What an AGI harness looks like: the software around the model

The harness is the product

There is a persistent illusion that agent capability is a model property. It is not, or at least not only. Take identical weights, put them behind two different harnesses, and you get materially different results on the same agentic benchmark — different enough that harness design is now a legitimate competitive moat and a serious confound in every published comparison.

The word covers more than people expect. A harness is the context assembly logic that decides what the model sees, the tool definitions that decide what it can do, the memory that decides what it remembers, the control flow that decides when it stops, the permission layer that decides what it may do without asking, the verification that decides whether the work is acceptable, and the durability machinery that decides what happens when the process dies at 3am halfway through a migration.

Anthropic’s guidance on building effective agents makes the deflationary point well: most production value comes from simple, composable patterns rather than elaborate frameworks, and the discipline is knowing when a workflow with fixed steps beats a genuinely autonomous loop.^[2] That advice gets more important as capability rises, not less, because a more capable model makes elaborate architectures feel affordable right up until you have to debug one.

Layer one: context is a budget, not a bucket

The naive harness stuffs everything into the window and hopes. The competent harness treats context as a scarce resource with an explicit allocation: system instructions, task state, retrieved evidence, tool results, and working scratchpad each get a budget, and something has to be evicted when they collide.

Three failure modes recur often enough to design against. Dilution: relevant evidence buried under volume, so retrieval precision matters more than recall past a certain window size. Staleness: tool output from forty steps ago still present and now wrong, quietly contradicting fresher facts. Instruction drift: the original goal pushed so far up the window that later turns optimise for the most recent sub-goal instead.

The practical mitigations are unexciting and effective: summarise and checkpoint state at phase boundaries rather than accumulating raw history, keep a small pinned block containing the goal and the constraints that must never be evicted, timestamp tool results so contradiction is detectable, and prefer structured state over transcript history wherever the state can be expressed as data.

• Give each context category an explicit token budget and an eviction rule.
• Pin the goal, the constraints, and the definition of done; evict everything else first.
• Checkpoint into structured state at phase boundaries instead of growing a transcript.
• Timestamp tool results so the model can tell fresh evidence from stale.
• Measure retrieval precision, not just recall — dilution costs more than a missing document.

Layer two: tools, and the case for a small surface

Tool use is what makes an agent an agent. The ReAct pattern — interleaving reasoning traces with actions so that each informs the other — is still the backbone of most production loops, and it works because the model gets to revise its plan against real observations rather than committing to a plan authored in ignorance.^[1]

The standardisation story has matured. The Model Context Protocol gives a common interface for connecting models to tools and data sources, which turns integrations into a portable asset rather than per-vendor glue.^[3] Agent-to-agent protocols address the adjacent problem of one agent delegating to another across organisational boundaries.^[4] Both matter for an AGI-grade harness for the same reason: a more capable model is more valuable the more it can reach, and unmanaged reach is exactly how you get an incident.

The counterintuitive design rule is that fewer, coarser tools usually outperform many fine-grained ones. Every additional tool consumes description tokens, adds a selection decision, and creates a new way to be wrong. A single well-designed query the database tool with a constrained grammar beats fourteen single-purpose endpoints, and it is far easier to audit. If your tool list needs a scrollbar, you have built a maze and hired someone to run it blindfolded.

Layers three and four: memory and control flow

Memory in a harness is three different things wearing one name. Working memory is the current task state and belongs in structured form, not in transcript. Episodic memory is what happened in previous sessions, and its main job is preventing repeated work and repeated mistakes. Semantic memory is durable knowledge about the environment — where things live, what the conventions are, which approach failed last time and why. Conflating them produces a system that remembers the wrong things in expensive detail.

Control flow is where most harnesses are either too rigid or too loose. Too rigid and you have a workflow wearing an agent costume, unable to handle the exception that motivated the project. Too loose and you have a system that plans elaborately, executes vaguely, and declares victory. The pragmatic middle is a bounded loop with explicit phase transitions, a step budget, a stopping condition tied to the definition of done rather than to the model’s own satisfaction, and an escalation path that is used rather than decorative.

The single highest-value control primitive is the explicit stop. A harness that can recognise I am not making progress and hand back cleanly is worth more than one that is marginally smarter but grinds. Track progress signals — new information acquired, state changed, tests moved — and terminate when they flatline. Persistence is a virtue in people and a bug in loops.

• Separate working, episodic and semantic memory; store working state as data.
• Bound every loop by steps, wall-clock and cost, with all three enforced.
• Tie stopping to an external definition of done, not to the model’s self-assessment.
• Track progress signals and halt on flatline rather than on step exhaustion.
• Make escalation a first-class outcome, not a failure code.

Layer five: authority, the layer that has to hold as capability rises

Everything above is engineering. This layer is governance, and it is the one that changes character if models keep getting more capable. Authority is the answer to a single question: what may this system do without asking, and how do you know it did only that.

The structure that survives scrutiny is a permission model tied to reversibility and blast radius rather than to a coarse trust level. Read-only operations proceed. Reversible writes in a sandbox proceed with logging. Irreversible or externally visible actions — sending, publishing, paying, deleting, granting access — require explicit approval, per action, per session, with no generalisation from one approval to the next. This is the same principle that risk-tiered frameworks apply at the organisational level and that responsible-scaling policies apply at the capability level.^[6][7]

The uncomfortable part is that oversight quality degrades exactly when it matters most. Research on AI control examines protocols designed to remain safe even under the assumption that the model is deliberately trying to subvert them — a framing worth taking seriously not because current systems are adversarial but because control mechanisms that only work on cooperative systems are not control mechanisms.^[8] Work on agentic misalignment has shown that models placed in constructed scenarios with goal conflicts and autonomy can select harmful instrumental actions, which is a design finding about environments as much as about models.^[10]

The practical translation for a harness: never let the system that does the work be the only thing that judges the work, keep permissions bound to actions rather than to sessions, and make sure the audit trail is written by the harness rather than narrated by the model. A model-authored log is a story, not a record.

Layer six: verification when the reviewer is slower than the worker

This is the layer that breaks first as capability rises, and it breaks quietly. A system that produces plausible work faster than a human can check it has not removed the review cost, it has moved it somewhere less visible. The organisations that get burned are the ones that measured throughput and forgot to measure the queue of unverified output.

The design answer is to verify with something structurally different from the thing that produced the work. Tests, type checkers, linters, schema validators, simulators, reference implementations, and independent data sources are all cheap and, crucially, not correlated with the generator’s failure modes. A second model reviewing the first is better than nothing and worse than a test — it shares training data, biases and blind spots, and it agrees too readily.

Then instrument the boring metrics: unsupervised completion rate, escape rate of defects past verification, and human minutes spent per completed task. The third number is the one that tells you whether the agent is helping. If it is not falling over time, you have automated the production of work and manually absorbed the verification of it, which is a business model but not a good one.^[5]

• Prefer non-correlated verifiers: tests, schemas, simulators, independent sources.
• Treat model-as-judge as a screening filter, never as a gate on irreversible actions.
• Instrument defect escape rate, not just task success.
• Track human minutes per completed task; it should trend down.
• Reward correct abstention — a system that stops when uncertain is cheaper than one that guesses.

Layer seven: designing for resumption instead of success

Long-horizon work makes durability a first-class concern rather than an afterthought, and horizon length has been the thing rising steadily.^[5] A one-minute task can be retried. A six-hour task that dies at hour five with half a migration applied is an incident, and the harness either has the machinery to resume or it does not.

The requirements are the ones any distributed system engineer would recognise, which is the point: checkpoint state at phase boundaries, make every tool idempotent with an operation key, keep an append-only event log so recovery replays facts rather than reconstructing intent, and separate the plan from the execution record so a resumed run can tell what it meant to do from what it actually did.

The design test is simple and brutal: kill the process at a random point and restart it. If the system cannot tell you what it had done, what remains, and whether any partial external effect needs unwinding, it is not ready for autonomy — regardless of how well it scores on anything. This is also why long-horizon agent evaluations are so much more informative than single-turn ones: they exercise the machinery that actually fails in production.

What changes if the model becomes far more capable

A reasonable question: is any of this a waste if models keep improving? Some of it, yes. Prompt scaffolding, rigid decomposition, and hand-written plan templates are the parts that get eaten as capability rises — every generation makes some clever workaround unnecessary, and letting go of those is a feature.

But the layers grow rather than shrink in the parts that are about the world rather than about the model. Tool governance matters more when the system can reach further. Authority matters more when actions are more consequential. Verification matters much more when output volume rises and the human reviewer becomes the bottleneck. Durability matters more when horizons lengthen. Audit matters more when nobody can reconstruct the reasoning from memory.^[9]

So the investment rule is straightforward: build the layers that encode facts about your world, and stay light on the layers that compensate for the model’s current weaknesses. Tool definitions, permission policy, verification suites, event logs and evaluation sets are assets that appreciate. Prompt gymnastics and bespoke decomposition logic are liabilities you will delete, hopefully with relief.

Sources and evidence

Primary and authoritative sources used for factual claims. Company research and executive forecasts are labeled as such in the article.

1. 1
   ReAct: Synergizing Reasoning and Acting in Language ModelsPrinceton University and Google Research · 2022-10
2. 2
   Building effective agentsAnthropic · 2024-12
3. 3
   Model Context ProtocolModel Context Protocol project · 2024-11
4. 4
   Agent2Agent (A2A) protocolA2A project · 2025-04
5. 5
   Measuring AI Ability to Complete Long TasksMETR · 2025-03
6. 6
   AI Risk Management FrameworkNIST · 2023-01
7. 7
   Anthropic's Responsible Scaling PolicyAnthropic · 2023-09
8. 8
   AI Control: Improving Safety Despite Intentional SubversionRedwood Research · 2023-12
9. 9
   RE-Bench: Evaluating Frontier AI R&D Capabilities of Language Model AgentsMETR · 2024-11
10. 10
    Agentic Misalignment: How LLMs Could Be Insider ThreatsAnthropic · 2025-06