An agent harness is the software around a large language model that turns next-token prediction into work: tools, memory, a loop, permissions, and a stop. LangChain’s 2026 documentation writes the equation in plain type: Agent = Model + Harness. The model reasons. The harness is everything else.

That sentence is not marketing. An unaided model is stateless. It produces text. It cannot keep a file, call Salesforce, fail a linter, or refuse a write. The Wikipedia entry on agent harnesses records the same split, and notes that the UK’s AI Security Institute already described an AI agent as the model plus scaffolding in 2023. The industry spent two years arguing about which model was smartest. In 2026 it started arguing about which environment the model was sitting in.

Databricks uses a body-and-brain analogy: the model is the brain; the harness is the body and the workspace. LangChain’s anatomy post is more mechanical. A harness is every piece of code, configuration, and execution logic that is not the model itself. A raw model is not an agent. It becomes one when a harness gives it state, tool execution, feedback loops, and constraints that do not depend on the model’s mood.

This article is the definition. What is harness engineering is the practice of tightening that environment when the agent fails. Inner vs outer agent harness is the cut between a repo and a company. An enterprise agent harness is the outer case: operators, signers, a ledger.

Words you’ll hear

Harness / scaffolding. Same object, two eras. Scaffolding is the 2023–2024 research word. Harness is the 2026 product word. Both mean the runtime around the weights.
Agent. The composed system. Not the model. Not the chat UI. If you can swap the model and the job still runs, you were looking at the harness.
Loop. Plan, act, observe, repeat — the ReAct-shaped cycle popularised in 2022 and now owned by the harness, not by the prompt. The harness dispatches the tool, returns the result, and decides whether to continue.
Stop. Budget, max steps, empty retrieval, tool error, human cancel, wait-for-named-signer. “The model says it is done” is a suggestion. Anthropic’s note on building effective agents is honest about this: encoding the job and deciding what “done” means is the boring part that actually matters.
Tools / skills / MCP. Hands. The Model Context Protocol is a common plug so hosts can call the same servers. Plumbing. A plug is not a permission model. See What is Model Context Protocol.
Hooks / middleware. Deterministic intercepts on the loop. Claude Code hooks run shell or HTTP at PreToolUse and can block with exit code 2. LangChain middleware is the same instinct in a library. A line in CLAUDE.md is advice. A hook is a gate.
Guides and sensors. Birgitta Böckeler’s framing on martinfowler.com: feed-forward context (conventions, architecture, AGENTS.md) versus feedback (linters, tests, reviewers). A harness that only prompts is half a harness.
Inner harness. Coding agents: Claude Code, Cursor, Codex. Workspace is a repository. Tests are the eval. See inner vs outer.
Outer / enterprise harness. Operators. Connectors, workstreams, write-back, a ledger. Workspace is the company. A passing unit test does not prove a CRM write was authorised.

Nimbus is one outer harness: wiki, agent teams, workstreams, governance, Lifecycle Graph. Claude Code is a strong inner harness. Calling either “an agent” without naming the harness is how RFPs buy a model and inherit someone else’s loop.

Why you should care

McKinsey’s 2025 State of AI survey is the scale gap in one chart: most organisations use AI in at least one function; far fewer have begun to scale. Copilots produce usage. Harnesses produce jobs that finish under a stop. If your programme is “we rolled out ChatGPT Enterprise,” you have licensed a model surface. You have not yet chosen a harness for the work that writes back.

It affects you if:

the job is multi-step and tool-using, not a single completion
a live system can change (CRM, ERP, repo, ticket queue)
someone will ask, six months later, why a field or a file changed
you need to swap models without rewriting every tool
you already noticed that a better model still skips the linter, invents a policy, or pastes into Salesforce

In February 2024 a British Columbia tribunal held Air Canada responsible for a chatbot that invented a bereavement-fare policy. CBC reported that the airline’s argument — the chatbot is a separate legal entity — failed. That failure is a missing harness, not a missing model: no quote, no signer, no stop before a commitment left the building. In 2023 a New York court sanctioned lawyers who filed ChatGPT-invented cases. Ungated generation reached a system of record. CRM writes are the operational twin with money attached.

NIST’s AI RMF organises Govern, Map, Measure, Manage. ISO/IEC 42001 is an AI management system standard. Neither is implemented by a system prompt that says “be careful.” They are implemented by a runtime that can refuse a tool call.

Addy Osmani’s 2026 write-up states the engineering claim operators keep rediscovering: a decent model with a great harness beats a great model with a bad harness. When the agent does something dumb, the default instinct is to blame the weights. Harness engineering treats most of those failures as configuration. That is the rest of this cluster.

What a harness actually contains

LangChain’s anatomy and Databricks’s list converge on the same parts. You can inspect each one before you buy a product or assemble a library.

The loop. The harness owns plan → act → observe. It executes the tool. It feeds the result back. It enforces max steps and a cost budget so a stuck agent cannot run forever. Anthropic’s long-running harness note shows why this is not a prompt: tasks that outlast one context window need an initializer, incremental sessions, git commits, and a progress file the next session can read. The model does not remember. The environment does.

Tools and execution. Search, shell, apply_patch, browser, CRM, ERP. The model proposes a call. The harness runs it in a sandbox or against an adapter, handles timeouts, and returns structured results. A generic HTTP tool with a production token is not a harness. It is a confused deputy. OWASP’s Top 10 for LLM applications still applies: excessive agency and unbounded tool use are design failures, not model quirks.

Context and memory. Working memory is the current window. Session state is progress for this job. Durable memory is files, AGENTS.md, a wiki, or a graph — something that survives compaction. Anthropic’s initializer/coding-agent split is a memory design: feature lists and commits as cross-session state. A company that stores “what we approved” only in Slack search does not have durable memory for operations. See What is a lifecycle graph and What is a company wiki for AI agents.

Permissions and hooks. Who may call which tool, with which identity, on which object. Claude Code’s PreToolUse hook can deny Bash regardless of what the model intended. That is the inner version of write-back governance: the write API is unreachable until a named role signs a quoted payload. A prompt that says “ask Legal first” is not this layer. The model can forget. The user can paste anyway.

Feedback. Compilers, tests, linters, schema validators, human review. Böckeler’s sensors. Without them the loop is open: the model reports success and the harness believes it. Terminal-Bench and SWE-bench exist because coding harnesses can grade against an environment. Enterprise writes need an equivalent: did the signed payload match what executed. See eval loops for enterprise agent harnesses.

Orchestration. Subagents, hand-offs, model routing. Optional until the job already splits in the organisation. Multi-agent AI is the pattern. Agent team architecture is the hiring object. A harness that spawns specialists without a stop is a faster way to share a production login.

An agentic workflow is a designed sequence with business stops. The harness is the runtime that can actually run that sequence. Mixing those two words is how demos skip isolation. A workstream is the company object that hosts the job: brief, connectors, people, budget. In Nimbus the workstream is that folder; the harness is wiki + teams + connectors + gates + graph sitting around whichever model routing picks for the step.

What is not a harness

A chat window with plugins. The human is still the message bus, the permission system, and the audit log.

A system prompt. Advice inside the window. Useful. Not a stop.

A policy PDF. What is AI governance is a management claim. A harness is whether an unapproved write is impossible.

MCP on its own. A standard plug. See MCP for enterprise integrations. If the server can PATCH Salesforce from natural language, you built a bypass.

A framework on its own. LangChain’s create_agent is a way to assemble a harness. CrewAI, LangGraph, and Pydantic AI are in the same neighbourhood. You still have to choose tools, stops, and identity. See agent harness vs agent framework.

A copilot seat. ChatGPT Enterprise and Microsoft 365 Copilot are excellent personal surfaces. They are not, by default, a company loop with fail-closed writes. See How to choose between a copilot and a work OS and How to choose between a coding harness and an enterprise harness.

How this shows up in products

Coding harnesses. Claude Code, Cursor, Codex, open shells like OpenHands. Workspace is a checkout. CLAUDE.md / AGENTS.md are guides. Hooks, tests, and CI are sensors. Eval is SWE-bench or Terminal-Bench, or your own suite. These are the right shape for software.

Library harnesses. LangChain create_agent, Deep Agents, LangGraph graphs. You compose the loop in code. You own production identity. Good when the job is yours to engineer. A liability when operators are expected to “just add Salesforce.”

Enterprise / outer harnesses. Palantir AIP, Salesforce Agentforce, and self-service OS-class products such as Nimbus. The workspace is a job with connectors and people, not a git root. The interesting stop is a named signer on a quoted write, not a green test. How to evaluate an agent harness is the buying sheet.

Nimbus’s mapping is deliberate and not unique as a category: Perception orients, Conflux collaborates, agent teams run, governance quotes, the graph records. You can score that mapping against the parts above. You should score AIP and Agentforce the same way. Category names do not substitute for a failed write.

Questions people actually ask

Is the model the agent?

No. The agent is model plus harness. Shopping for a model is shopping for a chip. Shopping for a harness is shopping for how work finishes.

Do I need a harness for a single prompt?

No. A completion does not need a loop. Multi-step tool use does. Long-running work that outlasts one window does. Writes to live systems do.

Is RAG a harness?

Retrieval is a tool and a memory pattern inside a step. Enterprise RAG does not dispatch tools, enforce a signer, or persist a decision. Useful. Incomplete.

Can I just use MCP as my harness?

You can use MCP as the plug. You still need identity, scope, quoting, and a stop. The spec does not require those.

Will a better model shrink the harness?

Osmani and Anthropic’s long-running work both say the ceiling moves. Tasks that were unreachable come into play and bring new failure modes. Stronger models still do not know your signer, your budget, or your CRM field map.

How is this different from an enterprise AI OS?

An enterprise AI operating system is the company-shaped product: wiki, workstreams, teams, gates, ledger. A harness is the runtime idea underneath — including coding harnesses that are not an OS. Nimbus is an OS-class outer harness. Claude Code is not an OS. Both are harnesses.

What should I read next?

What is harness engineering for the practice. Agent harness architecture for the parts in one diagram. How to evaluate an agent harness before a vendor demo.

What is an agentic workflow, What is multi-agent AI, and What is write-back governance.

What is an Agent Harness