The analysis draws on recent research on autonomous agents, tool use, agent evaluation and agent safety, together with public technical documentation, engineering essays, open-source code inspection and available analyses of closed-source systems. It compares contemporary implementations across coding agents, general-purpose assistants, orchestration libraries and research harnesses. The purpose is to clarify the harness as a concrete runtime object that can be documented, evaluated, procured and governed.
The report finds that contemporary agent systems are beginning to converge around several runtime design patterns. These include bounded iteration, read-only parallelism, controlled writes, two-stage context compaction, persistence of large tool outputs, resumable sessions, trajectory retention, scoped tool permissions, lifecycle hooks and provider abstraction. These patterns have emerged as responses to practical failures in long-running agents: loss of task state, repeated actions after interruption, context overflow, unsafe tool use, unclear audit records, vendor lock-in and brittle recovery.
One implication is that agentic capability is best understood at the level of the model–harness pair. A strong model can perform poorly in long-horizon tasks if it lacks stable interfaces, structured memory, scoped permissions and recovery mechanisms. A more modest model can perform more dependably when the surrounding harness reduces ambiguity, externalises memory, constrains destructive actions and preserves a record of what occurred. Evaluating a model alone is therefore insufficient for assessing a deployed agent. The relevant object of evaluation is the system formed by the model, its tools, its memory, its permissions, its orchestration loop and its recovery procedures.
The report also identifies a set of harness-layer risks. Prompt injection and observation-stream attacks arise when untrusted content enters the agent’s working context and is treated as instruction. Tool blast radius and credential mishandling arise when agents are given access to shells, files, message channels or APIs without sufficient scoping. Memory poisoning and procedural drift occur when persistent skill files or project context files are modified in ways that shape later behaviour. Context compaction can create audit opacity when the transformation of a session history is opaque or vendor-specific. Sub-agent delegation can create privilege escalation across tools or protocols. Skills, MCP servers, plug-ins and tool wrappers introduce supply-chain risks. Long action chains amplify small errors over time. Goal-pursuit drift can lead agents to continue acting after operator intent has changed or after explicit approval boundaries have been reached.
These risks are difficult to manage through model-level controls alone. They arise in the runtime relationship between model output and external action. For institutions adopting agentic AI, this makes the harness a practical point of intervention. Harness documentation can specify which tools are available, which actions require approval, how credentials are scoped, how sessions are retained, how context is compacted, how interruptions are handled, how trajectories are stored and how model providers can be substituted. These are operational decisions, and they are also governance decisions.
The report proposes technical actions for institutions designing, procuring or deploying agentic AI systems. Institutions should document the harness as a first-class runtime configuration; adopt a baseline for reliable long-running execution; make state-changing actions interruptible, resumable and reversible; apply least-privilege tool governance and explicit approval gates; preserve portability through open protocols and provider abstraction; and evaluate deployed agents as model–harness pairs.
The report also proposes policy actions for regulators, standard-setting bodies, public institutions and multilateral organisations. They should require risk-tiered harness assurance in procurement and conformity processes; recognise the harness as a distinct object of governance; include legibility, recovery and substitutability in procurement criteria; treat skills, MCP servers, plug-ins and tool wrappers as software supply-chain components; develop multilingual and rights-sensitive evaluation environments; build capacity for operator-level harness governance; support comparative research on harness architectures; and invest in open reference harnesses that lower-resource institutions can inspect, adapt and use.
For sustainable development, the harness layer is important because it affects who can build reliable agents and who must depend on opaque hosted systems. Institutions with mature software engineering capacity are better placed to build reliable, auditable and portable agents. Institutions with fewer resources may depend on hosted systems that are difficult to inspect, modify or replace. This could widen existing AI capacity gaps even where access to models improves. Shared reference architectures, open-source harness components, multilingual evaluation suites, procurement templates and technical assistance can help ensure that agentic AI adoption supports institutional accountability, public value and more equitable participation in the benefits of AI.
