From Agent Harness Engineering, https://openreview.net/forum?id=3hXEPbG0dh, May 2026

In the fall of 2025 we at Pattern Pulse AI produced some findings, demonstrating that agentic AI could only exist in production if the amount of scaffolding (deterministic code, sandboxing, itemization or isolation) was greater than the amount of AI programming. Every agentic development that has happened since including the recent Hugging Face incident and other agent “autonomy incidents” have validated this thinking. The higher the quality of an agent’s harness, the safer and more productive its agency becomes, and the mechanism producing that result is the transfer of decision authority out of the model and into deterministic code.

Agentic Ratio 3.0, published in February 2026, formalised this as the Consequentiality Constraint: E_safe ≤ k/O_c, where the probabilistic authority a system can safely exercise falls as the operational consequentiality of its task rises. Harness engineering is the practice of satisfying that constraint. Each layer of infrastructure wrapped around a model is a place where something the model would otherwise decide gets decided by code instead, and the quality of a harness is measured by how completely it makes that substitution at the points where the consequence of a wrong resolution is highest.

The convergence now has a map

A survey circulating under double-blind review at TMLR, Agent Harness Engineering, proposes a seven-layer taxonomy it calls ETCLOVG: execution environment, tool interface, context management, lifecycle and orchestration, observability, verification, and governance. It maps more than 170 open-source projects onto those layers, alongside engineering principles drawn from production deployments at OpenAI, Anthropic, and LangChain. Its organising claim is that task execution reliability depends less on the underlying model than on the infrastructure layer wrapping it, and that this layer deserves treatment as an independent engineering discipline with a three-phase lineage running from prompt engineering through context engineering to harness engineering.
Agentic Ratio 3.0 described this convergence five months before the survey catalogued it, naming atomization, protocols, deterministic controls, and reduced model authority as the direction the industry was already moving. The survey supplies the empirical map that the February analysis predicted, and it does so from inside the practitioner community rather than from a governance vantage point. Two of its cross-layer findings sit particularly close to the ratio. It names a capability-control tradeoff as a first-class design tension, which is the Consequentiality Constraint stated in engineering vocabulary. It also names a cost-quality-speed trilemma, which locates spend as a design axis rather than an afterthought.
The taxonomy’s most useful move for governance work is separating observability and governance from verification and treating each as an architectural concern in its own right. Prior six-component frameworks folded them in elsewhere. Pulling them out creates a named slot where permissions, approvals, and audit rules live, which is the slot a procurement specification has to point at when a buyer wants to know where accountability physically resides in a deployed system.

Every layer removes a decision

Walk the seven layers and the same operation repeats at each one. An execution environment decides what the model may touch, replacing a judgement about whether an action is safe with a boundary that makes the unsafe action unavailable. A tool interface decides what calling a capability looks like, replacing improvisation with a signature. Context management decides what the model sees, replacing the model’s selection of relevant material with a retrieval policy. Lifecycle and orchestration decides the sequence, replacing planning with a graph. Observability decides what gets recorded, removing the model’s account of its own behaviour as the source of truth. Verification decides whether output is acceptable, replacing self-assessment with an external check. Governance decides who may invoke any of it.

None of these makes the model better at deciding. Each one relocates a decision to a place where the outcome is determined in advance and inspectable afterward. That is why harness quality tracks safety and productivity together: the same substitution that narrows the range of things that can go wrong also narrows the variance that makes agent output unusable at volume. Reliability at scale is what a deployment gets in exchange for the authority it takes back.

This explains the survey’s headline claim more precisely than the survey does. Reliability depends on the harness because the harness is where the deterministic portion of the system lives, and the deterministic portion is the portion that behaves the same way twice. A finding phrased as the model mattering less is more accurately a finding about how much of a working agentic system consists of ordinary software.

Authority runs out before the layers do

The constraint that follows has no expression in the taxonomy. E_safe ≤ k/O_c binds regardless of how many layers a harness has, because the layers themselves are the mechanism for lowering exercised authority, and there is a floor beneath which lowering it further removes the agency the deployment was for.
Harden the environment, the tools, the context, the sequence, the logging, the checks, and the permissions, and what remains inside the boundary is the interpretive act: reading an underdetermined situation and selecting which resolution governs. That act is the reason a model is in the loop. It is also the only remaining place a failure can originate once everything around it behaves deterministically. Hardening it means specifying the resolution in advance, at which point the system is a workflow with a language model attached rather than an agent.
So harness engineering has a productive range, and the range contracts as consequentiality rises. At low O_c, layers buy a great deal: an agent triaging tickets or drafting summaries can operate with wide interpretive latitude because a wrong resolution is cheap to catch and cheap to reverse. At high O_c, the same seven layers deliver progressively less, because the residual authority required for the task to be worth automating is itself the thing that cannot be made safe by wrapping. Past that point the honest engineering decision is to stop delegating the decision, and no amount of additional infrastructure substitutes for making it.

The survey’s own open-problem agenda gestures at this from the other direction when it names harness coupling as an unsolved issue. Layers interact. Adding them introduces failure modes belonging to the harness rather than to the model, which means the returns on additional containment are not merely diminishing at some point but negative.

The capability objection

The strongest argument against treating this as structural runs as follows: models improve, improved models need less wrapping, and the whole apparatus is a temporary scaffold around a transitional weakness. On this reading the ceiling recedes with each generation, harness engineering is a phase, and designing governance around a constraint that capability will dissolve wastes effort on a problem with an expiry date.

The evidence for it is real. Longer effective context reduces what context management has to do. Better instruction adherence reduces the verification burden. Native tool use makes parts of the tool interface layer redundant. Anyone who built agent infrastructure in 2024 has watched pieces of it become unnecessary.
The reply is that capability improvement acts on competence and leaves the underdetermination untouched. A model resolves ambiguity by probability, which identifies the statistically likely reading and cannot establish which reading holds authority. Improving the model improves the execution of whichever resolution wins. It does not supply the missing authority signal, and at high consequentiality the cost of a confidently executed wrong resolution rises with capability rather than falling. This is why the layers that have proven most durable are the ones furthest from model competence. Sandboxing, permissioning, and audit have not been absorbed by better models in any generation so far, and the reason is that they were never compensating for a deficiency in the first place.

What this changes for buyers

For anyone specifying an agentic system, the operative question is which decisions have been moved out of the model and whether the ones remaining inside it match the consequence of the task. A vendor claiming reliability improvements should be able to say which ETCLOVG layer produced them. Improvements sourced from the execution, tool, orchestration, and governance layers are durable, because they are properties of software. Improvements sourced from model behaviour are conditional on the model, the prompt, and the session, and they degrade in ways the buyer will observe before the vendor does.

The measurement problem the survey leaves open is how much containment a given deployment needs, which is the question a taxonomy cannot answer and a ratio can. Consequentiality is assessable before deployment, from the reach of the actions available and the reversibility of the worst outcome, without relying on anything the system reports about itself. That assessment sets the authority budget. The harness is how the budget gets spent.