An inner agent harness is the runtime around a model for a developer and a codebase. An outer agent harness is the runtime around a model for operators and live business systems. Same equation — Agent = Model + Harness — different workspace, different sensors, different stop.

Böckeler already uses “outer harness” for the controls users add around a coding agent (guides, sensors) as distinct from the vendor’s built-in loop. Addy Osmani tells engineers to own the outer loop of investigate → implement → verify so accountability does not dissolve into the model. This article borrows those words and draws the cut enterprises actually buy: repo versus company.

Claude Code, Cursor, and Codex are excellent inner harnesses. They sandboxes, apply_patch, CLAUDE.md / AGENTS.md, hooks, and tests. Palantir AIP, Salesforce Agentforce, and OS-class products such as Nimbus are outer harnesses: workstreams, connectors, named signers, a decision record. Confusing them is how Legal is asked to “just use Cursor on the Salesforce repo” and how engineering is asked to “approve CRM writes in a coding agent.”

How to choose between a coding harness and an enterprise harness is the buying version of this page. How to choose between a copilot and a work OS is the adjacent cut (personal assistant versus departmental work). Inner/outer is about which loop you are hiring, not whether the UI looks like chat.

Words you’ll hear

Inner loop (classic SE). Edit, build, test on a developer’s machine. Fast. Local. The coding-agent inner harness lives here: shell, files, compiler.
Outer loop (classic SE). PR, CI, review, release. Osmani’s “own the outer loop” is this accountability layer for agentic coding. Still software.
Inner harness (this article). Vendor + user controls for a repository workspace: Claude Code, Cursor, Codex. Eval: tests, Terminal-Bench, SWE-bench.
Outer harness (this article). Controls for a company workspace: jobs, systems of record, people who may sign. Eval: quoted write, identity, ledger. An enterprise agent harness.
Guides vs sensors. Feed-forward markdown versus feedback from tools. Inner: lint and pytest. Outer: schema of a Salesforce payload and a Hard gate. See what is harness engineering.
CLAUDE.md / AGENTS.md. Inner guides. Anthropic is explicit: files are context; hooks are deterministic. A company wiki is the outer analogue of those files — asserted policy, not a repo README. See What is a company wiki for AI agents.
Write gate. Inner: hook denies rm or force-push. Outer: write-back governance — adapter cannot mutate CRM until a named role signs the quote.

Nimbus is built as an outer harness: wiki instead of only AGENTS.md, connectors instead of only a local shell, governance instead of only a pre-commit hook, Lifecycle Graph instead of only git log. Engineering should still run Claude Code. Those products should not share a write path to NetSuite.

Why you should care

Demos collapse the cut. Both products answer a question. Both call tools. Both show a transcript. The evaluation is the workspace.

It affects you if:

Security asks whether the coding agent’s MCP server can reach production Salesforce
RevOps wants “an agent” and is shown a SWE-bench slide
Engineering wants Cursor and is told to wait for the enterprise OS
You already have both, and they silently write to the same object

McKinsey’s 2025 State of AI describes agentic systems as an organisational design problem. Inner harnesses scale developer throughput. They do not, by themselves, scale governed operations. Stanford HAI’s 2025 AI Index maps how fast coding-agent tooling moved. Speed in the repo is not a substitute for EU AI Act oversight on systems that affect customers and money.

Two failure modes:

Outer job, inner harness. A pricing change drafted in Cursor with an MCP Salesforce tool. Tests pass on a fixture. Production Amount changes. git blame does not name the signer. You used a repo loop on a company record.
Inner job, outer harness. “Rewrite this function” opened as a cross-department workstream with a Critical gate. Engineers will route around it. You used a company loop on a compile.

NIST AI RMF Map step: know the context of use. Inner and outer are different contexts. ISO/IEC 42001 wants controls matched to that context. One harness policy for “all AI” is how both jobs get the wrong stop.

What each harness actually owns

Workspace. Inner: a checkout, often sandboxed. Anthropic’s long-running harness keeps progress in git and files because the workspace is the filesystem. Outer: a job folder with people, budget, and attached systems — a workstream. Files may appear as artefacts. They are not the system of record.

Identity. Inner: the developer’s machine credentials, a repo token, maybe a sandbox role. Outer: org roster, workstream membership, named approver. The model is not the principal. Connector and permissions architecture is the outer identity plane.

Tools. Inner: shell, editor, tests, browser, maybe MCP to docs. Outer: CRM, ERP, warehouse, ticket systems, mail — default read, write as a separate plane. MCP can sit under both. The grant must not.

Guides. Inner: AGENTS.md, skills, directory-local rules. Outer: company wiki, playbooks versioned with the run. Mixing them is useful (engineering conventions in the repo; discount policy in the wiki). Collapsing them is how a style guide becomes “legal approval.”

Sensors. Inner: typechecker, unit tests, CI, architecture tests. Böckeler and Thoughtworks on sensors. Outer: payload schema, blast-radius cardinality, maker-checker, exportable ledger. A passing pytest does not mean Opportunity.Stage was authorised.

Stop. Inner: tests red, hook exit 2, max steps, human in the IDE. Outer: wait-for-named-signer, missing connector, budget, reject. Human-in-the-loop in a coding agent is “the developer kept going.” HITL in an outer harness is a first-class step with identity.

Eval. Inner: SWE-bench, Terminal-Bench, your suite. Outer: replay the signer; compare quote to SoR; see eval loops. Leaderboard scores are not a SOX control.

Memory. Inner: files, commits, session transcripts, memory files the next coding session loads. Outer: wiki + Lifecycle Graph so next quarter’s operator can ask why a field changed. Chat logs of a coding session are not institutional memory for RevOps.

Nimbus’s agent teams sit on the outer side: mandates, required connectors, approval triggers. You can still use an inner harness as a bounded tool behind a connector (for example a coding agent that only opens a draft PR). Do not let that inner harness become the orchestrator of record for a CRM write. Multi-agent architecture says the same thing with specialists: hands are not roles.

How they should sit together

Most companies need both. That is not a hedge. It is how software and operations already split.

Pattern that works. Engineers use Cursor or Claude Code on application repos. CI remains the merge sensor. Separately, RevOps and Finance run outer-harness jobs on Salesforce and NetSuite. If a coding agent must touch a live business system, it proposes an artefact; the outer harness quotes and gates the write. Two writers to the same object without a single quote is the failure multi-agent architecture already names.

Pattern that fails. One MCP mesh with production tokens, used from the IDE and from the chatbot and from the OS. Confused deputy. MCP for enterprise integrations.

Thoughtworks’ four layers — model, builder harness, user harness, organisational harness — map cleanly: Claude Code is builder + user on the inner side; the organisational layer is the outer operating model. Nimbus is one productisation of that outer layer, not the only one. AIP is a programme-shaped outer harness. Agentforce is CRM-anchored. Score scope and time-to-value separately. See self-service vs forward-deployed.

A week that uses both

Monday an engineer uses Cursor to fix a pricing calculator in the billing service. AGENTS.md says no raw SQL in the request path. A hook blocks git push --force. CI runs the unit suite. The PR is the artefact. CODEOWNERS signs the merge. That is a complete inner story. SWE-bench is relevant only as a vendor quality signal for the coding tool, not as a control.

Tuesday RevOps needs the list price on twenty renewals updated after Legal changed the cap in the playbook. The artefact is Salesforce. The signer is a named RevOps lead. The sensor is: quoted fields, hash, read-back. If Tuesday’s job is opened as a Cursor session with an MCP Salesforce server using a shared integration user, you have imported Monday’s workspace into Tuesday’s system of record. git log will not name the RevOps lead. Write-back did not fire because the inner harness does not have that interceptor.

Wednesday someone proposes “one agent for everything.” The honest architecture is: Monday’s harness stays. Tuesday’s job runs on an outer harness — in Nimbus, a workstream with the CRM connector, the wiki revision that contains the new cap, a Hard gate. If the calculator code must change as well, the outer job can spawn a bounded inner step that opens a draft PR. Two artefacts, two sensors, one company rule: unsigned SoR writes are impossible from either loop.

Thursday Security reviews MCP. The question is not “is MCP approved.” It is “which workspace may this server mutate.” Inner: sandbox and repo. Outer: workstream grant. Same protocol, different identity box. MCP for enterprise.

Friday you look at evals. Engineering posts a Terminal-Bench plot for the coding vendor. Finance asks who signed Amount. Those are not competing dashboards. They are different oracles. Eval loops.

Thoughtworks would call Monday layers 2–3 on a builder harness, Tuesday a delegation question on layer 4, and “one agent” a way to skip layer 4. Osmani would say engineering still owns verify-and-merge on Monday. Neither author is selling Nimbus. Both are describing why the cut exists.

If you only fund inner harnesses, Tuesday happens in paste and Slack. If you only fund outer harnesses, Monday happens in unsanctioned Cursor anyway. Fund both. Bind writes.

Inner vs Outer Agent Harness

Words you’ll hear

Why you should care

What each harness actually owns

How they should sit together

A week that uses both

Questions people actually ask

Is Cursor an enterprise harness if we SSO it?

Can Claude Code hooks replace write-back governance?

Should we ban coding agents until the OS is live?

Where does a copilot fit?

Is Nimbus trying to replace Claude Code?

What should I read next?

Sources

Related guides

What is an Enterprise Agent Harness

Agent Harness vs Agent Framework

See what governed AI looks like on your stack.