07.05 · Short-concept
Your Agent Has the Keys
Describe what an agent harness is - the loop it runs, the context it is handed, and the limits placed on it - which is the layer where an agent's reach is actually bounded.
An agent harness is the host-side control layer that runs the model, feeds it context, exposes tools, and decides when to stop. Its permissions, credentials, validators, approvals, and runtime sandbox define the agent’s real blast radius, not the model’s text output or the task description.
What this lesson answers
- what is an agent harness in deployment
- how do agent tools get bounded safely
- why model context is not agent authorisation
Notes
Agent Harness — An agent harness exists to run the model-tool loop with explicit context, permissions, and stopping rules; without it, a model with tool access can accidentally read, modify, or exfiltrate anything its runtime credentials can reach.
Key Concepts: - The harness loop is typically until a stop condition such as tool calls, , or a terminal response is reached. - The model does not “have access” directly; the harness passes bounded inputs such as a system prompt, the current task, selected files…
References
Common questions
- What does an agent harness actually do?
- An agent harness runs the loop around a model: gather state, ask the model what to do, execute approved tool calls, then feed results back. It also supplies the prompt, task, selected files, tool definitions, credentials, and stop conditions. That surrounding code is where practical control lives.
- Where is an agent’s blast radius really controlled?
- Blast radius is controlled by the authority available to the harness at runtime. If the process has broad cloud credentials, write access to production, or an unrestricted shell, the agent can affect those systems. Safer bounds come from narrow IAM scopes, containers, network rules, path checks, and approval gates.
- Is putting data in the prompt the same as granting access?
- No. Prompt context gives the model information, but it does not by itself grant operational power. A pasted secret can still be disclosed or misused in generated output, but mounted credentials, API tokens, kubeconfigs, and executable tools are what let the harness take real actions against external systems.