Agentic AI harnesses: the layer above the model

The LLM is replaceable. The harness is the investment.

A single harness can operate with multiple LLMs, and a well-designed harness outlasts successive model upgrades. ASD expects the harness ecosystem, with its integrations, governance mechanisms and operational processes, to become the more enduring organisational capability.

Most 'agent failures' are model-plus-harness failures.

A model may pick the wrong tool, use it incorrectly, lose context or propose an unsafe action. Whether that action executes depends on the harness. When an agent misbehaves, investigate the harness configuration as well as the model's reasoning, rather than only rewriting prompts.

Organisations control the harness, not the LLM.

ASD's three key takeaways: you control the harness; the harness is where long-term value, governance and investment accumulate; and the harness and its surrounding ecosystem are the primary focus for security and risk management.

Privilege risks

Agents granted excessive access or permissions, so a single compromise has far-reaching consequences. Least privilege and strong identity and access management are the primary controls.

Design and configuration risks

Insecure architecture, integration or setup that creates weaknesses before the system is operational. Secure-by-design and defence in depth apply here as they do to any enterprise system.

Behavioural risks

Agents pursuing goals in unintended ways, or being manipulated through prompt injection and data poisoning. Constrain access and require human approval for high-impact actions.

Structural risks

Failures cascading across interconnected components and multi-step workflows, obscuring where a failure originated. ASD advises treating a multi-agent system as a single agent for security purposes, because compromise propagates through shared context and trust.

Accountability risks

Complexity and opacity making it difficult to trace decisions, audit actions or assign responsibility. Audit and observability in the harness, plus clear human ownership of outcomes, address this.

Run it in a hardened, organisation-controlled environment

Contain only the tools and permissions the task needs. Restrict access to production systems, sensitive data and network services.

Encode policy in the harness, not the prompt

Apply secure coding standards, prohibit unsafe actions, validate tool parameters and outputs, and require human approval for sensitive or high-impact actions.

Verify outputs before operational use

Review, test and formally accept an agent's output before it goes into production. Confident-sounding text is not correct text. The harness may draft and act, but accountability stays with a person.

Put cost controls on APIs

Agentic sessions cost far more than a chatbot exchange. Monitoring token or compute consumption surfaces misuse, compromise, runaway loops and denial-of-wallet attacks.

Log everything and protect the logs

Record prompts, responses, tool invocations, approvals, actions, security events and configuration changes. Retain, review and independently monitor them for auditability and incident response.

Choose a trusted model, but do not rely on its safety controls

Assess provenance, limitations, security characteristics and behaviour. Model safety features are not a substitute for harness-enforced controls.

Keep context focused and least-privileged

Provide only the information and access the task needs. Delete stale context rather than summarising it, because summarisation rewrites the record. Save durable facts to external memory and start fresh sessions seeded with a concise summary.

Isolate exploration in sub-agents

Give sub-agents only the tools, permissions and context a bounded task requires. This limits exposure to untrusted content, keeps the primary session small, and reduces cost and context degradation.

Maintain a mandatory organisational rules file

Standards, prohibited areas, and build and test commands in a file the harness reads every session. Behaviour becomes consistent and reviewable instead of rediscovered each time.