No, we’re not talking about shooting a perfume ad with a famous gorgeous person under contract with a horse on a beach, though if you’re not immersed in AI, you might have good reason to be confused. We’re talking about three components of the latest iteration of generative artificial intelligence: the model (aka Claude Opus) generates possibilities. The harness is (mostly) deterministic aka traditional code that controls and manages the output of the model and turns some of those possibilities into controlled actions. The thing we call an AI agent is the two working together to accomplish tasks independently, usually “outside” of the model but sometimes in.

OpenAI recently described the GPT-5.6 stack as three distinct layers: the model, the inference system that runs it, and the agentic harness used by Codex and ChatGPT Work. That separation is more important than it sounds. The industry routinely attributes the behaviour and benchmark performance of the whole deployed system to “the model,” even when much of what made the result possible happened outside the model altogether.

The clearest distinction is this: the model is the trained probabilistic component. The harness is the engineered software system surrounding it.

The model interprets language, handles ambiguity, generates a response and proposes what to do next. The harness assembles the model’s instructions and context, gives it access to tools, interprets its tool requests, enforces permissions, executes approved actions, returns the results, preserves state and decides when the process must stop.

Anthropic now uses the terms almost interchangeably, defining an agent harness, or scaffold, as the system that lets a model act as an agent. This is, quite literally, scaffolding in action.

There is still an important distinction between the words. Scaffolding is the broader design concept, not probablistic: prompts, context structures, tool descriptions, decomposition, memory, verification and constraints added around a model at inference time. The harness is the concrete runtime that assembles, executes and enforces much of that scaffolding. Scaffolding is the architecture; the harness is the machinery.

The model, the inference layer and the harness

A model is an architecture plus trained weights. Pretraining, post-training and fine-tuning alter those weights, so they change the model itself. The weights, however, are inert until an inference engine loads them and performs the calculations that turn input tokens into probabilities over possible output tokens.

The inference layer makes the model run. The harness makes repeated model inference useful as an agent.

That middle layer is easy to miss. Server routing, batching, caching, decoding and hardware optimization belong primarily to inference infrastructure. They can make a model faster and cheaper without changing either its learned capability or the logic of the agent wrapped around it, although decoding choices can also change its observed behaviour. “Reasoning effort” is normally an inference-time control: it changes how much reasoning work the running model is allowed or encouraged to perform without changing the model weights. OpenAI’s GPT-5.6 engineering account explicitly separates improvements to the model, inference stack and harness for this reason.

The harness sits above inference. It decides what the model gets to see, which actions it can request and what happens after it requests one.

None of these is an agent on its own. The deployed agent is the composite system.

What happens inside an agent loop

Suppose a user asks a coding agent (which is different from embedded functions referred to as agentic AI) to diagnose and fix a bug. The harness first builds the model’s working context: the user’s request, higher-priority instructions, relevant conversation history, available tool definitions, repository guidance and perhaps a summary of earlier work.

The inference system runs the model on that context. The model may produce a final answer, but it may instead generate a structured request to inspect a file. The harness parses that request, checks that the path and operation are permitted, runs the file-reading tool and appends the result to the model’s context. The model runs again, perhaps asks to edit the file, then asks to execute a test. Each request is validated and performed by the harness. The result of each action becomes evidence for the model’s next decision.

The cycle continues until the model supplies a final response or the harness stops it because it has reached a time, token, cost, safety or step limit. OpenAI’s description of the Codex agent loop lays out exactly this interaction.

The model proposes. The harness authorizes, executes and reports back. The model then reasons over the changed state. This repeated exchange is what converts token generation into apparent continuity of action.

Is the harness deterministic code?

Mostly, but the qualification matters.

The core control machinery is usually ordinary software: schemas, parsers, loops, permission checks, state machines, sandboxes, test runners, retry limits, logging and stop conditions. Given the same inputs and external state, these components can be designed to behave predictably. OpenAI describes its current agentic harness as a Rust orchestration layer connecting models, tools and the user’s environment.

But “harness” is a location in the system, not a guarantee that everything inside it is deterministic. A harness can call another model to route a task, summarize old context, judge an answer, select memories or coordinate subagents. Search results and external APIs can change. Concurrent processes can finish in different orders. Even a deterministic loop repeatedly invokes a probabilistic model.

The accurate formulation is therefore: the harness is where most deterministic scaffolding lives, but harness and deterministic scaffolding are not perfect synonyms.

This is where the Evans Ratio applies, and it shows definitively all agents are only effective because they are highly scaffolded, atomized or isolated. If Cp represents the probabilistic contribution and Cd represents deterministic scaffolding, the model falls predominantly on the Cp side, while the harness falls predominantly on the Cd side. Components, however, should be classified by function, not by the software that contains them. An LLM judge inside the harness remains probabilistic; a hard permission gate remains deterministic.

Can the model and harness be separated?

Yes, both conceptually and technically. The same model can be placed inside different harnesses, and the same harness can call different models through a stable interface. Anthropic’s Managed Agents architecture deliberately separates the session, harness and sandbox so implementations can be replaced independently. Codex can also be exposed through multiple products while retaining the same underlying harness.

This is why an API model is not the same product as Claude Code, Codex or another finished agent. A developer can take the same base model and build a research agent, coding agent or customer-service agent by changing the prompt assembly, tools, memory, permissions, environment and loop around it.

Separable does not mean interchangeable without cost. Models differ in the tool-call formats, context patterns, prompts and feedback structures that allow them to perform best. OpenAI now describes its Agents SDK as a “model-native” harness, while also warning that cross-provider abstractions can collapse richer provider-specific behaviour into a lowest common denominator. The harness can be swapped, but it may need to be retuned.

The reverse is also true: a harness can encode assumptions about a model’s weaknesses that become obsolete when the model improves. Anthropic found that context resets added to compensate for one Claude model’s tendency to finish early became dead weight with a later model. Model and harness can be separated, but their performance is coupled.

Does the harness make the model smarter?

Not in the sense of adding knowledge or changing the weights. It makes the model’s existing capability more usable.

A harness can retrieve missing evidence, divide a task into tractable steps, preserve intermediate state, let the model test its own answer, return errors for another attempt and prevent invalid actions. These mechanisms can produce a dramatic improvement in completed work. They do not prove that the underlying model acquired a corresponding increase in native intelligence.

A strong harness cannot manufacture judgment the model does not possess. A stronger model can also outperform a weaker one inside the same harness. System performance emerges from the fit between the two: what the model can infer, what the harness lets it observe and do, and how effectively the resulting loop detects and recovers from mistakes.

A modern harness is no longer a thin wrapper. It is becoming the principal design surface of an agent system.

That is why the vocabulary has recently shifted. OpenAI now explicitly calls the discipline “harness engineering”⁠. Anthropic is publishing detailed work on multi-agent harness design⁠, while Microsoft now documents agent harnesses⁠ as a distinct architectural layer.

The harness becomes more important as tasks become longer and agents gain more operational reach. It must increasingly design and manage:

• Context selection, retrieval, compaction and persistent memory
• Tool definitions, discovery, permissions and error handling
• Planning, delegation, retries and stopping rules
• Independent evaluation, testing and verification
• Sandboxes, credential isolation and human approvals
• Crash recovery, session durability and parallel execution
• Model routing, reasoning budgets, caching, latency and cost

Anthropic’s managed-agent architecture now separates the session, harness and execution sandbox so each can fail, scale or be replaced independently. That is distributed-systems architecture, not packaging. Anthropic⁠

The Evans Ratio wrinkle is that a more sophisticated harness does not necessarily mean *more* deterministic code. Modern harnesses can contain probabilistic planners, routers, memory selectors, evaluators and subagents. The harness is becoming more important as a system, while its internal balance between C_p and C_d can move in either direction. That makes the instruction to classify components by function rather than location essential.

The benchmark problem

This distinction changes how agent benchmarks should be read. Anthropic has been unusually explicit that SWE-bench evaluates the combination of model and software scaffolding, and that performance can vary substantially with the same model. In 2026, it also found that infrastructure configuration alone shifted Terminal-Bench results by as much as six percentage points in its experiments.

An agent score is therefore a system result. It may reflect a better model, a better harness, more compute, more retries, better tools, a more forgiving environment or some combination of them. A leaderboard that names the model but leaves the harness undisclosed is omitting part of the tested system.

The clearest way to identify the source of an improvement is an ablation: hold the model fixed and change the harness; then hold the harness fixed and change the model. If only the combined configuration is reported, the contribution of either layer cannot be isolated.

This is also why a performance jump with unchanged base architecture is not mysterious. Post-training may have improved how the model plans or uses tools. A new harness may have reduced context bloat, improved tool descriptions, introduced verification or allocated more attempts. Both can matter, but they are different claims and should be reported separately.

The simplest way to say it

The model supplies probabilistic judgment, reasoning, and somewhat unpredictable intelligence. The harness supplies structure, persistence, permissions and effect, to make the intelligence more reliable and predictable.

A model without an inference system is a set of inert weights. A model running without an agent harness can generate an answer, but it cannot independently inspect a file, execute a command or update an external system. A harness without a model can still run a predefined automation, but it loses the adaptive judgment that makes the path agentic rather than merely procedural.

The harness is not packaging around the intelligence. It is part of the operational intelligence of the deployed system. It determines what the model knows at each step, what it is allowed to attempt, how consequences return as feedback and which failures are caught before they propagate.

So yes: the harness is scaffolding in action. It is the running machinery in which scaffolding becomes control. Once the model and harness are separated analytically, many supposedly mysterious leaps in “model performance” become much easier to explain. Sometimes the model got better. Sometimes the system around it did. Most of the time, the agent we encounter is the result of both.