model. Harness engineering is the practice; this page is the structure the practice edits. NIST AI RMF Govern/Map need a system you can point to. ISO 42001 needs operational controls. OWASP LLM Top 10 excessive agency is what happens when the tool plane has no architecture.

McKinsey 2025 treats agentic value as organisational. Architecture is how you stop “every team’s unofficial loop” from becoming the estate.

It affects you if you are combining MCP servers, a coding agent, a copilot, and a CRM writer without a single grant and quote rule. Two writers to one object is an architecture bug, not a training issue.

The pieces

Keep these as inspectable contracts.

1. Loop runtime. Plan → act → observe, with max steps and a cost budget the model cannot waive. Frameworks (create_agent, LangGraph, CrewAI) implement this in process. Product harnesses implement it as a hosted run. Anthropic’s effective agents is still the best short note on bounding the loop. “The model says it is done” is an input to the runtime, not the runtime.

2. Workspace and filesystem. Inner harnesses treat the directory as externalised memory — Manus-style and Anthropic-style artefacts. Outer harnesses treat the workstream as the directory analogue: artefacts on a canvas, not a hidden /tmp on a laptop. Do not store approved discounts only in a coding agent’s memory file.

3. Context assembly. System prompt, skills, AGENTS.md / wiki slices, retrieved records, prior graph nodes. Guides in Böckeler’s sense. Compaction and retrieval belong here. Enterprise RAG is a pattern inside this box, not the architecture. Company wiki is asserted policy; do not collapse it into a private vector bucket per agent.

4. Tool dispatch. Host executes; model proposes. Sandbox for shell. Adapters for SaaS. Timeouts, retries, structured errors back into the loop. Generic HTTP with a production token is not this box. It is a confused deputy.

5. Hooks / middleware. Deterministic intercepts: Claude Code PreToolUse / PostToolUse; LangChain middleware; outer interceptor that never exposes the write API unsigned. Write-back governance. Advice in markdown does not live in this box.

6. Permissions and identity. Who the harness authenticates as, per tool, per object, per job. Roster and workstream membership on the outer side. Repo and sandbox roles on the inner side. Teams declare required connectors; the workspace still grants. Agent team architecture.

7. Orchestration. Subagents, specialist hand-offs, stop on gate. Optional until duties already split. Orchestrator in the product, not a manager persona with every login. What is multi-agent AI.

8. Sensors and eval. Compiler, tests, schema, quote-hash, SoR read-back, human review. Independent of the generator. Eval loops. SWE-bench / Terminal-Bench measure inner coding harnesses; they do not close this box for GL posts.

9. Durable memory of operations. Files and git (inner). Wiki + Lifecycle Graph (outer). Session transcripts are a debug aid. They are not the ledger. Causal memory.

10. Routing and spend. Step classes → model classes. Caps on the run. AI cost control. Seat-unlimited flagship is an architectural choice (always-frontier), not a missing feature.

Flow (outer). Brief on a workstream → satisfy connector contract → plan → retrieve (logged, scoped) → draft on canvas → quote if write in scope → gate → execute signed payload only → commit graph. If steps 5–7 live only in a prompt, jailbreaks and tired operators fall through the same hole.

Flow (inner). Session start loads guides → loop with shell/editor tools → hooks on tool events → tests as sensor → commit / PR → CI as outer-loop sensor in Osmani’s sense. Anthropic’s initializer vs coding agent is a two-role inner architecture for work that outlasts one window.

Nimbus’s hosted flow is the outer sequence. Perception and Conflux sit on retrieve/draft; they must not skip the quote. That is architecture, not brand.

Failure modes the diagram exists to prevent

Orchestrator-in-the-model. Jailbreak equals admin.
Shared toolbox. Every specialist has every write.
Context as only memory. Compaction deletes the approval.
MCP as control plane. Plug without grants.
Eval = transcript. The model graded itself.
Two harnesses, one SoR writer. IDE MCP and OS both PATCH.
Framework mistaken for architecture. Nodes without identity. Harness vs framework.

EU AI Act oversight needs interrupt and record. Those are boxes 5, 6, and 9.

Mapping LangChain’s anatomy onto company objects

LangChain’s parts list is built from coding and general agents. Translate, do not copy:

Anatomy piece	Inner binding	Outer binding
System prompts / skills	`CLAUDE.md`, skills	Wiki playbooks, versioned with the run
Tools + MCP	Shell, apply_patch, browser	Connectors; MCP behind the same grant
Filesystem / sandbox	Checkout, container	Workstream canvas + isolated grants
Orchestration	Subagents in the IDE	Agent teams on a roster
Hooks / middleware	PreToolUse, lint	Write interceptor, spend cap
Memory	Files, git, memory md	Wiki + Lifecycle Graph
Eval	Tests, Terminal-Bench	Quote hash, SoR read-back

If a vendor cannot fill the outer column, they are an inner (or framework) product. That is allowed. Do not invent the column in a slide.

Control plane independence. Whatever sits in the Orchestration row must know grants, budget, and gates without asking the model. LangGraph can do that if the nodes are code. A “manager agent” with every tool cannot. Nimbus’s orchestrator is product-hosted for that reason; you should still ask it to refuse when NetSuite is missing. Evaluate.

Thoughtworks’ four combinations (deterministic/probabilistic × feed-forward/feedback) overlay this table. Whitelists and spend ceilings are box 5/6 deterministic feed-forward. Schema validation is box 8 deterministic feedback. Wiki retrieval is probabilistic feed-forward. LLM critic is probabilistic feedback — never the only item in box 8 for a GL post.

Two harnesses, one SoR rule. Draw both columns on one whiteboard. Draw one write plane. If two arrows reach Salesforce, you have an architecture incident waiting. Inner vs outer.

Version the diagram when you add a tool. A new MCP server is a change to boxes 4 and 6, not a chat plugin. MCP.

Implementation order for a company that has none of this: (1) split write plane from read plane — even if the “harness” is still a single agent; (2) pin policy version on the run; (3) add one deterministic sensor on the artefact you cannot get wrong; (4) host the orchestrator’s grants outside the prompt; (5) only then add specialists. Reversing that order is how shared-toolbox swarms ship. Anthropic starts with bounding tools and defining done for a reason.

Framework teams should draw the ten boxes on the README of the graph repo and tick which are code, which are still prompts, which are missing. Product teams should map each box to a screen an operator can see. If box 8 is “the model reflects,” you do not have eval architecture. If box 6 is “the service account,” you do not have identity architecture. Nimbus’s screens are workstreams, governance, wiki, graph — use them as a checklist, not as proof that the boxes exist in your configuration.

Databricks calls the model the brain and the harness the body. Architecture is the anatomy of that body so Security can review it. If the diagram is only “LLM in the middle, tools around it,” you have a marketing poster. Add identity, the write split, the sensor that does not trust the brain, and the ledger. Then the poster is a design.

How this shows up in Nimbus

The product is a particular binding of the ten boxes for operators: hosted loop, workstream workspace, wiki context, connector dispatch, governance hooks, team orchestration, graph memory, NTU routing. Overview. Inspect each box in a PoV the way you would inspect Claude Code’s hooks and sandbox for an inner buy. How to evaluate. AIP and Agentforce bind the same boxes to Ontology or CRM; the architecture still applies.

Agent Harness Architecture

Words you’ll hear

Why architecture (not a bigger prompt)

The pieces

Failure modes the diagram exists to prevent

Mapping LangChain’s anatomy onto company objects

How this shows up in Nimbus

Questions people actually ask

Do we need all ten boxes on day one?

Is this the same as an enterprise AI OS architecture?

Where do skills fit?

Can LangGraph implement this?

What should I read next?

Sources

Related guides

Eval Loops for Enterprise Agent Harnesses

See what governed AI looks like on your stack.